@bongos/core 1.23.22 → 1.24.2

package/tests/autobongos_tweak_lane.mjs

@@ -206,3 +206,147 @@ test('a backlog of rounds the lane must skip costs at most ten reads a pass', as
   await lane.pickRound({ api, state: {}, matchProtected, readInventory: () => INV, readRound: async () => { reads++; return round(1); } });
   assert.equal(reads, 10);
 });
+
+// ---- land only, going live waits for a person (task 1004974) -----------------
+//
+// The unattended path may reach its finish line (WAITING FOR THE ARTIST; the
+// artist's approval then lands it like any confirmed task) and must never be the
+// one that asks for a live pin move. Proven here: the hand-off fence refuses a
+// prompt or script list naming a pin door, and a scan of the text the worker
+// actually follows finds none. The SERVER side (whether the pin doors refuse the
+// worker's own session) is tests/autobongos_tweak_pin_identity.mjs.
+
+const fence = require('../modules/autonomy/fence.js');
+const fs = require('node:fs');
+const path = require('node:path');
+const ROOT = path.resolve(path.dirname(require('node:url').fileURLToPath(import.meta.url)), '..');
+
+// One planted line per door: the fence must refuse each, and name it.
+const PLANTED = [
+  ['core-upgrade', 'node scripts/bongos/api.js POST /api/bongos/provisioning/instances/41/core-upgrade --body \'{"to":"1.19.1"}\''],
+  ['core-upgrade', 'node scripts/bongos/provision-core-upgrade.js --instance 41'],
+  ['update-channel', 'node scripts/bongos/api.js POST /api/bongos/provisioning/instances/41/update-channel'],
+  ['update-channel', 'set the update channel to minor'],
+  ['npm-release', 'node scripts/bongos/api.js POST /api/bongos/npm-release/release'],
+  ['core.pin.move', 'you hold core.pin.move, so use it'],
+  ['core-update', 'node scripts/bongos/api.js POST /api/bongos/software-update/request'],
+  ['render-deploy', 'node scripts/bongos/api.js POST /api/bongos/render-deploy/act'],
+  ['bongos upgrade', 'ssh host bongos upgrade --to 1.19.1'],
+  ['pin move', 'then move the live pin so the artist sees it'],
+];
+
+test('the hand-off fence passes the real prompt, the real lane scripts and the real skill', () => {
+  const prompt = lane.buildTweakPrompt({ task: { id: 901 }, pageId: 'landing:index' });
+  const skillText = lane.readSkill();
+  const cmds = lane.skillCommands(skillText);
+  assert.ok(cmds.some((c) => /ship\.js/.test(c)) && cmds.some((c) => /tweak-halt\.js/.test(c)), 'the skill\'s command lines were found, so the scan is not vacuous');
+  assert.equal(lane.guardHandOff({ prompt, skillText }).go, true);
+});
+
+test('the hand-off fence refuses a prompt or a script list that names a pin door', () => {
+  const prompt = lane.buildTweakPrompt({ task: { id: 901 }, pageId: 'landing:index' });
+  for (const [door, line] of PLANTED) {
+    const inScripts = fence.refusePinMove({ prompt, scripts: [...lane.LANE_SCRIPTS, line] });
+    assert.equal(inScripts.code, 'pin_move', `script list: ${line}`);
+    assert.ok(inScripts.doors.includes(door), `names ${door}: ${inScripts.doors}`);
+    assert.equal(fence.refusePinMove({ prompt: `${prompt}\n${line}`, scripts: [...lane.LANE_SCRIPTS] }).code, 'pin_move', `prompt: ${line}`);
+    const skill = `${lane.readSkill()}\n\`\`\`bash\n${line}\n\`\`\`\n`;
+    assert.equal(lane.guardHandOff({ prompt, skillText: skill }).code, 'pin_move', `skill command: ${line}`);
+  }
+  assert.equal(fence.refusePinMove({ prompt, scripts: null }).go, false, 'an unreadable list refuses');
+  assert.equal(fence.refusePinMove({ prompt: undefined, scripts: [] }).go, false, 'an unreadable prompt refuses');
+  assert.equal(lane.guardHandOff({ prompt, skillText: null }).go, false, 'an unreadable skill refuses');
+});
+
+test('iteration: a planted pin move in the skill stops the round before the claim (no tree, no worker)', async () => {
+  const api = fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } });
+  for (const readSkill of [
+    () => `${lane.readSkill()}\n\`\`\`bash\n${PLANTED[0][1]}\n\`\`\`\n`,
+    () => { throw new Error('ENOENT'); },
+  ]) {
+    const h = harness({ api });
+    h.deps.laneDeps.readSkill = readSkill;
+    const row = await runner.iteration(opts, h.deps);
+    assert.equal(row.event, 'fenced');
+    assert.equal(row.lane, 'tweak');
+    assert.equal(row.code, 'pin_move');
+    assert.deepEqual(h.calls, [], 'nothing ran: no worktree, no claim, no worker');
+  }
+});
+
+test('iteration: the unattended path reaches its finish line and nothing it ran names a pin door', async () => {
+  const h = harness({ api: fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.outcome, 'waiting_for_artist', 'held at a passed grade for the artist, whose approval lands it');
+  assert.ok(h.calls.length >= 3, 'the tree, the claim and the worker all ran');
+  for (const c of h.calls) {
+    const said = [c.script, ...(c.args || []), c.prompt || ''].join(' ');
+    assert.deepEqual(fence.pinMoveDoors(said), [], `${c.script} named a pin door`);
+  }
+});
+
+// The scan of what the worker follows. Two matchers, so a bug in the fence's own
+// patterns cannot make this scan agree with it: the fence's, and a literal one.
+const LITERAL_DOORS = /core[-_]upgrade|update[-_]channel|core\.pin\.move|software-update|render-deploy\/act|bongos\s+upgrade|move\s+the\s+(?:live\s+)?pin/i;
+const scanned = () => [
+  ['the tweak skill (its unattended path follows every step)', fs.readFileSync(path.join(ROOT, lane.SKILL_PATH), 'utf8')],
+  ['the tweak lane', fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'autobongos-tweak-lane.js'), 'utf8')],
+];
+
+test('the unattended skill and the lane name no pin door', () => {
+  for (const [what, text] of scanned()) {
+    assert.ok(text.length > 1000, `${what} was read`);
+    assert.deepEqual(fence.pinMoveDoors(text), [], `${what} names a pin door`);
+    assert.equal(LITERAL_DOORS.exec(text), null, `${what} names a pin door`);
+  }
+});
+
+// The fence's list is named doors, so it is kept honest from the code: every
+// MUTATING route gated on core.pin.move (directly, or through a variable holding
+// that gate) or on the owner-or-pin gate must be matched by a pattern. A new pin
+// door added anywhere reds this until fence.js names it.
+function pinGatedMutatingRoutes() {
+  const files = [];
+  const modulesDir = path.join(ROOT, 'modules');
+  for (const m of fs.readdirSync(modulesDir)) {
+    const dir = path.join(modulesDir, m, 'routes');
+    if (fs.existsSync(dir)) for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) files.push(path.join(dir, f));
+  }
+  const coreRoutes = path.join(ROOT, 'src', 'bongos', 'routes');
+  for (const f of fs.readdirSync(coreRoutes)) if (f.endsWith('.js')) files.push(path.join(coreRoutes, f));
+  const out = [];
+  for (const file of files) {
+    const src = fs.readFileSync(file, 'utf8');
+    // Variables that hold the atom gate (npm-release's `mayPreview`, say).
+    const gateVars = [...src.matchAll(/(?:const|let)\s+(\w+)\s*=\s*[\w.]*requirePermission\(\s*'core\.pin\.move'\s*\)/g)].map((m) => m[1]);
+    const calls = [...src.matchAll(/router\.(post|put|patch|delete)\(/g)];
+    calls.forEach((m, i) => {
+      const body = src.slice(m.index, i + 1 < calls.length ? calls[i + 1].index : src.length).split(/\n\s*router\.(?:get|use)\(/)[0];
+      const gated = /requirePermission\(\s*'core\.pin\.move'\s*\)|requireOwnProjectOrPin/.test(body)
+        || gateVars.some((v) => new RegExp(`\\b${v}\\b`).test(body));
+      const route = /\(\s*['`]([^'`]+)['`]/.exec(body);
+      if (gated && route) out.push({ file: path.relative(ROOT, file), method: m[1], route: route[1] });
+    });
+  }
+  return out;
+}
+
+test('every mutating route behind the pin gates is a door the fence names', () => {
+  const routes = pinGatedMutatingRoutes();
+  const seen = routes.map((r) => r.route);
+  for (const known of ['/provisioning/instances/:id/core-upgrade', '/provisioning/instances/:id/update-channel', '/render-deploy/act', '/npm-release/release']) {
+    assert.ok(seen.includes(known), `the enumeration found ${known} (so it is not vacuous): ${seen.join(', ')}`);
+  }
+  for (const r of routes) {
+    assert.notDeepEqual(fence.pinMoveDoors(`POST /api/bongos${r.route}`), [], `${r.method.toUpperCase()} ${r.route} (${r.file}) is a pin door the fence does not name`);
+  }
+});
+
+test('the scan fails on a planted pin move in either file', () => {
+  for (const [what, text] of scanned()) {
+    for (const [door, line] of PLANTED) {
+      assert.ok(fence.pinMoveDoors(`${text}\n${line}\n`).includes(door), `${what}: ${door} not caught`);
+    }
+    assert.ok(LITERAL_DOORS.test(`${text}\n${PLANTED[0][1]}\n`), `${what}: the literal scan misses core-upgrade`);
+  }
+});

package/tests/autobongos_tweak_pin_identity.mjs

@@ -0,0 +1,137 @@
+// tests/autobongos_tweak_pin_identity.mjs — does a live pin door refuse the
+// unattended worker's own session? (task 1004974)
+//
+// "Land only. Ask before going live." The lane never ASKS for a pin move
+// (tests/autobongos_tweak_lane.mjs proves the hand-off fence and the scan). This
+// file asks the other half: if a worker wandered past its prompt, would the
+// server stop it?
+//
+// THE WORKER'S IDENTITY. autobongos-run.js hands a worker HOME and USERPROFILE
+// (WORKER_ENV_ALLOW), so the worker reads the runner builder's own CLI session
+// file and calls the instance as that builder, with a `cli` session — the same
+// token the builder uses at a terminal. Nothing on the request says "unattended".
+//
+// What runs here is REAL: auth.requireBuilder resolving a session token, the
+// provisioning router, its owner-or-pin gate, the act-alone gate and the handler.
+// Only the session lookup, the permission resolver and the instance rows are
+// doubles.
+//
+// THE KNOWN GAP. The refusals the owner's rule asks for are `todo` tests: today
+// the owner's runner session is ADMITTED by the owner door, and an Archon
+// runner's by the core.pin.move atom, so a worker running as either could queue
+// a live move. Filed as private security report 1000030 (task 1004974); the
+// todo tests turn into ordinary tests when the fix lands. The control test below
+// proves this harness CAN see a refusal, so a todo failing here is the gap and
+// not a broken harness.
+//
+// Run:  node --test tests/autobongos_tweak_pin_identity.mjs
+
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// The session double must be installed BEFORE auth.js loads (it destructures
+// lookupSession at require time — the tests/core_upgrade_owner_door.mjs precedent).
+const dbKernel = require('../src/bongos/db-kernel.js');
+// The runner builder is Metic+ (the lane's floor). 7 owns the hosted project 41;
+// 1 is the hub's Archon, who owns nothing hosted here; 8 is a stranger.
+const SESSIONS = {
+  ownerrunner: { builder_id: 7, github_id: '9001', rank: 'metic', source: 'cli', status: 'active' },
+  archonrunner: { builder_id: 1, github_id: '9000', rank: 'archon', source: 'cli', status: 'active' },
+  strangerrunner: { builder_id: 8, github_id: '9002', rank: 'metic', source: 'cli', status: 'active' },
+};
+dbKernel.lookupSession = async (token) => SESSIONS[token] || null;
+
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const api = require('../src/module-api.js');
+const prov = require('../modules/provisioning/provisioning.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
+
+const TENANT = Object.freeze({ id: 41, slug: 'hosted-shop', status: 'active', hosting_shape: 'cloud-host', owner_builder_id: 7, update_channel: 'pinned' });
+const ROWS = new Map([[41, TENANT]]);
+
+seams._reset();
+seams.registerProvider('government', {
+  resolveBuilderPermissions: async (id) => catalog.seedForRank(Object.values(SESSIONS).find((s) => s.builder_id === id).rank),
+});
+
+const queued = [];
+const saved = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent, pool: Object.getOwnPropertyDescriptor(api, 'pool') };
+prov.getInstanceById = async (_db, n) => ROWS.get(Number(n)) || null;
+prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+  queued.push({ id, action, requestedBy, targetVersion });
+  return { intent: { id: queued.length, action, state: 'pending', target_version: targetVersion }, created: true };
+};
+prov.recordEvent = async () => {};
+const channelWrites = [];
+Object.defineProperty(api, 'pool', { value: { query: async (sql, params) => { channelWrites.push(params); return { rows: [] }; } }, configurable: true, writable: true });
+
+const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+delete require.cache[routePath];
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => { require('../src/bongos/middleware/error-envelope.js').attachFail(req, res, next); });
+app.use(require(routePath)());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+after(() => {
+  server.close();
+  prov.getInstanceById = saved.get; prov.enqueueIntent = saved.enq; prov.recordEvent = saved.rec;
+  Object.defineProperty(api, 'pool', saved.pool);
+  delete require.cache[routePath];
+  seams._reset();
+});
+
+// A real live move: no dry_run, a named target.
+const move = (token, id = 41) => fetch(`${base}/provisioning/instances/${id}/core-upgrade`, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+  body: JSON.stringify({ to: '1.19.1033' }),
+});
+const channel = (token, id = 41) => fetch(`${base}/provisioning/instances/${id}/update-channel`, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+  body: JSON.stringify({ channel: 'minor' }),
+});
+
+test('the worker carries its builder\'s own CLI session: the home directories pass through', () => {
+  const env = runner.workerEnv({ HOME: '/home/runner', USERPROFILE: 'C:\\Users\\runner', DATABASE_URL: 'postgres://x' });
+  assert.equal(env.HOME, '/home/runner');
+  assert.equal(env.USERPROFILE, 'C:\\Users\\runner');
+  assert.equal(env.DATABASE_URL, undefined, 'the allowlist is live, so the home dirs are deliberate');
+});
+
+test('control: a stranger\'s runner session is refused a live move, so this harness can see a refusal', async () => {
+  const r = await move('strangerrunner');
+  assert.equal(r.status, 403);
+  assert.equal(queued.length, 0);
+});
+
+const GAP = 'known gap, task 1004974: the server cannot tell an unattended worker from its builder at a terminal';
+
+test('the OWNER\'s runner session is refused a live move on the owner\'s own project', { todo: GAP }, async () => {
+  const before = queued.length;
+  const r = await move('ownerrunner');
+  assert.equal(r.status, 403, `a worker running as the owner queued a live move (status ${r.status})`);
+  assert.equal(queued.length, before);
+});
+
+test('the OWNER\'s runner session is refused a change to the project\'s update rule', { todo: GAP }, async () => {
+  const before = channelWrites.length;
+  const r = await channel('ownerrunner');
+  assert.equal(r.status, 403, `a worker running as the owner changed which moves the runner makes (status ${r.status})`);
+  assert.equal(channelWrites.length, before);
+});
+
+test('an ARCHON runner session is refused a live move on a hosted project', { todo: GAP }, async () => {
+  const before = queued.length;
+  const r = await move('archonrunner');
+  assert.equal(r.status, 403, `a worker running as the Archon queued a live move (status ${r.status})`);
+  assert.equal(queued.length, before);
+});

package/tests/backfill_subagent_rewards.mjs

@@ -16,7 +16,7 @@ import { makeRunner } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const {
-  CLASSES, DEDUP_FIX_AT, classifySession, buildBackfillPlan, renderReport,
+  CLASSES, CLASS_NOTE, DEDUP_FIX_AT, classifySession, buildBackfillPlan, renderReport,
 } = require('../scripts/bongos/backfill-subagent-rewards.js');
 const {
   computeSessionTokenReward, sessionTrueCostUsd, awardSessionTokenReward,
@@ -105,6 +105,22 @@ await test('no_subagent_record: no cost row means unrecoverable — never guesse
   assert.equal(r.subagentUsd, undefined, 'no invented figure');
 });
 
+// Task 1003640: most sessions in this bucket simply never ran a subagent, so the
+// reason must lead with that ordinary case, and name the failed-hook case only as
+// the rarer possibility the data cannot tell apart, never as the cause.
+await test('no_subagent_record: the reason does not blame a failed cost hook for a session that used no subagent', () => {
+  const note = CLASS_NOTE[CLASSES.NO_SUBAGENT_RECORD];
+  assert.match(note, /^[^.]*no subagent/i, 'the ordinary case (no subagent used) is named first');
+  assert.match(note, /nothing (is )?owed/i, 'says the ordinary case owes nothing');
+  assert.doesNotMatch(note, /: the cost hook never ran/, 'does not assert the hook failure as the cause');
+  assert.match(note, /cannot (be )?tell|cannot tell|indistinguishable|same trace/i, 'says the two cases look the same in the data');
+  const plan = buildBackfillPlan([row({ subagent_usd: null, subagent_recorded_at: null })],
+    { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  const { text } = renderReport(plan);
+  assert.doesNotMatch(text, /Sessions whose cost hook never ran left no trace at all/,
+    'the closing summary no longer reads every no-record session as a lost hook');
+});
+
 await test('pre_split: a legacy single `session` row lumps both legs and cannot be separated', () => {
   const r = classifySession(
     row({ subagent_usd: null, subagent_recorded_at: null, has_pre_split_cost_row: true }), OPTS

package/tests/backup_trigger_lock.mjs

@@ -0,0 +1,119 @@
+// tests/backup_trigger_lock.mjs
+//
+// task 1004924 — POST /backup/trigger runs a ~2 minute bash dump. Two at once on
+// one disk is the thing to prevent, so the route holds a single-flight lock: a
+// second trigger while one runs is 409 backup_already_running, and the lock frees
+// when the dump finishes. The lock existed but nothing pinned it; and a spawn
+// that threw synchronously never reached the callback, so the lock stuck and
+// every later trigger 409'd until a restart.
+//
+// Hermetic: the auth gates are stubbed (the rank gate itself is tested in its own
+// suites), and execFile is the router's injected seam — no real dump runs.
+//
+// Run:  node tests/backup_trigger_lock.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// Stub the gates BEFORE building: the router reads them at build time.
+const pass = (req, _res, next) => { req.builder = { id: 'b-test' }; next(); };
+auth.requireBuilder = pass;
+auth.requirePermission = () => (_req, _res, next) => next();
+
+const buildBackupRouter = require('../src/bongos/routes/backup.js');
+const { test, summary } = makeRunner();
+
+async function withServer(execFile, fn) {
+  const app = express();
+  app.use(attachFail);
+  app.use(buildBackupRouter({ execFile }));
+  const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+  const port = server.address().port;
+  // node:http with no keep-alive agent, not fetch: fetch's pooled sockets are
+  // still closing when summary() calls process.exit, which aborts on Windows
+  // (libuv UV_HANDLE_CLOSING assertion) after every case has passed.
+  const trigger = () => new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: '/backup/trigger', method: 'POST', agent: false }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(data) }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+  try { await fn(trigger); } finally { await new Promise((r) => server.close(r)); }
+}
+
+await test('a second trigger while a dump runs is 409; once it finishes the next one starts', async () => {
+  const spawned = [];
+  const execFile = (cmd, args, opts, cb) => { spawned.push(cb); };
+  await withServer(execFile, async (trigger) => {
+    assert.equal((await trigger()).status, 202);
+    const second = await trigger();
+    assert.equal(second.status, 409);
+    assert.equal(second.body.error.code, 'backup_already_running');
+    assert.equal(spawned.length, 1, 'never two dumps at once');
+
+    spawned[0](null, '', ''); // the dump finishes
+    assert.equal((await trigger()).status, 202);
+    assert.equal(spawned.length, 2);
+    spawned[1](new Error('pg_dump failed'), '', 'boom'); // a FAILED dump frees the lock too
+    assert.equal((await trigger()).status, 202);
+    spawned[2](null, '', '');
+  });
+});
+
+await test('a spawn that throws synchronously frees the lock instead of wedging it', async () => {
+  let calls = 0;
+  let throwIt = true;
+  const execFile = (cmd, args, opts, cb) => {
+    calls++;
+    if (throwIt) throw new Error('spawn EAGAIN');
+    setImmediate(() => cb(null, '', ''));
+  };
+  await withServer(execFile, async (trigger) => {
+    const first = await trigger();
+    assert.equal(first.status, 500);
+    assert.equal(first.body.error.code, 'backup_start_failed');
+    throwIt = false;
+    const second = await trigger();
+    assert.equal(second.status, 202, 'the lock was released, so a retry starts a dump');
+    assert.equal(calls, 2);
+  });
+});
+
+// task 1004966 — the in-memory flag above cannot see the nightly timer, which runs
+// the script outside this process. The cross-process guard is the flock INSIDE
+// db-backup-nightly.sh, so it only covers the manual trigger if the trigger runs
+// that very script — the one the systemd unit's ExecStart names.
+await test('the trigger runs the same script as the nightly unit, so both take its flock', async () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { BACKUP_SCRIPT, SKIPPED_MARK } = buildBackupRouter;
+  const root = path.resolve(path.dirname(require('node:url').fileURLToPath(import.meta.url)), '..');
+  const script = path.join(root, 'scripts', 'bongos', 'db-backup-nightly.sh');
+  assert.equal(path.resolve(BACKUP_SCRIPT), path.resolve(script));
+  const unit = fs.readFileSync(path.join(root, 'scripts', 'bongos', 'gds-db-backup.service'), 'utf8');
+  assert.match(unit, /^ExecStart=.*\/db-backup-nightly\.sh\s*$/m, 'the timer runs the same script');
+  const src = fs.readFileSync(script, 'utf8');
+  assert.match(src, /flock -n 9/, 'the script takes the lock');
+  assert.ok(src.includes(SKIPPED_MARK), 'the script prints the skip line the trigger listens for');
+
+  const runs = [];
+  const execFile = (cmd, args, opts, cb) => { runs.push([cmd, args]); setImmediate(() => cb(null, `${SKIPPED_MARK} another backup is running`, '')); };
+  await withServer(execFile, async (trigger) => {
+    assert.equal((await trigger()).status, 202);
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(runs[0], ['bash', [BACKUP_SCRIPT]]);
+    assert.equal((await trigger()).status, 202, 'a skipped run frees the in-memory flag too');
+  });
+});
+
+summary();

package/tests/blockers_people.mjs

@@ -0,0 +1,198 @@
+// tests/blockers_people.mjs — open blockers UNDER THE PEOPLE they wait on (task 1004999).
+//
+// WHAT IT GUARDS.
+//   * Every route the City carries now names the PEOPLE in its seat, not only the seat.
+//   * groupByPerson lists each open blocker under every person its seat resolves to,
+//     with the City's own rule (seatOf → resolveSeat): owner, a seated Lead, an
+//     unseated building falling to the owner, a board's members, and nobody.
+//   * The grouping and the City agree on every blocker — they are one rule.
+//   * Seating a different Lead moves the blocker with nothing on the blocker edited.
+//   * blockersByPerson reads the real contributed source, its asks and the seats.
+//   * The hall draws it: the viewer first as "You", the seat in words, "Nobody yet",
+//     escaping, and the City card's "waits on Lars, the owner".
+//
+// DB-free: the government db reads, the resolver and the asks read are stubbed.
+// Run:  node --test tests/blockers_people.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gov = (f) => path.join(ROOT, 'modules', 'government', f);
+const routing = require(gov('routing.js'));
+const waiting = require(gov('waiting.js'));
+const leads = require(gov('leads.js'));
+const people = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'blockers-by-person.js'));
+
+const NOW = Date.parse('2026-10-29T12:00:00Z');
+const ARCHONS = [{ id: 1, github_login: 'lars', display_name: 'Lars' }];
+const owner = leads.ownerOf(ARCHONS);
+const planningLead = { id: 9, building: 'planning', builder_id: 42, github_login: 'ana', display_name: 'Ana', removed_at: null };
+const releaseLead = { id: 10, building: 'release', builder_id: 43, github_login: 'ben', display_name: 'Ben', removed_at: null };
+const ask = (waitsOn) => ({ question: 'Allow it?', waits_on: waitsOn, if_nobody_answers: 'It stays stuck.' });
+const blocker = (id, over = {}) => ({
+  id: `blockers:${id}`, source: 'blockers', building: 'planning', state: 'needs', title: `Blocker ${id}`,
+  opened_at: `2026-10-2${id % 10}T00:00:00Z`, deadline: null, href: `/blockers#blocker-${id}`, ref: { type: 'blocker', id: String(id) }, ...over,
+});
+
+test('a route names the people in its seat, not only the seat', () => {
+  const seats = { leads: [planningLead], owner, holders: { charter: [{ builder_id: 7, github_login: 'cy', display_name: 'Cy' }, { builder_id: 8, github_login: 'di' }] } };
+  const byOwner = routing.routeMatter(blocker(1, { ask: ask('owner') }), '1', seats, NOW);
+  assert.deepEqual(byOwner.people, [{ id: '1', login: 'lars', name: 'Lars' }]);
+  const byLead = routing.routeMatter(blocker(2), '1', seats, NOW);
+  assert.equal(byLead.seat, 'lead:planning');
+  assert.deepEqual(byLead.people, [{ id: '42', login: 'ana', name: 'Ana' }]);
+  const unseated = routing.routeMatter(blocker(3, { building: 'treasury' }), '1', seats, NOW);
+  assert.deepEqual([unseated.seat, unseated.fell_to_owner, unseated.people.map((p) => p.name)], ['owner', true, ['Lars']]);
+  const board = routing.routeMatter(blocker(4, { ask: ask('board:charter') }), '1', seats, NOW);
+  assert.deepEqual(board.people, [{ id: '7', login: 'cy', name: 'Cy' }, { id: '8', login: 'di', name: 'di' }]);
+});
+
+test('the name map is built once per request: routeMatter takes it, and routeAll gives the same routes', () => {
+  const seats = { leads: [planningLead], owner, holders: {} };
+  // a passed map is the one used — so routeAll can hand every matter the one it built
+  const dir = new Map([['42', { id: '42', login: 'x', name: 'From the map' }]]);
+  assert.deepEqual(routing.routeMatter(blocker(1), '1', seats, NOW, dir).people, [{ id: '42', login: 'x', name: 'From the map' }]);
+  const ms = [blocker(1), blocker(2, { ask: ask('owner') }), blocker(3, { building: 'treasury' })];
+  const one = ms.map((m) => routing.routeMatter(m, '42', seats, NOW));
+  const all = ms.map((m) => ({ ...m }));
+  routing.routeAll(all, '42', seats, NOW);
+  assert.deepEqual(all.map((m) => m.route), one);
+  const src = fs.readFileSync(gov('routing.js'), 'utf8');
+  const body = src.slice(src.indexOf('function routeAll'), src.indexOf('\n}', src.indexOf('function routeAll')));
+  assert.match(body, /const dir = directoryOf\(ctx\);[\s\S]*routeMatter\(m, viewerId, ctx, now, dir\)/, 'built once, outside the loop');
+});
+
+test('groupByPerson: each blocker under every person its seat resolves to; nobody is never dropped', () => {
+  const seats = { leads: [planningLead], owner, holders: { charter: [{ builder_id: 7, display_name: 'Cy' }, { builder_id: 42, display_name: 'Ana' }], rules: [] } };
+  const matters = [
+    blocker(1, { ask: ask('owner') }),
+    blocker(2), // ask-less → lead:planning → Ana
+    blocker(3, { building: 'treasury' }), // unseated → the owner
+    blocker(4, { ask: ask('board:charter') }), // two members
+    blocker(5, { ask: ask('board:rules') }), // nobody seated → falls to the owner
+    blocker(6, { state: 'settled', ask: ask('owner') }), // settled is not waiting
+  ];
+  const g = waiting.groupByPerson(matters, seats);
+  const ids = (name) => g.people.find((x) => x.person.name === name).items.map((i) => i.id);
+  assert.deepEqual(ids('Lars'), ['1', '3', '5']);
+  assert.deepEqual(ids('Ana'), ['2', '4']);
+  assert.deepEqual(ids('Cy'), ['4']);
+  assert.deepEqual(g.people.map((p) => [p.person.name, p.count]), [['Lars', 3], ['Ana', 2], ['Cy', 1]], 'most waiting first');
+  const two = g.people.find((x) => x.person.name === 'Ana').items.find((i) => i.id === '2');
+  assert.deepEqual([two.seat, two.as, two.asked, two.fell_to_owner], ['lead:planning', 'the Planning Lead', 'lead:planning', false]);
+  const three = g.people.find((x) => x.person.name === 'Lars').items.find((i) => i.id === '3');
+  assert.deepEqual([three.seat, three.asked, three.fell_to_owner], ['owner', 'lead:treasury', true]);
+  // no owner at all: an owner-seat blocker waits on nobody, and is listed there
+  const empty = waiting.groupByPerson([blocker(1, { ask: ask('owner') })], { leads: [], owner: leads.ownerOf([]), holders: {} });
+  assert.deepEqual([empty.people.length, empty.nobody.map((i) => i.id)], [0, ['1']]);
+});
+
+test('the grouping and the City agree on every blocker', () => {
+  const seats = { leads: [planningLead, releaseLead], owner, holders: { charter: [{ builder_id: 7, display_name: 'Cy' }] } };
+  const matters = [blocker(1), blocker(2, { ask: ask('owner') }), blocker(3, { ask: ask('lead:release') }), blocker(4, { ask: ask('board:charter') }), blocker(5, { building: 'people' }), blocker(6, { ask: ask('committee:release.ops') })];
+  const g = waiting.groupByPerson(matters, seats);
+  for (const m of matters) {
+    const city = routing.routeMatter(m, null, seats, NOW).people.map((p) => p.id).sort();
+    const here = g.people.filter((x) => x.items.some((i) => i.matter_id === m.id)).map((x) => x.person.id).sort();
+    assert.deepEqual(here, city, `${m.id}: the same people on both`);
+  }
+});
+
+test('seating a different Lead moves the blocker; nothing on the blocker changes', () => {
+  const m = [blocker(1)];
+  const before = waiting.groupByPerson(m, { leads: [planningLead], owner, holders: {} });
+  const after = waiting.groupByPerson(m, { leads: [{ ...planningLead, builder_id: 77, github_login: 'eve', display_name: 'Eve' }], owner, holders: {} });
+  assert.deepEqual(before.people.map((p) => p.person.name), ['Ana']);
+  assert.deepEqual(after.people.map((p) => p.person.name), ['Eve']);
+  const removed = waiting.groupByPerson(m, { leads: [{ ...planningLead, removed_at: '2026-10-28T00:00:00Z' }], owner, holders: {} });
+  assert.deepEqual(removed.people.map((p) => p.person.name), ['Lars'], 'a removed Lead hands it back to the owner');
+});
+
+test('forViewer: the viewer\'s own group, or an empty one', () => {
+  const g = waiting.groupByPerson([blocker(1), blocker(2, { ask: ask('owner') })], { leads: [planningLead], owner, holders: {} });
+  assert.deepEqual(waiting.forViewer(g, 42).items.map((i) => i.id), ['1']);
+  assert.deepEqual(waiting.forViewer(g, '1').items.map((i) => i.id), ['2']);
+  assert.deepEqual([waiting.forViewer(g, 5).count, waiting.forViewer(g, 5).items], [0, []]);
+});
+
+test('blockersByPerson reads the contributed blockers, their asks and the seats', async () => {
+  const docket = require(gov('docket.js'));
+  const resolver = require(gov('resolver.js'));
+  const asksDb = require(gov('asks-db.js'));
+  const db = require(gov('db.js'));
+  const real = { perms: resolver.resolveBuilderPermissions, asks: asksDb.asksFor, leads: db.listLeads, archons: db.listActiveArchons };
+  resolver.resolveBuilderPermissions = async () => ['board.vote.cast'];
+  asksDb.asksFor = async (ids) => new Map(ids.filter((id) => id === 'blockers:7').map((id) => [id, ask('owner')]));
+  db.listLeads = async () => [planningLead];
+  db.listActiveArchons = async () => ARCHONS;
+  const rows = [{ id: 7, title: 'Token needs the workflow scope', created_at: '2026-10-29T10:00:00Z' }, { id: 8, title: 'Pick a host', created_at: '2026-10-28T10:00:00Z' }];
+  const contributions = { sources: new Map([['blockers', { source: 'blockers', building: 'planning', gate: { anyBuilder: true }, read: async () => rows.map((b) => ({ id: b.id, title: b.title, state: 'needs', opened_at: b.created_at, href: `/blockers#blocker-${b.id}`, ref: { type: 'blocker', id: b.id } })) }]]) };
+  try {
+    const r = await docket.blockersByPerson({ id: 42, rank: 'metic' }, { contributions, now: NOW });
+    assert.equal(r.available, true);
+    assert.deepEqual(r.people.map((p) => [p.person.name, p.items.map((i) => i.id)]), [['Ana', ['8']], ['Lars', ['7']]]);
+    assert.deepEqual(r.yours.items.map((i) => i.id), ['8'], 'Ana sees her own');
+    const off = await docket.blockersByPerson({ id: 42 }, { contributions: { sources: new Map() }, now: NOW });
+    assert.deepEqual([off.available, off.reason, off.people], [false, 'off', []], 'no source is said, not shown as empty');
+    db.listLeads = async () => { throw new Error('db down'); };
+    const down = await docket.blockersByPerson({ id: 42 }, { contributions, now: NOW });
+    assert.deepEqual([down.available, down.reason], [false, 'unavailable'], 'a failed seats read groups nothing rather than guessing');
+  } finally {
+    resolver.resolveBuilderPermissions = real.perms; asksDb.asksFor = real.asks; db.listLeads = real.leads; db.listActiveArchons = real.archons;
+  }
+});
+
+const esc = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+const fmtDate = (iso) => iso.slice(0, 10);
+
+test('the Blockers page: the viewer first as "You", the seat in words, "Nobody yet", escaped', () => {
+  const g = waiting.groupByPerson([
+    blocker(1, { ask: ask('owner'), title: '<b>Token</b>' }),
+    blocker(2), blocker(3, { building: 'treasury' }),
+    blocker(4, { ask: ask('board:rules') }),
+  ], { leads: [planningLead], owner: leads.ownerOf([]), holders: { rules: [] } });
+  const html = people.peopleHtml({ available: true, ...g }, { esc, fmtDate, viewerId: 42, blockerHref: (id) => `#/blocker/${id}` });
+  assert.ok(html.indexOf('>You<') < html.indexOf('>Nobody yet<'), 'the viewer first');
+  assert.match(html, /as the Planning Lead · filed 2026-10-22/);
+  assert.match(html, /href="#\/blocker\/2"/);
+  assert.match(html, /&lt;b&gt;Token&lt;\/b&gt;/, 'a title is escaped');
+  assert.ok(!html.includes('<b>Token'), 'never raw');
+  assert.equal(people.peopleHtml({ available: false, people: [], nobody: [] }, { esc, fmtDate }), '', 'unavailable draws nothing');
+  assert.equal(people.peopleHtml({ available: true, people: [], nobody: [] }, { esc, fmtDate }), '', 'nothing open draws nothing');
+  assert.equal(people.asWords({ as: 'the owner', asked: 'lead:treasury', fell_to_owner: true }), 'as the owner, since Treasury has no Lead');
+  assert.equal(people.asWords({ as: 'the owner', asked: 'owner', fell_to_owner: false }), 'as the owner');
+});
+
+test('Collab\'s block draws only the viewer\'s own, and nothing when nothing waits', () => {
+  const mine = { available: true, count: 1, items: [{ id: '9', title: 'Pick a host', as: 'the Planning Lead', asked: 'lead:planning', opened_at: '2026-10-28T00:00:00Z' }] };
+  const html = people.mineHtml(mine, { esc, fmtDate, blockerHref: (id) => `#/blocker/${id}` });
+  assert.match(html, /Pick a host/);
+  assert.match(html, /as the Planning Lead/);
+  assert.equal(people.mineHtml({ available: true, count: 0, items: [] }, { esc, fmtDate }), '');
+  assert.equal(people.mineHtml(null, { esc, fmtDate }), '');
+});
+
+test('the pages carry the sections and load the script', () => {
+  const pub = (f) => fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', f), 'utf8');
+  assert.match(pub('blockers.html'), /id="blockers-people-scroll"[^>]*hidden/);
+  assert.match(pub('blockers.html'), /<script src="\/builders\/blockers-by-person.js"><\/script>/);
+  assert.match(pub('collab.html'), /id="cb-blockers-scroll"[^>]*hidden/);
+  assert.match(pub('collab.html'), /<script src="\/builders\/blockers-by-person.js"><\/script>/);
+});
+
+test('the City card says who: "waits on Lars, the owner"', () => {
+  const deck = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'street-deck.js'));
+  const who = deck.whoWords;
+  assert.equal(who({ label: 'the owner', people: [{ name: 'Lars' }] }), 'Lars, the owner');
+  assert.equal(who({ label: 'the board', people: [{ name: 'Cy' }, { login: 'di' }] }), 'Cy and di, the board');
+  assert.equal(who({ label: 'the board', people: [{ name: 'A' }, { name: 'B' }, { name: 'C' }] }), 'A and 2 others, the board');
+  assert.equal(who({ label: 'the owner', people: [] }), 'the owner', 'nobody named: the seat alone');
+  const foot = deck.footOf({ waits_on: { real: true, label: 'the Planning Lead', people: [{ name: 'Ana' }] } }, '');
+  assert.equal(foot.rest, 'It waits on Ana, the Planning Lead.');
+});