@bongos/core 1.24.1 → 1.24.3

package/tests/access_holders.mjs

@@ -0,0 +1,214 @@
+// tests/access_holders.mjs — who holds the keys OUTSIDE Bongos, and blockers that need
+// them (task 1005000, goal 1000111).
+//
+// WHAT IT GUARDS (the task's done-when, one by one):
+//   1. Only the owner can record a holder: the writes refuse anyone without
+//      government.manage; the read is the docket's atom.
+//   2. An ask on access:<key> resolves to exactly the recorded holders, and to the
+//      owner when none is recorded.
+//   3. Such a blocker shows under its holder as "needs repo-owner access".
+//   4. No secret is stored: the table has no column a credential could live in.
+//   And the trap: it is a record of who to ask, never authority — no gate, rank check
+//   or permission atom reads it.
+//
+// Also: the vocabulary, the ask grammar (asks.SEAT) and both migration CHECKs agree.
+// DB-free: the government db is stubbed by property. Run:  node --test tests/access_holders.mjs
+
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gov = (f) => path.join(ROOT, 'modules', 'government', f);
+const access = require(gov('access.js'));
+const asks = require(gov('asks.js'));
+const routing = require(gov('routing.js'));
+const waiting = require(gov('waiting.js'));
+const leads = require(gov('leads.js'));
+const people = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'blockers-by-person.js'));
+const page = require(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government-access.js'));
+const SQL = fs.readFileSync(gov('migrations/government_036_access_holders.sql'), 'utf8');
+
+const owner = leads.ownerOf([{ id: 1, github_login: 'lars', display_name: 'Lars' }]);
+const KIM = { access_key: 'github-admin', builder_id: 5, github_login: 'kim', display_name: 'Kim', granted_at: '2026-10-29T00:00:00Z' };
+const blocker = (id, waitsOn) => ({ id: `blockers:${id}`, source: 'blockers', building: 'planning', state: 'needs', title: `Blocker ${id}`, opened_at: '2026-10-29T00:00:00Z', ref: { type: 'blocker', id: String(id) }, ask: { question: 'Allow it?', waits_on: waitsOn, if_nobody_answers: 'It stays stuck.' } });
+
+test('one vocabulary: access.js, the holders CHECK and the asks CHECK name the same keys', () => {
+  const holders = /access_key IN \(([^)]+)\)/.exec(SQL)[1].match(/'([^']+)'/g).map((s) => s.slice(1, -1));
+  assert.deepEqual(holders, access.KEYS);
+  const seat = new RegExp(/CHECK \(waits_on ~ '([^']+)'\)/.exec(SQL)[1]);
+  for (const s of ['owner', 'lead:planning', 'board:charter', 'committee:review.testers', ...access.KEYS.map((k) => `access:${k}`)]) {
+    assert.equal(seat.test(s), true, `${s}: the table takes it`);
+    assert.equal(asks.SEAT.test(s), true, `${s}: the module takes it`);
+  }
+  for (const s of ['access:nope', 'access:', 'access:github-admin.x', 'lead:nowhere']) {
+    assert.equal(seat.test(s), false, `${s}: the table refuses it`);
+    assert.equal(asks.SEAT.test(s), false, `${s}: the module refuses it`);
+  }
+});
+
+test('an ask can wait on an outside access, and reads as its holder', () => {
+  const ok = asks.checkAsk({
+    question: 'Allow the publish token to change CI workflow files?',
+    options: [{ key: 'yes', label: 'Add the scope', result: 'It lands on the next ship.' }, { key: 'no', label: 'Leave it', result: 'It stays stuck.' }],
+    recommend: { key: 'yes', why: 'One setting fixes it.' },
+    waits_on: 'access:github-admin',
+    if_nobody_answers: 'It stays stuck.',
+  });
+  assert.equal(ok.ok, true, JSON.stringify(ok.errors || []));
+  assert.equal(asks.seatWords('access:github-admin'), 'the repo owner');
+  assert.equal(asks.checkAsk({ ...ok.ask, waits_on: 'access:nope' }).ok, false);
+});
+
+test('access:<key> resolves to exactly the recorded holders, and to the owner when none is', () => {
+  const seats = { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) };
+  const held = routing.resolveSeat('access:github-admin', seats);
+  assert.deepEqual([held.seat, held.label, held.builder_ids, held.fell_to_owner], ['access:github-admin', 'the repo owner', ['5'], false]);
+  const unheld = routing.resolveSeat('access:dns', seats);
+  assert.deepEqual([unheld.seat, unheld.builder_ids, unheld.fell_to_owner], ['owner', ['1'], true]);
+  const route = routing.routeMatter(blocker(1, 'access:github-admin'), '5', seats, Date.now());
+  assert.deepEqual([route.yours, route.people], [true, [{ id: '5', login: 'kim', name: 'Kim' }]]);
+  assert.equal(routing.routeMatter(blocker(1, 'access:github-admin'), '1', seats, Date.now()).yours, false, 'not the owner\'s while a holder is recorded');
+  // no access read at all (an instance that has not migrated): every access seat falls to the owner
+  assert.deepEqual(routing.resolveSeat('access:github-admin', { leads: [], owner, holders: {} }).builder_ids, ['1']);
+});
+
+test('a blocker on an access seat shows under its holder as "needs repo-owner access"', () => {
+  const g = waiting.groupByPerson([blocker(7, 'access:github-admin'), blocker(8, 'access:payments')], { leads: [], owner, holders: {}, access: access.holdersByKey([KIM]) });
+  const kim = g.people.find((p) => p.person.name === 'Kim');
+  assert.deepEqual(kim.items.map((i) => [i.id, i.needs]), [['7', 'needs repo-owner access']]);
+  const lars = g.people.find((p) => p.person.name === 'Lars');
+  assert.deepEqual(lars.items.map((i) => [i.id, i.needs, i.fell_to_owner]), [['8', 'needs access to payments', true]]);
+  const esc = (s) => String(s);
+  const html = people.peopleHtml({ available: true, ...g }, { esc, fmtDate: (d) => d.slice(0, 10) });
+  assert.match(html, /needs repo-owner access · filed/);
+  assert.match(html, /needs access to payments, and nobody is recorded holding it/);
+  assert.equal(people.asWords({ as: 'the owner', asked: 'owner' }), 'as the owner', 'an ordinary seat reads as before');
+});
+
+test('no secret is stored, and nothing that gates reads it', () => {
+  const cols = /CREATE TABLE IF NOT EXISTS government_access_holders \(([\s\S]*?)\n\);/.exec(SQL)[1]
+    .split('\n').map((l) => /^\s+([a-z_]+)\s/.exec(l)).filter(Boolean).map((m) => m[1]).filter((c) => c !== 'PRIMARY');
+  assert.deepEqual(cols, ['access_key', 'builder_id', 'granted_by', 'granted_at']);
+  for (const f of ['src/bongos/auth.js', 'modules/government/resolver.js', 'modules/government/catalog.js', 'src/bongos/act-alone.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.doesNotMatch(src, /access_holders|listAccessHolders|require\(['"][./]*access['"]\)/, `${f} never reads access holders`);
+  }
+  const catalog = require(gov('catalog.js'));
+  const keys = catalog.PERMISSIONS.map((p) => p.key || p);
+  assert.ok(keys.length > 50, 'the real catalog, not an empty list');
+  for (const k of access.KEYS) assert.ok(!keys.some((p) => String(p).includes(k)), `${k} is not a permission atom`);
+});
+
+test('the access view: each access, what it is, its holders, or that it falls to the owner', () => {
+  const v = access.accessView([KIM, { ...KIM, access_key: 'not-a-key' }]);
+  assert.deepEqual(v.map((a) => a.key), access.KEYS);
+  const gh = v.find((a) => a.key === 'github-admin');
+  assert.deepEqual([gh.seat, gh.holders.map((h) => h.name), gh.falls_to_owner], ['access:github-admin', ['Kim'], false]);
+  assert.equal(v.find((a) => a.key === 'dns').falls_to_owner, true);
+  const html = page.accessHtml(v, (s) => String(s).replace(/</g, '&lt;'));
+  assert.match(html, /Repo owner/);
+  assert.match(html, /data-act="revoke" data-key="github-admin" data-id="5"/);
+  assert.match(html, /Nobody recorded — it falls to the owner/);
+  // the picker and the list say the same name, capitalised the same way
+  const opts = page.optionsHtml(v, (s) => String(s));
+  for (const a of v) {
+    assert.match(opts, new RegExp('<option value="' + a.key + '">' + a.title + '</option>'));
+    assert.ok(html.includes('>' + a.title + '<'), a.key + ': the list shows the same name');
+    assert.match(a.title, /^[A-Z]/);
+  }
+});
+
+test('every access reads as plain words when a blocker needs it — no "access access"', () => {
+  for (const k of access.KEYS) {
+    const w = access.needsWords(k);
+    assert.match(w, /^needs [a-z]/, k);
+    assert.doesNotMatch(w, /access access|-access access/, k + ': ' + w);
+  }
+  assert.equal(access.needsWords('github-admin'), 'needs repo-owner access');
+});
+
+test('the City keeps routing when the access read fails or is missing: every access seat falls to the owner', async () => {
+  const docket = require(gov('docket.js'));
+  const db = require(gov('db.js'));
+  const real = { leads: db.listLeads, archons: db.listActiveArchons, access: db.listAccessHolders };
+  db.listLeads = async () => [];
+  db.listActiveArchons = async () => [{ id: 1, github_login: 'lars', display_name: 'Lars' }];
+  try {
+    db.listAccessHolders = async () => { throw new Error('relation government_access_holders does not exist'); };
+    const failed = await docket.loadSeats({ holders: {} });
+    assert.ok(failed, 'seats still read');
+    assert.deepEqual(routing.resolveSeat('access:github-admin', failed).builder_ids, ['1'], 'falls to the owner');
+    assert.deepEqual(failed.access['github-admin'], []);
+    db.listAccessHolders = undefined;
+    const missing = await docket.loadSeats({ holders: {} });
+    assert.ok(missing, 'a db layer without the read still routes');
+    assert.deepEqual(routing.resolveSeat('access:dns', missing).builder_ids, ['1']);
+    db.listAccessHolders = async () => [KIM];
+    assert.deepEqual(routing.resolveSeat('access:github-admin', await docket.loadSeats({ holders: {} })).builder_ids, ['5']);
+  } finally {
+    db.listLeads = real.leads; db.listActiveArchons = real.archons; db.listAccessHolders = real.access;
+  }
+});
+
+// --- the routes, through the real router and the real permission gate ---------------
+
+const express = require('express');
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const govDb = require(gov('db.js'));
+
+const rows = [];
+const REAL = { list: govDb.listAccessHolders, grant: govDb.grantAccess, revoke: govDb.revokeAccess, who: govDb.getActiveBuilder };
+govDb.listAccessHolders = async () => rows.slice();
+govDb.grantAccess = async (k, id, by) => { if (rows.some((r) => r.access_key === k && r.builder_id === id)) return false; rows.push({ access_key: k, builder_id: id, granted_by: by, github_login: 'kim', display_name: 'Kim' }); return true; };
+govDb.revokeAccess = async (k, id) => { const i = rows.findIndex((r) => r.access_key === k && r.builder_id === id); if (i < 0) return false; rows.splice(i, 1); return true; };
+govDb.getActiveBuilder = async (id) => (id === 5 ? { id: 5, github_login: 'kim', display_name: 'Kim' } : null);
+const realRequireBuilder = api.requireBuilder;
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'archon' }; next(); };
+function grant(keys) { seams._reset(); seams.registerProvider('government', { resolveBuilderPermissions: async () => keys }); }
+grant(['government.manage', 'board.vote.cast']);
+const buildRouter = require(gov('routes/government.js'));
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => {
+  server.close();
+  api.requireBuilder = realRequireBuilder;
+  govDb.listAccessHolders = REAL.list; govDb.grantAccess = REAL.grant; govDb.revokeAccess = REAL.revoke; govDb.getActiveBuilder = REAL.who;
+  seams._reset();
+});
+const call = async (method, p, body) => {
+  const res = await fetch(BASE + p, { method, headers: body ? { 'content-type': 'application/json' } : {}, body: body ? JSON.stringify(body) : undefined });
+  return { status: res.status, json: await res.json().catch(() => null) };
+};
+
+test('only the owner records a holder; everyone who can open the City can read who holds what', async () => {
+  grant(['board.vote.cast']);
+  assert.equal((await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status, 403, 'a voter cannot record');
+  assert.equal((await call('DELETE', '/government/access/github-admin/holders/5')).status, 403, 'nor remove');
+  assert.equal((await call('GET', '/government/access')).status, 200, 'but can read');
+  grant(['government.manage', 'board.vote.cast']);
+  const added = await call('POST', '/government/access/github-admin/holders', { builder_id: 5 });
+  assert.deepEqual([added.status, added.json.added], [201, true]);
+  assert.equal(rows[0].granted_by, 1, 'who recorded it rides the row');
+  assert.deepEqual([(await call('POST', '/government/access/github-admin/holders', { builder_id: 5 })).status], [200], 'idempotent');
+  const read = await call('GET', '/government/access');
+  assert.deepEqual(read.json.access.find((a) => a.key === 'github-admin').holders.map((h) => h.id), ['5']);
+  assert.equal((await call('POST', '/government/access/nope/holders', { builder_id: 5 })).status, 400, 'an unknown access');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 99 })).status, 404, 'an unknown builder');
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 'x' })).status, 400);
+  assert.equal((await call('POST', '/government/access/dns/holders', { builder_id: 5, token: 'ghp_x' })).status, 400, 'strict: an unknown field (a token, say) is refused, never stored');
+  const removed = await call('DELETE', '/government/access/github-admin/holders/5');
+  assert.deepEqual([removed.status, removed.json.removed, rows.length], [200, true, 0]);
+});

package/tests/government_board_membership.mjs

@@ -256,7 +256,10 @@ test('the membership queries exclude machines and the deactivated — structural
   const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
   const start = src.indexOf('getActiveBuildersWithRank');
   assert.ok(start > -1);
-  const block = src.slice(start);
+  // bounded to the two membership reads: a later query filtering status for its own
+  // reasons (task 1005000's access holders) is not one of them
+  const end = src.indexOf('\nasync function ', src.indexOf('async function builderHoldsRankActive') + 1);
+  const block = src.slice(start, end > start ? end : undefined);
   assert.equal((block.match(/b\.status = 'active'/g) || []).length, 2, 'both reads filter status');
   assert.equal((block.match(/b\.system_role IS NULL/g) || []).length, 2, 'both reads exclude principals');
 });

package/tests/government_routes.mjs

@@ -104,7 +104,7 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // task 1004712: the treasury is read, and its pots and borrows decided, where the room is (the holder and the seat are the walls).
   // task 1004715: the strictness presets are read where the law book is.
   // task 1004716: the counts are read where the docket they count is.
-  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.includes('/government/blockers/') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
+  const boardFamily = (key) => key.includes('/board/') || key.includes('/government/asks') || key.endsWith('/government/constitution') || key.endsWith('/government/docket') || key.includes('/government/blockers/') || key.endsWith('/government/access') || key.endsWith('/government/counts') || key.endsWith('/government/laws') || key.endsWith('/government/leads') || key.endsWith('/government/buildouts') || key.includes('/government/treasury') || key.endsWith('/government/presets');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }

package/tests/government_seed.mjs

@@ -52,6 +52,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_030_buildouts.sql',                  // a Lead's build-outs, on the record at once or by a passed vote (task 1004711)
   'government_031_treasury.sql',                   // the treasury: a pot per goal and the loans a dry pot asks the reserve for (task 1004712)
   'government_032_ask_flags.sql',                  // the reword list: matters a reader flagged as unclear (owner 2026-10-23)
+  'government_036_access_holders.sql',             // who holds the keys outside Bongos + the access:<key> ask seat (task 1005000)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.

package/tests/governor_docket.mjs

@@ -678,10 +678,14 @@ test('automation, treasury and disputes floors read their own ledgers, and say s
   const rep = autonomyDocket.reportsFloor([{ routine: 'builder', decision: 'go', created_at: '2026-09-30T00:00:00Z' }, { routine: 'idea-triage', decision: 'no-go', reason: 'nothing open', created_at: '2026-09-01T00:00:00Z' }], NOW);
   assert.deepEqual([rep.count, rep.lines.map((l) => l[0])], ['1', ['The builder went ahead.', 'Idea sorting held back: nothing open.']], 'said in words, not the gate\'s keys');
   const months = [{ month: '2026-10', rewards_credits: 1180, rewarded_builders: 6, grading_usd: 310.4, hosting_usd: 120 }, { month: '2026-09', rewards_credits: 4920, rewarded_builders: 8, grading_usd: 0, hosting_usd: 160 }];
-  assert.deepEqual([economyDocket.rewardsFloor(months, NOW).count, economyDocket.rewardsFloor(months, NOW).line], ['$1,180', '$1,180 this month · 6 builders']);
+  assert.deepEqual([economyDocket.rewardsFloor(months, NOW).count, economyDocket.rewardsFloor(months, NOW).line], ['1,180 credits', '1,180 credits this month · 6 builders']);
   assert.deepEqual(economyDocket.hostingFloor(months, NOW).lines[1], ['$160 in sep.', 'last month']);
   assert.equal(economyDocket.gradingFloor([], NOW).count, '$0', 'a month with no rows is a real zero, read from the ledger');
-  assert.deepEqual(economyDocket.treasuryHistory(months).map((h) => h.title), ['Paid $1,180 to 6 builders', 'AI grading cost $310', 'Hosting cost $120', 'Paid $4,920 to 8 builders', 'Hosting cost $160']);
+  assert.deepEqual(economyDocket.treasuryHistory(months).map((h) => h.title), ['6 builders earned 1,180 credits', 'AI grading cost $310', 'Hosting cost $120', '8 builders earned 4,920 credits', 'Hosting cost $160']);
+  // Credits are a contribution meter, not money (ADR 0385/0387, task 1005006): no $ sign, no dollar peg, no "paid".
+  const rewardWords = JSON.stringify([economyDocket.rewardsFloor(months, NOW), economyDocket.treasuryHistory(months).filter((h) => h.outcome === 'rewards')]);
+  assert.doesNotMatch(rewardWords, /\$|dollar|\bpaid\b/i, 'the rewards line counts credits, never money');
+  assert.equal(economyDocket.rewardsFloor([{ month: '2026-10', rewards_credits: 1, rewarded_builders: 1 }], NOW).count, '1 credit');
   assert.deepEqual(reportsRoute.rulingHistory([{ id: 1, title: 'sign-in limits', status: 'fixed', fixed_at: '2026-08-02T00:00:00Z' }, { id: 2, title: 'open one', status: 'open' }, { id: 3, title: 'undated', status: 'wontfix' }]).map((h) => [h.title, h.outcome]), [['Security report: sign-in limits', 'fixed']]);
 });
 
@@ -706,7 +710,7 @@ test('one ledger read per docket request: the treasury floors and record share i
     for (const f of ['modules/economy/routes/cost.js', 'modules/autonomy/routes/autonomy.js']) require(path.join(ROOT, f))();
     const d = await docket.buildDocket({ viewer: VIEWER, permissions: ['board.vote.cast', 'autonomy.precheck'], now: NOW + 1 });
     const by = Object.fromEntries(d.floors.map((f) => [f.key, f]));
-    assert.deepEqual([by['treasury.rewards'].count, by['treasury.hosting'].count, by['automation.spending_limit'].status], ['$10', '$3', 'live']);
+    assert.deepEqual([by['treasury.rewards'].count, by['treasury.hosting'].count, by['automation.spending_limit'].status], ['10 credits', '$3', 'live']);
     assert.equal(reads, 1, 'one treasury read for three floors and the record');
     assert.equal(spends, 1, 'one spend read for the money reading and the spending limit');
     assert.equal(fences, 1, 'one fence read for the switch, allowed goals and the switch\'s record');

package/tests/hall_street_inside.mjs

@@ -303,12 +303,12 @@ test('every floor of every building is bound to a docket feed: none is left unwi
 
 test('a live floor shows exactly what the docket says: its count, line and lines; hot is being decided', () => {
   const d = docket([], { floors: [
-    floorRow('treasury.rewards', { count: '$2,400', line: '$2,400 this month · 6 builders', lines: [['Paid to builders for shipped work.', 'each ship']] }),
+    floorRow('treasury.rewards', { count: '2,400 credits', line: '2,400 credits this month · 6 builders', lines: [['Credits earned for shipped work.', 'each ship']] }),
     floorRow('automation.allowed_goals', { count: '2', line: '2 goals it may build', lines: [['goal 7', 'first in line'], ['goal 99', 'since sep 2']] }),
     floorRow('charter.founding', { count: '', line: '1 of 2 founding steps passed', lines: [['The charter.', 'passed']], hot: true }),
   ] });
   const t = I.civicInfo('treasury', { docket: d, now: NOW }).floors.find((f) => f.name === 'Builder rewards');
-  assert.deepEqual([t.count, t.line, t.status, t.lines], ['$2,400', '$2,400 this month · 6 builders', 'ok', [['Paid to builders for shipped work.', 'each ship']]]);
+  assert.deepEqual([t.count, t.line, t.status, t.lines], ['2,400 credits', '2,400 credits this month · 6 builders', 'ok', [['Credits earned for shipped work.', 'each ship']]]);
   const a = I.civicInfo('automation', { docket: d, goals: [goal(7, 'open', 'Onboarding')], now: NOW }).floors.find((f) => f.name === 'Allowed goals');
   assert.deepEqual(a.lines, [['Onboarding', 'first in line'], ['goal 99', 'since sep 2']], 'a goal it knows is lettered by title; one it does not keeps its id');
   const c = I.buildingModel({ key: 'charter', docket: d, mode: 'dark', now: NOW });