@bongos/core 1.24.3 → 1.24.4

package/tests/google_halls.mjs

@@ -0,0 +1,211 @@
+// tests/google_halls.mjs — a project's hall takes a person who joined with Google
+// (task 1004994, ADR 0393/0396).
+//
+// WHY. Someone with no GitHub account must be able to apply to a project, be
+// admitted, and sign in to its hall like anyone else. What must hold:
+//   - the hub hands a Google-only person (a negative person key) only to a hall
+//     whose authorize link says it can take one; an older hall never gets one;
+//   - the join relay carries them by their stand-in `~handle` with a vouch for
+//     their key, and a hall too old to take a stand-in is said as such;
+//   - the hall files a stand-in application only with that vouch, and matches
+//     their approval on the vouched key, never on the handle (a handle can be
+//     renamed and later taken by someone else);
+//   - a stand-in key and a stand-in login always travel as a pair;
+//   - people read the handle, not `~handle`.
+// No server beyond an in-process express app, no database, no network.
+//
+// Run:  node tests/google_halls.mjs
+
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+// ESM imports so knip credits the exports (a createRequire import reads as
+// unused). Every stub below is read at call time, so hoisting is harmless.
+import { idpAuthorizeUrl, applicationVouchIdentity, PERSON_KEYS_PARAM as CORE_PARAM } from '../src/bongos/auth-idp.js';
+import { hasInvitedAccessRequest } from '../src/bongos/db-kernel.js';
+import { PERSON_KEYS_PARAM as HUB_PARAM, hallTakesPersonKey } from '../modules/platform-identity/account-logins.js';
+import { joinRelayOutcome } from '../modules/platform-identity/routes/my-projects.js';
+import buildAccessRequestsRouter, { shownLogin, accessRequestDocketMatter } from '../modules/onboarding/routes/access-requests.js';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); } catch (err) { failed++; console.log(`  FAIL ${name}\n    ${err && err.stack}`); }
+}
+
+// ── stubs, installed before anything destructures them ──
+const { pool } = require('../src/bongos/pool.js');
+let queries = [];
+let answer = () => ({ rows: [] });
+pool.query = async (sql, params) => { queries.push({ sql, params }); return answer(sql, params); };
+
+const auth = require('../src/bongos/auth.js');
+const projectDoor = require('../src/bongos/project-door.js');
+projectDoor.effectiveJoinDoor = () => 'apply';
+
+const hubKeys = require('../modules/platform-identity/hub-keys.js');
+const logins = { PERSON_KEYS_PARAM: HUB_PARAM, hallTakesPersonKey };
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const { privateKeyB64, publicKeyB64 } = hubKeys.generateHubKeypair();
+const crypto = require('node:crypto');
+const signingKey = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, 'base64'), format: 'der', type: 'pkcs8' });
+const publicKey = crypto.createPublicKey({ key: Buffer.from(publicKeyB64, 'base64'), format: 'der', type: 'spki' });
+const vouch = (githubId, githubLogin) => hubKeys.mintHubApplicationVouch(
+  { clientId: 'client-x', githubId, githubLogin, handle: 'ana' }, { signingKey },
+);
+const vouchOpts = (githubLogin) => ({ githubLogin, publicKey, clientId: 'client-x' });
+
+console.log('the hub sends a Google-only person only to a hall that says it can take one:');
+
+await t('a current hall’s authorize link says so, under the name the hub reads', () => {
+  const u = new URL(idpAuthorizeUrl('https://hub.example', 'client-x', 'st', 'https://p.example/cb'));
+  assert.equal(CORE_PARAM, logins.PERSON_KEYS_PARAM, 'core and hub must spell the marker the same');
+  assert.equal(u.searchParams.get(CORE_PARAM), '1');
+});
+
+await t('a GitHub person goes to any hall; a minted key only to one that said person_keys=1', () => {
+  assert.equal(logins.hallTakesPersonKey('42', {}), true, 'GitHub people are unchanged on older halls');
+  assert.equal(logins.hallTakesPersonKey('-5', {}), false, 'an older hall never receives a minted key');
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: '0' }), false);
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: ['1', '1'] }), false, 'a repeated param is not a yes');
+  assert.equal(logins.hallTakesPersonKey('-5', { person_keys: '1' }), true);
+});
+
+await t('/sso/authorize asks hallTakesPersonKey and the old blanket refusal is gone', () => {
+  const src = require('node:fs').readFileSync(new URL('../modules/platform-identity/routes/sso.js', import.meta.url), 'utf8');
+  assert.match(src, /if \(!hallTakesPersonKey\(session\.github_id, req\.query\)\)/);
+  assert.doesNotMatch(src, /Google sign-in yet\. That is coming soon/);
+  const join = require('node:fs').readFileSync(new URL('../modules/platform-identity/routes/my-projects.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(join, /google_join_not_yet/, 'the join relay no longer refuses a Google-only person');
+});
+
+console.log('\nthe join relay:');
+
+await t('an older hall refusing a stand-in is "needs an update", not "could not be reached"', () => {
+  const o = joinRelayOutcome(400, { error: { code: 'bad_github_login', message: 'x' } }, { standIn: true });
+  assert.equal(o.status, 'needs_update');
+  assert.match(o.message, /older version/);
+  assert.equal(joinRelayOutcome(400, { error: { code: 'bad_github_login' } }), null,
+    'a GitHub login refused is still not relayed: that is not a version gap');
+});
+
+console.log('\nthe vouch — a stand-in key and a stand-in login travel together:');
+
+await t('a minted key vouched with its stand-in login yields the key', () => {
+  assert.deepEqual(applicationVouchIdentity(vouch(-5, '~ana'), vouchOpts('~ana')), { githubId: '-5', handle: 'ana' });
+});
+
+await t('a minted key with a GitHub login, or a GitHub id with a stand-in, is no vouch', () => {
+  assert.equal(applicationVouchIdentity(vouch(-5, 'octo'), vouchOpts('octo')), null);
+  assert.equal(applicationVouchIdentity(vouch(42, '~ana'), vouchOpts('~ana')), null);
+});
+
+console.log('\nadmission on the hall:');
+
+await t('a Google-only person’s approval is matched on the vouched key, never the handle', async () => {
+  queries = [];
+  answer = () => ({ rows: [{ '?column?': 1 }] });
+  assert.equal(await hasInvitedAccessRequest('~ana', '-5'), true);
+  assert.equal(queries.length, 1);
+  assert.match(queries[0].sql, /applicant_github_id = \$1/);
+  assert.doesNotMatch(queries[0].sql, /github_login/, 'whoever is ~ana next must not inherit the approval');
+  assert.deepEqual(queries[0].params, ['-5']);
+});
+
+await t('a GitHub person is still matched by login', async () => {
+  queries = [];
+  await hasInvitedAccessRequest('octo', '42');
+  await hasInvitedAccessRequest('octo');
+  for (const q of queries) {
+    assert.match(q.sql, /lower\(github_login\) = lower\(\$1\)/);
+    assert.deepEqual(q.params, ['octo']);
+  }
+});
+
+await t('both hub sign-ins on the hall pass the key to the admission read', () => {
+  const src = require('node:fs').readFileSync(new URL('../src/bongos/auth-idp.js', import.meta.url), 'utf8');
+  assert.equal((src.match(/hasInvitedAccessRequest\(ghLogin, ghId\)/g) || []).length, 2);
+});
+
+// The hall's public POST /access-requests, in-process.
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(buildAccessRequestsRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const post = (body, headers = {}) => fetch(`${base}/access-requests`, {
+  method: 'POST', headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(body),
+});
+
+let vouchFor = null;
+auth.readApplicationVouch = (token, { githubLogin }) => (token === 'good' ? vouchFor(githubLogin) : null);
+
+await t('a stand-in application with the hub’s vouch is filed, keyed on the person', async () => {
+  queries = [];
+  answer = (sql) => (sql.startsWith('INSERT') ? { rows: [{ id: 9, github_login: '~ana', status: 'pending' }] } : { rows: [] });
+  vouchFor = (login) => (login === '~ana' ? { githubId: '-5', handle: 'ana' } : null);
+  const res = await post({ github_login: '~ana', display_name: 'Ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(res.status, 201);
+  const member = queries.find((q) => /FROM builders/.test(q.sql));
+  assert.match(member.sql, /github_id = \$1/, 'the already-a-member check is on the key');
+  assert.deepEqual(member.params, ['-5']);
+  const insert = queries.find((q) => q.sql.startsWith('INSERT'));
+  assert.equal(insert.params[0], '~ana');
+  assert.equal(insert.params[3], '-5', 'applicant_github_id is the key the approval will match');
+});
+
+await t('a stale approval under a handle someone else now holds does not block the new holder', async () => {
+  // An approved row for `~ana` belongs to person -4; person -5 holds the handle now.
+  const approved = [{ github_login: '~ana', applicant_github_id: '-4' }];
+  queries = [];
+  answer = (sql, params) => {
+    if (sql.startsWith('INSERT')) return { rows: [{ id: 11, github_login: '~ana', status: 'pending' }] };
+    if (/FROM access_requests/.test(sql) && /status = 'invited'/.test(sql)) {
+      const hit = /applicant_github_id = \$1/.test(sql)
+        ? approved.some((r) => r.applicant_github_id === params[0])
+        : approved.some((r) => r.github_login.toLowerCase() === String(params[0]).toLowerCase());
+      return { rows: hit ? [{ '?column?': 1 }] : [] };
+    }
+    return { rows: [] };
+  };
+  vouchFor = () => ({ githubId: '-5', handle: 'ana' });
+  const res = await post({ github_login: '~ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(res.status, 201, 'the new holder’s application is filed, not answered "already approved"');
+  vouchFor = () => ({ githubId: '-4', handle: 'ana' });
+  const again = await post({ github_login: '~ana' }, { 'X-Bongos-Platform-Assertion': 'good' });
+  assert.equal(again.status, 409, 'the approved person themselves is told they are already approved');
+});
+
+await t('a stand-in typed by anyone, with no vouch, is refused and nothing is written', async () => {
+  queries = [];
+  const res = await post({ github_login: '~ana' });
+  assert.equal(res.status, 400);
+  assert.equal(queries.length, 0);
+});
+
+await t('a GitHub login still files with or without a vouch', async () => {
+  answer = (sql) => (sql.startsWith('INSERT') ? { rows: [{ id: 10, github_login: 'octo', status: 'pending' }] } : { rows: [] });
+  const res = await post({ github_login: 'octo' });
+  assert.equal(res.status, 201);
+});
+
+server.close();
+
+console.log('\nwhat people read:');
+
+await t('the handle is shown without its ~; a GitHub login is unchanged', () => {
+  assert.equal(shownLogin('~ana'), 'ana');
+  assert.equal(shownLogin('octo'), 'octo');
+  const m = accessRequestDocketMatter({ id: 1, github_login: '~ana', display_name: null, created_at: new Date() });
+  assert.equal(m.title, 'Admit ana as a builder');
+  assert.equal(m.short, 'admit ana');
+});
+
+console.log(`\ngoogle_halls: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/market_watch_ask.mjs

@@ -0,0 +1,369 @@
+// tests/market_watch_ask.mjs — the Market Watch weekly ask card (task 1004940, goal 1000137).
+//
+// DB-free: the flow (modules/market-watch/ask.js) runs over an in-memory store that keeps the
+// same rules the SQL store keeps (the UNIQUE constraints, the project guard on an answer's
+// ask, the pooled-proposal lookup), and the real routes run over it in a real Express app.
+// tests/market_watch_ask_db.mjs runs the SQL store itself on Postgres (INTEGRATION set).
+//
+//   - pure: the week, normalising, chips from the project's own data, parsing and its caps
+//   - the poller: once per project per week, by the wall clock
+//   - THE WHOLE PATH: the card the hall draws → a member taps and names one → POST → the
+//     proposals with their agree counts, read back as the next card's team rows
+//   - members only (403), nobody answers for anyone else (403), closed weeks expire quietly
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const ask = require('../modules/market-watch/ask.js');
+const widget = require('../modules/market-watch/public/hall-widget.js');
+const api = require('../src/module-api.js');
+
+const PROJECT = 'https://acme.example';
+const OTHER = 'https://other.example';
+// Thursday of ISO week 44, 2026; its Monday is 26 October.
+const NOW = new Date('2026-10-29T12:00:00Z');
+
+// ---- the in-memory store --------------------------------------------------
+
+function memoryStore({ items = [], activeRules = { [PROJECT]: 11 }, names = {} } = {}) {
+  const s = { asks: [], answers: [], proposals: [], seq: 0, items, activeRules, names, locks: [] };
+  const q = {
+    async insertAnswer({ project, askId, builderId, choice, freeText }) {
+      const a = s.asks.find((x) => x.id === askId && x.project === project);
+      if (!a) return null; // the SQL guard: an ask of another project inserts nothing
+      if (s.answers.some((x) => x.ask_id === askId && x.builder_id === builderId && x.choice === choice)) return null;
+      const row = { id: ++s.seq, ask_id: askId, builder_id: builderId, choice, free_text: freeText };
+      s.answers.push(row);
+      return row.id;
+    },
+    async lockPool(project, key) { s.locks.push(`${project}:${key}`); },
+    async findPooled(project, key) {
+      const p = s.proposals.find((x) => x.project === project && x.origin === 'weekly_ask' && x.payload.pool_key === key && ['open', 'approved', 'applied'].includes(x.status));
+      return p ? p.id : null;
+    },
+    async insertProposal(x) {
+      const row = { id: ++s.seq, project: x.project, kind: x.kind, origin: 'weekly_ask', rule_version_id: x.ruleVersionId, answer_id: x.answerId, payload: x.payload, reason: x.reason, proposed_by: x.proposedBy, status: 'open', created_at: NOW };
+      if (s.proposals.some((p) => p.answer_id === row.answer_id)) throw new Error('one proposal per answer');
+      s.proposals.push(row);
+      return row.id;
+    },
+  };
+  return {
+    state: s,
+    async asksForWeek(project, weekOf) { return s.asks.filter((a) => a.project === project && a.week_of === weekOf); },
+    async insertAsk(project, a) {
+      if (s.asks.some((x) => x.project === project && x.week_of === a.weekOf && x.question_key === a.questionKey)) return false;
+      s.asks.push({ id: ++s.seq, project, week_of: a.weekOf, question_key: a.questionKey, prompt: a.prompt, options: JSON.parse(JSON.stringify(a.options)), closes_at: a.closesAt });
+      return true;
+    },
+    async chipSource(project) { return s.items.filter((i) => (i.project || PROJECT) === project && (i.status || 'active') === 'active'); },
+    async answeredWeek(project, weekOf, builderId) {
+      const ids = new Set(s.asks.filter((a) => a.project === project && a.week_of === weekOf).map((a) => a.id));
+      return s.answers.some((x) => ids.has(x.ask_id) && x.builder_id === builderId);
+    },
+    async streak() { return 4; },
+    async teamProposals(project) {
+      return s.proposals.filter((p) => p.project === project && ['open', 'approved', 'applied'].includes(p.status)).map((p) => {
+        const agreeing = new Set(s.answers.filter((x) => {
+          const a = s.asks.find((k) => k.id === x.ask_id);
+          return a && a.project === project && `${a.question_key}|${x.choice}` === p.payload.pool_key;
+        }).map((x) => x.builder_id));
+        return { ...p, who: s.names[p.proposed_by] || null, agree: agreeing.size };
+      }).sort((a, b) => b.agree - a.agree || b.id - a.id).slice(0, 5);
+    },
+    async activeRuleVersionId(project) { return s.activeRules[project] ?? null; },
+    async tx(fn) { return fn(q); },
+  };
+}
+
+const ITEMS = [
+  { kind: 'competitor', name: 'Cognition (Devin)', category: 'AI software-engineering agent' },
+  { kind: 'competitor', name: 'Factory', category: 'AI software-engineering agent' },
+  { kind: 'competitor', name: 'Lovable', category: 'AI app builder' },
+  { kind: 'competitor', name: 'Bolt.new (StackBlitz)', category: 'AI app builder' },
+  { kind: 'competitor', name: 'Cursor (Anysphere)', category: 'AI IDE + background/cloud agents' },
+  { kind: 'competitor', name: 'Gone Inc', category: 'Removed kind', status: 'removed' },
+  { kind: 'partner', name: 'NLnet Foundation', category: 'open-source funding' },
+  { kind: 'partner', name: 'FLOSS/fund (Zerodha)', category: 'open-source funding' },
+  { kind: 'partner', name: 'Colony', category: 'DAO tooling' },
+  { kind: 'partner', name: 'Igalia', category: 'worker co-op (software)' },
+  { kind: 'topic', name: 'Worker co-op (software)', category: '' },
+];
+
+// ---- pure -------------------------------------------------------------------
+
+test('the week is the Monday (UTC) and the card names its ISO week number', () => {
+  assert.equal(ask.weekStart(NOW), '2026-10-26');
+  assert.equal(ask.weekStart(new Date('2026-10-26T00:00:00Z')), '2026-10-26', 'Monday midnight is the new week');
+  assert.equal(ask.weekStart(new Date('2026-10-25T23:59:59Z')), '2026-10-19', 'Sunday night is still last week');
+  assert.equal(ask.isoWeek('2026-10-26'), 44);
+  assert.equal(ask.isoWeek('2025-12-29'), 1, 'the week holding the year\'s first Thursday is week 1');
+});
+
+test('similar answers pool: case, punctuation, spacing and a leading article do not count', () => {
+  for (const s of ['Kilo Code', ' kilo-code ', 'The Kilo  Code!', 'KILO_CODE']) assert.equal(ask.normalise(s), 'kilo code');
+  assert.equal(ask.normalise('Ｋｉｌｏ Ｃｏｄｅ'), 'kilo code', 'full-width letters fold');
+  assert.equal(ask.normalise('the'), 'the', 'a lone word is never emptied');
+  assert.ok(!ask.normalise('~nothing').includes('~'), 'no entry can collide with the nothing-new marker');
+  const hidden = (n) => String.fromCharCode(n); // spelled as code points: no hidden character sits in this file
+  assert.equal(ask.cleanText(`a${hidden(0)}b${hidden(0x202e)}c\n d${hidden(0x200b)}`), 'a b c d', 'control and direction characters go');
+});
+
+test('chips come from the project\'s own items: competitor kinds, then partner areas it does not already watch', () => {
+  const c = ask.chipOptions(ITEMS);
+  assert.deepEqual(c.rival.map((o) => o.label), ['AI app builder', 'AI software-engineering agent', 'AI IDE + background/cloud agents']);
+  assert.equal(c.rival[1].example, 'Cognition, Factory', 'the parenthetical is dropped from an example');
+  assert.ok(!c.rival.some((o) => o.label === 'Removed kind'), 'a removed item is not a chip');
+  assert.deepEqual(c.watch.map((o) => o.label), ['Open-source funding', 'DAO tooling'],
+    'the area already watched as a topic is not offered again');
+  assert.deepEqual(ask.chipOptions([]), { rival: [], watch: [] }, 'a project with no data still gets the free entries');
+});
+
+test('parseAnswer refuses what the card cannot send, and caps free text', () => {
+  assert.equal(ask.parseAnswer(null).error, 'bad_answer');
+  assert.equal(ask.parseAnswer({}).error, 'empty_answer');
+  assert.equal(ask.parseAnswer({ picks: [{ question: 'salary', choice: 'x' }] }).error, 'unknown_question');
+  assert.equal(ask.parseAnswer({ names: [{ question: 'rival', text: 'x'.repeat(81) }] }).error, 'text_too_long');
+  assert.equal(ask.parseAnswer({ names: [{ question: 'rival', text: '  !!  ' }] }).error, 'empty_answer');
+  assert.equal(ask.parseAnswer({ picks: Array.from({ length: 21 }, () => ({ question: 'rival', choice: 'a' })) }).error, 'too_many');
+  const ok = ask.parseAnswer({ names: [{ question: 'rival', text: '  Kilo   Code ' }] });
+  assert.deepEqual(ok.entries, [{ question: 'rival', choice: 'kilo code', label: 'Kilo Code', free: true }]);
+  assert.deepEqual(ask.parseAnswer({ nothing: true }), { entries: [], nothing: true });
+});
+
+// ---- the poller -------------------------------------------------------------
+
+test('the poller issues each week once per project, by the wall clock', async () => {
+  const tick = require('../modules/market-watch/pollers/weekly-ask.js').tick;
+  const store = memoryStore({ items: ITEMS });
+  const first = await tick({ project: PROJECT, store, now: () => NOW });
+  assert.equal(first.created, 2);
+  assert.equal((await tick({ project: PROJECT, store, now: () => new Date('2026-10-30T09:00:00Z') })).created, 0, 'a later tick the same week is a no-op');
+  assert.equal(store.state.asks.length, 2);
+  const [rival] = store.state.asks;
+  assert.equal(rival.week_of, '2026-10-26');
+  assert.equal(new Date(rival.closes_at).toISOString(), '2026-11-02T00:00:00.000Z', 'it closes when the next week opens');
+  const next = await tick({ project: PROJECT, store, now: () => new Date('2026-11-02T00:30:00Z') });
+  assert.equal(next.created, 2, 'the next week gets its own card');
+  assert.equal((await tick({ project: OTHER, store, now: () => NOW })).created, 2, 'per project');
+  assert.deepEqual(await tick({ project: null, store }), { skipped: 'no_project_origin' });
+});
+
+// ---- the routes ---------------------------------------------------------------
+
+let viewer = { id: 7, rank: 'xenos', status: 'active' };
+Object.defineProperty(api, 'requireBuilder', {
+  configurable: true,
+  value: (req, res, next) => { if (!viewer) { res.status(401).json({ error: { code: 'unauthenticated' } }); return; } req.builder = viewer; next(); },
+});
+const express = require('express');
+let store = memoryStore({ items: ITEMS, names: { 7: 'ada', 8: 'ben', 9: 'cy' } });
+let clock = NOW;
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } });
+  next();
+});
+app.use(express.json());
+app.use('/api/bongos', require('../modules/market-watch/routes/ask.js')({ store: () => store, project: PROJECT, now: () => clock }));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); resolve({ status: res.statusCode, raw, body: JSON.parse(raw) }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+async function freshWeek() {
+  store = memoryStore({ items: ITEMS, names: { 7: 'ada', 8: 'ben', 9: 'cy' } });
+  clock = NOW;
+  await ask.issueWeeklyAsk(store, { project: PROJECT, now: NOW });
+}
+
+test('THE WHOLE PATH: a member answers from the hall card and the answer shows up as a proposal', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+
+  // 1. The card the hall draws, from the route the hall calls.
+  const got = await call('GET', '/market-watch/ask');
+  assert.equal(got.status, 200);
+  const card = got.body.card;
+  assert.equal(card.week_no, 44);
+  assert.equal(card.next_on, '2026-11-02');
+  const html = widget.cardHtml(card);
+  assert.match(html, /market watch · week 44 · about 30 seconds/);
+  assert.match(html, /what counts as a competitor\?/);
+  assert.match(html, /and what else should we watch\?/);
+  assert.match(html, /data-mwask-choice="AI app builder"/);
+  assert.match(html, /\+ name one/);
+  assert.match(html, /\+ a topic/);
+  assert.match(html, /class="hask ginbox__item mwask"/, 'drawn as an inbox row, so the attention card counts it');
+
+  // 2. The member taps a competitor chip and a watch chip, and names one; the page builds the body.
+  const body = widget.answerBody(card.week_of, [
+    { question: 'rival', choice: 'AI app builder' },
+    { question: 'watch', choice: 'Open-source funding' },
+    { question: 'rival', text: 'Kilo Code' },
+  ]);
+  assert.ok(!('builder_id' in body), 'the page never names who is answering');
+  const sent = await call('POST', '/market-watch/ask/answer', body);
+  assert.equal(sent.status, 200, sent.raw);
+  assert.deepEqual([sent.body.answers, sent.body.proposals, sent.body.pooled], [3, 3, 0]);
+
+  // 3. Each answer is stored, under the caller.
+  assert.deepEqual(store.state.answers.map((a) => [a.builder_id, a.choice, a.free_text]), [
+    [7, 'ai app builder', null], [7, 'open source funding', null], [7, 'kilo code', 'Kilo Code'],
+  ]);
+
+  // 4. ... and is a proposal: change a definition, add a topic, add an item.
+  const byKey = Object.fromEntries(store.state.proposals.map((p) => [p.payload.pool_key, p]));
+  assert.equal(byKey['rival|ai app builder'].kind, 'rule_change');
+  assert.equal(byKey['rival|ai app builder'].rule_version_id, 11, 'it changes the rules in use');
+  assert.equal(byKey['rival|ai app builder'].payload.include, 'AI app builder');
+  assert.deepEqual([byKey['watch|open source funding'].kind, byKey['watch|open source funding'].payload.item_kind], ['add_item', 'topic']);
+  assert.deepEqual([byKey['rival|kilo code'].kind, byKey['rival|kilo code'].payload.item_kind, byKey['rival|kilo code'].payload.name], ['add_item', 'competitor', 'Kilo Code']);
+  for (const p of store.state.proposals) assert.equal(p.proposed_by, 7);
+
+  // 5. Answered: the card is gone for them (no second ask, no reminder).
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+
+  // 6. Two more members name the same rival their own way: one pool, three agree.
+  viewer = { id: 8, rank: 'thetes', status: 'active' };
+  const ben = await call('POST', '/market-watch/ask/answer', { week_of: card.week_of, names: [{ question: 'rival', text: 'kilo-code' }] });
+  assert.deepEqual([ben.body.answers, ben.body.proposals, ben.body.pooled], [1, 0, 1]);
+  viewer = { id: 9, rank: 'metic', status: 'active' };
+  const cyCard = (await call('GET', '/market-watch/ask')).body.card;
+  await call('POST', '/market-watch/ask/answer', { week_of: card.week_of, names: [{ question: 'rival', text: 'The Kilo Code' }] });
+  assert.equal(store.state.proposals.filter((p) => p.payload.pool_key === 'rival|kilo code').length, 1, 'similar answers are ONE proposal');
+
+  // 7. The team rows the next member sees: "Add Kilo Code as a competitor · ada · 3 agree".
+  const row = cyCard.team.find((r) => r.name === 'Kilo Code');
+  assert.deepEqual([row.verb, row.tail, row.who, row.agree], ['Add', 'as a competitor', 'ada', 2], 'ada and ben had agreed when cy opened the card');
+  viewer = { id: 10, rank: 'xenos', status: 'active' };
+  const team = (await call('GET', '/market-watch/ask')).body.card.team;
+  assert.equal(team[0].name, 'Kilo Code');
+  assert.equal(team[0].agree, 3);
+  assert.match(widget.cardHtml({ ...card, team }), /Add <b>Kilo Code<\/b> as a competitor<\/span><span class="mwask__who">ada<\/span><span class="mwask__pill mwask__pill--hot">3 agree<\/span>/);
+});
+
+test('a second tap on the same chip is a no-op, and "nothing new" files no proposal', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const b = { week_of: '2026-10-26', picks: [{ question: 'rival', choice: 'AI app builder' }, { question: 'rival', choice: 'ai APP builder' }] };
+  const r = await call('POST', '/market-watch/ask/answer', b);
+  assert.deepEqual([r.body.answers, r.body.proposals], [1, 1]);
+  viewer = { id: 8, rank: 'xenos', status: 'active' };
+  const n = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.equal(n.status, 200);
+  assert.deepEqual([n.body.answers, n.body.proposals], [1, 0]);
+  assert.equal(store.state.proposals.length, 1);
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null, 'nothing new still answers the week');
+});
+
+test('with no rules in use a competitor chip is kept as an answer and files no proposal', async () => {
+  await freshWeek();
+  store.state.activeRules = {};
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const r = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.deepEqual([r.status, r.body.answers, r.body.proposals], [200, 1, 0]);
+});
+
+test('MEMBERS ONLY: a non-member is refused 403 on both routes, a signed-out caller 401', async () => {
+  await freshWeek();
+  for (const v of [{ id: 66, rank: 'helot', status: 'active' }, { id: 67, rank: 'xenos', status: 'inactive' }, { id: 68, rank: null, status: 'active' }]) {
+    viewer = v;
+    const g = await call('GET', '/market-watch/ask');
+    const p = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'AI app builder' }] });
+    assert.equal(g.status, 403, `GET as ${JSON.stringify(v)}`);
+    assert.equal(p.status, 403, `POST as ${JSON.stringify(v)}`);
+  }
+  assert.equal(store.state.answers.length, 0, 'nothing was stored');
+  viewer = null;
+  assert.equal((await call('POST', '/market-watch/ask/answer', { nothing: true })).status, 401);
+});
+
+test('a member cannot answer for another member', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'metic', status: 'active' };
+  const r = await call('POST', '/market-watch/ask/answer', { builder_id: 8, picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.equal(r.status, 403);
+  assert.equal(r.body.error.code, 'not_your_answer');
+  assert.equal(store.state.answers.length, 0);
+  // Naming yourself is allowed, and is the same as naming nobody.
+  const self = await call('POST', '/market-watch/ask/answer', { builder_id: 7, picks: [{ question: 'rival', choice: 'AI app builder' }] });
+  assert.equal(self.status, 200);
+  assert.deepEqual(store.state.answers.map((a) => a.builder_id), [7]);
+});
+
+test('a chip must be one the card offered, and free text is capped', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  const forged = await call('POST', '/market-watch/ask/answer', { picks: [{ question: 'rival', choice: 'Anything I like' }] });
+  assert.deepEqual([forged.status, forged.body.error.code], [400, 'unknown_choice']);
+  const long = await call('POST', '/market-watch/ask/answer', { names: [{ question: 'watch', text: 'y'.repeat(200) }] });
+  assert.deepEqual([long.status, long.body.error.code], [400, 'text_too_long']);
+  const extra = await call('POST', '/market-watch/ask/answer', { nothing: true, reason: '<b>hi</b>' });
+  assert.equal(extra.status, 400, 'an unknown field is refused (strict body schema)');
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an unanswered card expires quietly: after the week closes there is no card and no answer', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  clock = new Date('2026-11-02T00:00:01Z'); // the next week, before its ask is out
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+  const late = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.deepEqual([late.status, late.body.error.code], [409, 'ask_closed']);
+  // A body for last week, sent once the new week's card is out, is refused, not filed on the new one.
+  await ask.issueWeeklyAsk(store, { project: PROJECT, now: clock });
+  const stale = await call('POST', '/market-watch/ask/answer', { week_of: '2026-10-26', nothing: true });
+  assert.equal(stale.status, 409);
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an ask whose closes_at has passed is closed even inside its week', async () => {
+  await freshWeek();
+  viewer = { id: 7, rank: 'xenos', status: 'active' };
+  for (const a of store.state.asks) a.closes_at = new Date('2026-10-29T00:00:00Z'); // closed this morning
+  assert.equal((await call('GET', '/market-watch/ask')).body.card, null);
+  assert.equal((await call('POST', '/market-watch/ask/answer', { nothing: true })).status, 409);
+  assert.equal(store.state.answers.length, 0);
+});
+
+test('an answer can never land on another project\'s ask', async () => {
+  await freshWeek();
+  await ask.issueWeeklyAsk(store, { project: OTHER, now: NOW });
+  const otherAsk = store.state.asks.find((a) => a.project === OTHER);
+  const id = await store.tx((t) => t.insertAnswer({ project: PROJECT, askId: otherAsk.id, builderId: 7, choice: 'x', freeText: null }));
+  assert.equal(id, null);
+});
+
+// ---- untrusted text is escaped ------------------------------------------------
+
+test('members\' words and item names are escaped wherever the card draws them', () => {
+  const evil = '<img src=x onerror=alert(1)>';
+  const html = widget.cardHtml({
+    week_of: '2026-10-26', week_no: 44, next_on: '2026-11-02', streak: 2,
+    questions: [{ key: 'rival', prompt: 'what counts as a competitor?', options: [{ label: evil, example: `"${evil}` }] }],
+    team: [{ verb: 'Add', name: evil, tail: 'as a competitor', who: evil, agree: 1, status: 'open' }],
+  });
+  assert.ok(!html.includes('<img'), 'no member text becomes markup');
+  assert.ok(html.includes('&lt;img src=x onerror=alert(1)&gt;'));
+  assert.ok(!/data-mwask-choice="[^"]*"[^ >]*onerror/.test(html), 'an attribute cannot be broken out of');
+  assert.equal(widget.cardHtml(null), '', 'no card, no slice');
+  assert.deepEqual(widget.answerBody('2026-10-26', [{ question: 'watch', text: 'z'.repeat(120) }]).names[0].text.length, 80);
+});