@bongos/core 1.24.44 → 1.24.46

package/scripts/bongos/run-unit-tests.js

@@ -140,6 +140,9 @@ const INTEGRATION = new Set([
   // task 1004677: two marked auto-pickup claims racing for the last slot of the
   // monthly cap; only real connections prove the advisory lock. Scratch DB only.
   'autopickup_cap_db',
+  // task 1004547: an Autobongos runner's one-time code works once, even when two
+  // PCs race it, and not after it expires; only real SQL proves both. Scratch DB.
+  'autobongos_runner_login_db',
   'claims_requested_worktree_db',
   'clawback_confirmed_backlog',
   // task 1003113: the copy_desk_flags schema half. The module's own tests are

package/src/bongos/auth.js

@@ -51,6 +51,8 @@ const { pool } = require('./pool');
 // the optional `?.` degrades to a no-op when the module is off (the stage tick is
 // best-effort anyway).
 const seams = require('../module-seams');
+// task 1004547: an Autobongos runner's own login holds no SYSTEM permission.
+const { isRunnerSession, withoutSystemPermissions, capRunnerRank } = require('./runner-login');
 const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
@@ -284,7 +286,11 @@ async function requireBuilder(req, res, next) {
     // rank is the single source of authority (ADR 0016). Read fresh from the
     // DB on every request via lookupSession — never cached, never from the
     // token — so demotion takes effect on the builder's very next request.
-    rank: session.rank,
+    // An Autobongos runner's own login acts at Metic at most (task 1004547,
+    // runner-login.js capRunnerRank), so every requireRank gate and every handler
+    // that reads this field sees the capped rank; `runner` says why.
+    rank: isRunnerSession(session) ? capRunnerRank(session.rank, RANKS) : session.rank,
+    runner: isRunnerSession(session),
     // system_role identifies a non-human service principal (NULL for every
     // human builder). The BFG cross-builder write gate (requireBfgPrincipal)
     // keys on this EXACT value — never on rank — so an Archon token cannot
@@ -456,7 +462,22 @@ async function pageGateAlsoAdmits(name, session) {
 // query fold, not the cross-request memo ADR 0016 forbids. Anything unexpected —
 // no raw keys on the row, an older port without the pure half, a throw — falls
 // through to the DB resolve, so the fold can only ever be an optimization.
-async function resolveHeldPermissions(builderId, rawKeys) {
+//
+// A RUNNER SESSION HOLDS NO SYSTEM PERMISSION (task 1004547). `session` is the
+// caller's session row; when its source is 'runner' (an Autobongos PC's own login,
+// src/bongos/runner-login.js) every key the catalog marks system:true is dropped —
+// core.pin.move, autonomy.fence.manage, builder.rank.set and the rest. The owner
+// rule (ADR 0307 §6) is that an unattended machine never moves a live version or
+// touches its own kill switch; this is where the server, which the PC cannot edit,
+// makes that true. An unknown key, or a port without isSystem, drops too.
+async function resolveHeldPermissions(builderId, rawKeys, session = null) {
+  const held = await resolveHeldPermissionsForBuilder(builderId, rawKeys);
+  if (held === null || !isRunnerSession(session)) return held;
+  const governance = seams.resolveOptional('government');
+  return withoutSystemPermissions(held, governance && governance.isSystem);
+}
+
+async function resolveHeldPermissionsForBuilder(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
   const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
@@ -506,7 +527,7 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
-  const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
+  const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys, session);
   if (held === null || !held.has(permission)) {
     // The rank door said no. A page whose data route admits a SECOND audience
     // asks that door before redirecting (ADR 0210) — consulted here and nowhere
@@ -770,7 +791,7 @@ function requirePermission(...perms) {
     // (no port / malformed port / a throwing resolver) and is always a denial.
     // req.rawPermissionKeys rides the fold (task 1002556) when the session query
     // carried the grant keys; absent, the DB resolve runs exactly as before.
-    const held = await resolveHeldPermissions(builderId, req.rawPermissionKeys);
+    const held = await resolveHeldPermissions(builderId, req.rawPermissionKeys, req.gdsSession);
     if (held === null) return deny(null);
     if (required.every((key) => held.has(key))) return next();
     return deny(required.filter((key) => held.has(key)));

package/src/bongos/route-rank-check.js

@@ -199,6 +199,11 @@ const EXPECTED_RANKS = {
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',
+  // An Autobongos runner's own login (task 1004547). Issuing the one-time code is
+  // Metic+ (who may run a runner); pinned so a widening cannot hand a Xenos a
+  // machine login. The exchange is a public auth-establishment route like
+  // /auth/device/exchange (the code IS the credential), so it carries no pin.
+  'POST /auth/runner-code/issue': 'metic+archon',
   // deliberately any-builder (task 1003341) — the OWN-scoped half of the same
   // capability. These reach only the caller's own sessions (every statement is
   // keyed on req.builder.id), so a rank floor here would just put an Archon back

package/src/bongos/routes/auth.js

@@ -35,6 +35,8 @@ const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 // endpoint refuses. Same composed answer the gate itself reads.
 const { effectiveJoinDoor } = require('../project-door.js');
 const db = require('../db');
+// task 1004547: an Autobongos PC's own login, from a one-time code.
+const { issueCode: issueRunnerCode, exchangeCode: exchangeRunnerCode } = require('../runner-login');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
@@ -1364,6 +1366,52 @@ module.exports = function buildAuthRouter() {
     }
   });
 
+  // POST /auth/runner-code/issue — task 1004547 (goal 1000139). A ONE-TIME CODE an
+  // Autobongos PC trades for its own login (src/bongos/runner-login.js). Body:
+  // { label? } — the PC's name, shown later in the builder's sessions list.
+  //
+  // rank: metic+archon — running a runner is Metic+ today (owner, 2026-11-06).
+  // Cookie ONLY, like /auth/cli-token/issue: a bearer — a CLI token or a runner's
+  // own login — must never be able to mint another login. The code is returned
+  // once; only its hash is stored. It works once and expires in 15 minutes.
+  router.post('/auth/runner-code/issue', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+    if (validateOrRespond(req, res, { label: { type: 'string', maxLength: 200 } })) return;
+    if (!sessionCookieToken(req)) {
+      return res.fail('cookie_required', { status: 403, message: 'A runner code is issued from the builders hall in a browser (Settings), never from a token, so a leaked token cannot mint a login.' });
+    }
+    try {
+      const out = await issueRunnerCode({ builderId: req.builder.id, label: req.body && req.body.label });
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '').trim().replace(/\/+$/, '');
+      res.status(201).json({ ok: true, code: out.code, expires_at: out.expires_at, api_base: issuer || null });
+    } catch (err) {
+      log.error('[gds] POST /auth/runner-code/issue', err && err.message);
+      res.fail('runner_code_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /auth/runner-code/exchange — task 1004547. The PC sends the one-time code
+  // and gets back its own login (a 'runner' session). Body: { code }.
+  //
+  // rank: public — auth establishment; the one-time code is the bearer. A wrong,
+  // used or expired code all answer the same 401, so nothing is learned from which.
+  // The router's per-IP write limit (rateLimitMiddleware) is its abuse ceiling; the
+  // code is 256 bits, so guessing one is not a race worth a limiter of its own.
+  router.post('/auth/runner-code/exchange', async (req, res) => {
+    if (validateOrRespond(req, res, { code: { required: true, type: 'string', maxLength: 200 } })) return;
+    try {
+      const out = await exchangeRunnerCode({ code: req.body.code, userAgent: req.headers['user-agent'] ?? null });
+      if (out.refused === 'builder_inactive') return res.fail('builder_inactive', 403);
+      if (out.refused) {
+        return res.fail('runner_code_invalid', { status: 401, message: 'That runner code is wrong, already used or expired. Make a new one in Settings.' });
+      }
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '').trim().replace(/\/+$/, '');
+      res.json({ ok: true, token: out.token, session_id: out.session_id, builder_login: out.github_login, label: out.label, api_base: issuer || null });
+    } catch (err) {
+      log.error('[gds] POST /auth/runner-code/exchange', err && err.message);
+      res.fail('runner_code_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /auth/revoke — V3.R38 / #259. Archon-only. Kill a SINGLE session by
   // its primary-key id. Used for surgical lockouts (e.g. a compromised CLI on
   // a known builder's laptop) without disturbing that builder's other sessions.

package/src/bongos/runner-login.js

@@ -0,0 +1,151 @@
+'use strict';
+
+// src/bongos/runner-login.js — an Autobongos runner's OWN login (task 1004547, goal
+// 1000139, ADR 0307 §6).
+//
+// WHY. A runner used to run under its builder's CLI session. The server then could
+// not tell a runner's work from the person's, except by the worktree name the runner
+// chose, and the worker carried the person's full authority (it could move a live
+// core pin, task 1004974). Now the PC gets a login of its own:
+//
+//   1. In the builders hall (a browser, so a cookie session), a Metic+ builder asks
+//      for a ONE-TIME CODE (issueCode). The plaintext is shown once; only its sha256
+//      is stored. It expires after CODE_TTL_MS and works once.
+//   2. The setup command on the PC trades the code for a session whose source is
+//      'runner' (exchangeCode). That session belongs to the same builder, so the
+//      ledger credits them, but the server knows it is a machine working alone.
+//   3. What 'runner' changes, server-side, where the PC cannot reach:
+//        - every claim it makes is marked autonomous (claims.autonomous), whatever
+//          the worktree is called, and the publish guard reads that mark;
+//        - it holds no SYSTEM permission (core.pin.move, autonomy.fence.manage, …),
+//          and the project-owner door to a core move is shut to it (auth.js,
+//          provisioning core-upgrade-authz.js);
+//        - it may not mint another login: issuing a code needs a browser cookie.
+//   4. "Remove this PC" is the ordinary own-session revoke; the next call is a 401.
+//
+// The exchange is unauthenticated by design (the PC has no login yet); the code IS
+// the credential, so it is 256 bits of CSPRNG, single-use, short-lived and looked up
+// by its full digest, exactly as a session bearer is (db-kernel sessionTokenHash).
+
+const crypto = require('node:crypto');
+const { pool } = require('./pool');
+const { sessionTokenHash } = require('./db-kernel');
+
+const RUNNER_SOURCE = 'runner';
+const CODE_TTL_MS = 15 * 60 * 1000; // 15 minutes: long enough to paste, short enough to waste if leaked
+const CODE_PREFIX = 'abr_'; // recognisable in a pasted command, never part of the secret's entropy
+const LABEL_MAX = 80;
+
+const isRunnerSession = (session) => !!session && session.source === RUNNER_SOURCE;
+
+function cleanLabel(label) {
+  if (typeof label !== 'string') return null;
+  const s = label.replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, LABEL_MAX);
+  return s || null;
+}
+
+// Issue a one-time code for `builderId`. Returns { code, expires_at, id }. The
+// plaintext code exists only in this return value.
+async function issueCode({ builderId, label = null, now = Date.now() }, exec = pool) {
+  const code = CODE_PREFIX + crypto.randomBytes(32).toString('hex');
+  const expiresAt = new Date(now + CODE_TTL_MS);
+  const { rows } = await exec.query(
+    `INSERT INTO runner_enrollment_codes (builder_id, code_hash, label, expires_at)
+     VALUES ($1, $2, $3, $4)
+     RETURNING id, expires_at`,
+    [builderId, sessionTokenHash(code), cleanLabel(label), expiresAt]
+  );
+  return { id: rows[0].id, code, expires_at: rows[0].expires_at };
+}
+
+// Trade a code for a runner session. Returns { token, session_id, builder_id,
+// github_login, label } or a refusal { refused: 'code_invalid' | 'builder_inactive' }.
+// One transaction: the code is burned (used_at) by the same UPDATE that proves it
+// was live, so two PCs racing one code cannot both win. A wrong, used or expired
+// code all answer the same 'code_invalid', so the route leaks nothing about which.
+async function exchangeCode({ code, userAgent = null }, exec = pool) {
+  if (typeof code !== 'string' || !code.startsWith(CODE_PREFIX) || code.length > 200) {
+    return { refused: 'code_invalid' };
+  }
+  const client = typeof exec.connect === 'function' ? await exec.connect() : exec;
+  const release = () => { if (client !== exec && typeof client.release === 'function') client.release(); };
+  try {
+    await client.query('BEGIN');
+    const { rows } = await client.query(
+      `UPDATE runner_enrollment_codes c
+          SET used_at = now()
+         FROM builders b
+        WHERE c.code_hash = $1
+          AND c.used_at IS NULL
+          AND c.expires_at > now()
+          AND b.id = c.builder_id
+        RETURNING c.id, c.builder_id, c.label, b.github_login, b.status`,
+      [sessionTokenHash(code)]
+    );
+    const hit = rows[0];
+    if (!hit) {
+      await client.query('ROLLBACK');
+      return { refused: 'code_invalid' };
+    }
+    if (hit.status === 'inactive') {
+      await client.query('ROLLBACK');
+      return { refused: 'builder_inactive' };
+    }
+    const token = crypto.randomBytes(32).toString('hex');
+    const ua = [hit.label ? `runner:${hit.label}` : 'runner', userAgent].filter(Boolean).join(' · ').slice(0, 400);
+    const ins = await client.query(
+      `INSERT INTO builder_sessions (builder_id, token_hash, source, user_agent, expires_at)
+       VALUES ($1, $2, $3, $4, NULL)
+       RETURNING id`,
+      [hit.builder_id, sessionTokenHash(token), RUNNER_SOURCE, ua]
+    );
+    await client.query(
+      `UPDATE runner_enrollment_codes SET used_session_id = $2 WHERE id = $1`,
+      [hit.id, ins.rows[0].id]
+    );
+    await client.query('COMMIT');
+    return { token, session_id: ins.rows[0].id, builder_id: hit.builder_id, github_login: hit.github_login, label: hit.label };
+  } catch (err) {
+    try { await client.query('ROLLBACK'); } catch (_) { /* the original error wins */ }
+    throw err;
+  } finally {
+    release();
+  }
+}
+
+// The highest rank a runner session ACTS at (task 1004547). A runner does its
+// builder's ordinary work (claim, ship, grade, publish, file a blocker), and every
+// one of those routes is open at Metic. Anything gated above that is an owner's
+// decision, which an unattended machine does not make. `ranks` is the ladder,
+// highest authority first (db-kernel RANKS); an unknown rank is returned as is,
+// because requireRank already fails it closed.
+const RUNNER_RANK_CAP = 'metic';
+function capRunnerRank(rank, ranks) {
+  const i = ranks.indexOf(rank);
+  const cap = ranks.indexOf(RUNNER_RANK_CAP);
+  if (i === -1 || cap === -1) return rank;
+  return i < cap ? RUNNER_RANK_CAP : rank;
+}
+
+// Drop every SYSTEM permission from a held set, for a runner session. `isSystem` is
+// the government port's catalog.isSystem: true = system, false = not, null =
+// unknown key. Anything but an explicit false is dropped, so an unreadable catalog
+// leaves a runner with less, never more. Without a port at all every key goes.
+function withoutSystemPermissions(held, isSystem) {
+  const out = new Set();
+  if (typeof isSystem !== 'function') return out;
+  for (const key of held) {
+    let sys = null;
+    try { sys = isSystem(key); } catch (_) { sys = null; }
+    if (sys === false) out.add(key);
+  }
+  return out;
+}
+
+module.exports = {
+  isRunnerSession,
+  issueCode,
+  exchangeCode,
+  withoutSystemPermissions,
+  capRunnerRank,
+};

package/src/bongos/serve-internal.js

@@ -1214,10 +1214,15 @@ function mountInternalSurfaces(app) {
   // static handler. Gated per-request on the live enabled set so a disabled module's
   // assets 404 (defense in depth behind the no-injection above). Same Cache-Control
   // posture as the hall's own scripts.
+  //
+  // Served on EVERY host, the generic surface hosts (status.) included (task
+  // 1005081): the shared token sheet /modules/ui-design/public/tokens.css is one
+  // URL the hall, the landing, the status page and raise all load. A surface host
+  // still answers its own files first — its static handler above falls through
+  // only when the surface dir has no such file.
   const MODULE_ASSET_RE = /^\/modules\/([a-z][a-z0-9-]*)\/public\/(.+)$/;
   const MODULES_ROOT = path.join(ROOT, 'modules');
   app.get(MODULE_ASSET_RE, (req, res, next) => {
-    if (isModuleSurfaceHost(req)) return next();
     const m = req.path.match(MODULE_ASSET_RE);
     const key = m[1];
     let enabled = false;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.44'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_runner_login.mjs

@@ -0,0 +1,296 @@
+// tests/autobongos_runner_login.mjs — an Autobongos runner's OWN login (task 1004547,
+// goal 1000139).
+//
+// The done-when this proves: a runner session claiming under a NON-runner worktree
+// name is still recognised as autonomous by the server and refused a self-modifying
+// publish. Plus the owner's extras: the one-time code works once, expires, is
+// Metic+-only to issue; the runner login acts at Metic at most, holds no system
+// permission, and cannot take the owner door to a core move.
+//
+// DB-free: the session lookup, the government port and the pool are stubbed, the
+// way tests/government_session_scope.mjs and tests/government_require_permission.mjs
+// do. The claim route and the publish guard are driven through their real code.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// auth.js destructures lookupSession at load, so the stub goes in first.
+const dbKernel = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
+let nextSession = null;
+dbKernel.lookupSession = async () => nextSession;
+
+const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const runnerLogin = require(path.join(ROOT, 'src', 'bongos', 'runner-login.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const guard = require(path.join(ROOT, 'modules', 'lifecycle', 'runner-self-guard.js'));
+const authz = require(path.join(ROOT, 'modules', 'provisioning', 'core-upgrade-authz.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+
+function fakeRes() {
+  const res = {
+    _status: null,
+    _json: null,
+    status(code) { this._status = code; return this; },
+    json(body) { this._json = body; return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+
+async function throughRequireBuilder(session) {
+  nextSession = session;
+  const req = { headers: { authorization: 'Bearer anytoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  return { req, res, nexted };
+}
+
+const ARCHON_RUNNER = { session_id: 91, builder_id: 3, source: 'runner', rank: 'archon', status: 'active', github_login: 'owner' };
+const ARCHON_CLI = { ...ARCHON_RUNNER, session_id: 90, source: 'cli' };
+
+// ── the login ────────────────────────────────────────────────────────────────
+
+test('a runner login is a declared session source, and requireBuilder admits it', async () => {
+  const { nexted, req } = await throughRequireBuilder(ARCHON_RUNNER);
+  assert.equal(nexted, true);
+  assert.equal(req.builder.runner, true);
+});
+
+test('a runner login acts at Metic at most, so every archon rank gate refuses it', async () => {
+  const { req } = await throughRequireBuilder(ARCHON_RUNNER);
+  assert.equal(req.builder.rank, 'metic', 'an Archon\'s runner is capped');
+  const res = fakeRes();
+  let nexted = false;
+  auth.requireRank('archon')(req, res, () => { nexted = true; });
+  assert.equal(nexted, false);
+  assert.equal(res._status, 403);
+  // The same person's own CLI session keeps their rank: the cap is the login's, not the person's.
+  const cli = await throughRequireBuilder(ARCHON_CLI);
+  assert.equal(cli.req.builder.rank, 'archon');
+  assert.equal(cli.req.builder.runner, false);
+});
+
+test('a lower rank is never raised by the cap', () => {
+  const R = dbKernel.RANKS;
+  assert.equal(runnerLogin.capRunnerRank('xenos', R), 'xenos');
+  assert.equal(runnerLogin.capRunnerRank('metic', R), 'metic');
+  assert.equal(runnerLogin.capRunnerRank('olympian', R), 'metic');
+  assert.equal(runnerLogin.capRunnerRank('nonsense', R), 'nonsense', 'an unknown rank is left for requireRank to fail closed');
+});
+
+// ── system permissions ───────────────────────────────────────────────────────
+
+async function permissionGate(session, key, held) {
+  seams._reset();
+  seams.registerProvider('government', {
+    resolveBuilderPermissions: async () => held,
+    isSystem: catalog.isSystem,
+  });
+  const req = { builder: { id: 3, rank: 'archon' }, gdsSession: session, rawPermissionKeys: null };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requirePermission(key)(req, res, () => { nexted = true; });
+  seams._reset();
+  return { res, nexted };
+}
+
+test('a runner login is refused every system permission its builder holds', async () => {
+  const systemKeys = catalog.systemKeys().filter((k) => !catalog.isPrincipalKey(k));
+  assert.ok(systemKeys.includes('core.pin.move') && systemKeys.includes('autonomy.fence.manage'));
+  for (const key of systemKeys) {
+    const runner = await permissionGate(ARCHON_RUNNER, key, systemKeys);
+    assert.equal(runner.nexted, false, `${key} must be refused to a runner login`);
+    assert.equal(runner.res._status, 403);
+    const person = await permissionGate(ARCHON_CLI, key, systemKeys);
+    assert.equal(person.nexted, true, `${key} stays with the person's own session`);
+  }
+});
+
+test('a runner login keeps the ordinary permissions its builder holds', async () => {
+  const ordinary = catalog.permissionKeys().find((k) => catalog.isSystem(k) === false);
+  const r = await permissionGate(ARCHON_RUNNER, ordinary, [ordinary]);
+  assert.equal(r.nexted, true);
+});
+
+test('with no way to tell a system key, a runner holds nothing', () => {
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a', 'b']), undefined).size, 0);
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a']), () => null).size, 0, 'an unknown key drops');
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a']), () => { throw new Error('x'); }).size, 0);
+});
+
+test('a runner login never takes the owner door to a core move', async () => {
+  let ownerLookups = 0;
+  let pinGateCalled = 0;
+  const gate = authz.requireOwnProjectOrPin({
+    pinGate: (req, res) => { pinGateCalled++; res.status(403).json({ refused: true }); },
+    provisioning: { getInstanceById: async () => { ownerLookups++; return { hosting_shape: 'cloud-host', owner_builder_id: 3 }; } },
+    pool: {},
+    log: null,
+  });
+  const res = fakeRes();
+  let nexted = false;
+  await gate({ params: { id: '41' }, builder: { id: 3, runner: true } }, res, () => { nexted = true; });
+  assert.equal(nexted, false);
+  assert.equal(pinGateCalled, 1, 'it falls to the permission gate, which a runner fails');
+  assert.equal(ownerLookups, 0, 'the ownership door is never asked');
+  // The owner's own session still goes through the owner door.
+  let ownerNexted = false;
+  await gate({ params: { id: '41' }, builder: { id: 3, runner: false } }, fakeRes(), () => { ownerNexted = true; });
+  assert.equal(ownerNexted, true);
+});
+
+// ── the one-time code ────────────────────────────────────────────────────────
+
+// A pool double holding the codes table and the sessions inserted from it.
+function fakePool({ builderStatus = 'active' } = {}) {
+  const codes = [];
+  const sessions = [];
+  const client = {
+    async query(sql, params = []) {
+      if (/^(BEGIN|COMMIT|ROLLBACK)/.test(sql)) return { rows: [] };
+      if (/INSERT INTO runner_enrollment_codes/.test(sql)) {
+        const row = { id: codes.length + 1, builder_id: params[0], code_hash: params[1], label: params[2], expires_at: params[3], used_at: null };
+        codes.push(row);
+        return { rows: [{ id: row.id, expires_at: row.expires_at }] };
+      }
+      if (/UPDATE runner_enrollment_codes c\s+SET used_at/.test(sql)) {
+        const hit = codes.find((c) => c.code_hash === params[0] && !c.used_at && c.expires_at > new Date());
+        if (!hit) return { rows: [] };
+        hit.used_at = new Date();
+        return { rows: [{ id: hit.id, builder_id: hit.builder_id, label: hit.label, github_login: 'owner', status: builderStatus }] };
+      }
+      if (/INSERT INTO builder_sessions/.test(sql)) {
+        sessions.push({ builder_id: params[0], token_hash: params[1], source: params[2], user_agent: params[3] });
+        return { rows: [{ id: 500 + sessions.length }] };
+      }
+      if (/UPDATE runner_enrollment_codes SET used_session_id/.test(sql)) return { rows: [] };
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+    release() {},
+  };
+  return { codes, sessions, connect: async () => client, query: client.query };
+}
+
+test('a code is issued once, stored only as a hash, and expires in 15 minutes', async () => {
+  const pool = fakePool();
+  const now = Date.UTC(2026, 10, 6, 12, 0, 0);
+  const out = await runnerLogin.issueCode({ builderId: 3, label: 'nucbox\nm8', now }, pool);
+  assert.match(out.code, /^abr_[0-9a-f]{64}$/);
+  assert.equal(pool.codes.length, 1);
+  assert.equal(pool.codes[0].code_hash, dbKernel.sessionTokenHash(out.code));
+  assert.ok(!JSON.stringify(pool.codes).includes(out.code), 'the plaintext is never stored');
+  assert.equal(pool.codes[0].expires_at.getTime() - now, 15 * 60 * 1000);
+  assert.equal(pool.codes[0].label, 'nucbox m8', 'a control character in the label is flattened');
+});
+
+test('a code works exactly once and yields a runner session', async () => {
+  const pool = fakePool();
+  const { code } = await runnerLogin.issueCode({ builderId: 3, label: 'pc' }, pool);
+  const first = await runnerLogin.exchangeCode({ code, userAgent: 'setup/1' }, pool);
+  assert.equal(first.builder_id, 3);
+  assert.match(first.token, /^[0-9a-f]{64}$/);
+  assert.equal(pool.sessions.length, 1);
+  assert.equal(pool.sessions[0].source, 'runner');
+  assert.equal(pool.sessions[0].token_hash, dbKernel.sessionTokenHash(first.token), 'the token is stored only as a hash');
+  const again = await runnerLogin.exchangeCode({ code }, pool);
+  assert.deepEqual(again, { refused: 'code_invalid' }, 'a used code is refused');
+  assert.equal(pool.sessions.length, 1);
+});
+
+test('an expired, wrong or malformed code is refused with the same answer', async () => {
+  const pool = fakePool();
+  const { code } = await runnerLogin.issueCode({ builderId: 3, now: Date.now() - 16 * 60 * 1000 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: 'abr_' + '0'.repeat(64) }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: 'not-a-code' }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: null }, pool), { refused: 'code_invalid' });
+  assert.equal(pool.sessions.length, 0);
+});
+
+test('an offboarded builder\'s code mints nothing', async () => {
+  const pool = fakePool({ builderStatus: 'inactive' });
+  const { code } = await runnerLogin.issueCode({ builderId: 3 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'builder_inactive' });
+  assert.equal(pool.sessions.length, 0);
+});
+
+// ── the routes ───────────────────────────────────────────────────────────────
+
+test('issuing a code is Metic+, cookie-only, and the exchange is a public auth route', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
+  assert.match(src, /router\.post\('\/auth\/runner-code\/issue', auth\.requireBuilder, auth\.requireRank\('metic', 'archon'\),/);
+  const issue = src.slice(src.indexOf("'/auth/runner-code/issue'"), src.indexOf("'/auth/runner-code/exchange'"));
+  assert.match(issue, /if \(!sessionCookieToken\(req\)\)/, 'a bearer (CLI or runner) cannot mint a login');
+  const rr = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js')).checkRouteRanks();
+  const ranks = Object.fromEntries(rr.routes.map((r) => [r.key, r.rank]));
+  assert.equal(ranks['POST /auth/runner-code/issue'], 'metic+archon');
+  assert.equal(ranks['POST /auth/runner-code/exchange'], 'public');
+  assert.equal(rr.ok, true);
+});
+
+// ── the claim and the publish ────────────────────────────────────────────────
+
+test('the claim route marks a runner login\'s claim autonomous from the session, never the body', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'claims.js'), 'utf8');
+  assert.match(src, /autonomous: !!\(req\.builder && req\.builder\.runner\),/);
+  assert.doesNotMatch(src, /autonomous: [^\n]*req\.body/);
+  assert.match(src, /if \(req\.builder && req\.builder\.runner\) \{\n\s*return res\.fail\('runner_batch_refused'/);
+  const db = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'db-claims.js'), 'utf8');
+  assert.match(db, /\$\{autonomous \? ', autonomous' : ''\}/);
+});
+
+const files = (...p) => p.map((x) => ({ path: x }));
+
+test('DONE WHEN: a runner claim under a person-looking worktree name is still refused a self-modifying publish', async () => {
+  const disguised = { worktree_name: 'fix-typo', requested_worktree_name: 'fix-typo', autonomous: true };
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, branch: 'fix-typo' }, {
+    readLatestClaim: async () => disguised,
+    getPullRequestFiles: async () => files('modules/autonomy/fence.js'),
+  });
+  assert.equal(r && r.code, 'self_modification');
+  assert.deepEqual(r.files, ['modules/autonomy/fence.js']);
+});
+
+test('a runner login publishing someone else\'s claim is checked too', async () => {
+  const person = { worktree_name: 'mine', requested_worktree_name: 'mine', autonomous: false };
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, publisherIsRunner: true }, {
+    readLatestClaim: async () => person,
+    getPullRequestFiles: async () => files('scripts/bongos/autobongos-run.js'),
+  });
+  assert.equal(r && r.code, 'self_modification');
+});
+
+test('a person\'s claim published by a person is still never checked', async () => {
+  let read = 0;
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, publisherIsRunner: false }, {
+    readLatestClaim: async () => ({ worktree_name: 'mine', requested_worktree_name: null, autonomous: false }),
+    getPullRequestFiles: async () => { read++; return files('modules/autonomy/fence.js'); },
+  });
+  assert.equal(r, null);
+  assert.equal(read, 0);
+});
+
+test('the guard reads the autonomous mark from the claim row, and the route passes the publisher', async () => {
+  const seen = [];
+  await guard.readLatestClaim(4242, { query: async (sql) => { seen.push(sql); return { rows: [] }; } });
+  assert.match(seen[0], /c\.autonomous/);
+  const tasks = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'tasks.js'), 'utf8');
+  assert.match(tasks, /publisherIsRunner: !!\(req\.builder && req\.builder\.runner\)/);
+});
+
+test('the migration adds the source, the codes table and the claim mark, and stores no plaintext', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations', 'core_295_runner_logins.sql'), 'utf8');
+  assert.match(sql, /CHECK \(source IN \('cli', 'web', 'runner'\)\)/);
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS runner_enrollment_codes/);
+  assert.match(sql, /code_hash\s+text NOT NULL UNIQUE/);
+  assert.doesNotMatch(sql, /\bcode\s+text\b/, 'no plaintext code column');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS autonomous boolean NOT NULL DEFAULT false/);
+});