@bongos/core 1.24.45 → 1.24.47

package/tests/autobongos_runner_login.mjs

@@ -0,0 +1,296 @@
+// tests/autobongos_runner_login.mjs — an Autobongos runner's OWN login (task 1004547,
+// goal 1000139).
+//
+// The done-when this proves: a runner session claiming under a NON-runner worktree
+// name is still recognised as autonomous by the server and refused a self-modifying
+// publish. Plus the owner's extras: the one-time code works once, expires, is
+// Metic+-only to issue; the runner login acts at Metic at most, holds no system
+// permission, and cannot take the owner door to a core move.
+//
+// DB-free: the session lookup, the government port and the pool are stubbed, the
+// way tests/government_session_scope.mjs and tests/government_require_permission.mjs
+// do. The claim route and the publish guard are driven through their real code.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// auth.js destructures lookupSession at load, so the stub goes in first.
+const dbKernel = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
+let nextSession = null;
+dbKernel.lookupSession = async () => nextSession;
+
+const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const runnerLogin = require(path.join(ROOT, 'src', 'bongos', 'runner-login.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const guard = require(path.join(ROOT, 'modules', 'lifecycle', 'runner-self-guard.js'));
+const authz = require(path.join(ROOT, 'modules', 'provisioning', 'core-upgrade-authz.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+
+function fakeRes() {
+  const res = {
+    _status: null,
+    _json: null,
+    status(code) { this._status = code; return this; },
+    json(body) { this._json = body; return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+
+async function throughRequireBuilder(session) {
+  nextSession = session;
+  const req = { headers: { authorization: 'Bearer anytoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  return { req, res, nexted };
+}
+
+const ARCHON_RUNNER = { session_id: 91, builder_id: 3, source: 'runner', rank: 'archon', status: 'active', github_login: 'owner' };
+const ARCHON_CLI = { ...ARCHON_RUNNER, session_id: 90, source: 'cli' };
+
+// ── the login ────────────────────────────────────────────────────────────────
+
+test('a runner login is a declared session source, and requireBuilder admits it', async () => {
+  const { nexted, req } = await throughRequireBuilder(ARCHON_RUNNER);
+  assert.equal(nexted, true);
+  assert.equal(req.builder.runner, true);
+});
+
+test('a runner login acts at Metic at most, so every archon rank gate refuses it', async () => {
+  const { req } = await throughRequireBuilder(ARCHON_RUNNER);
+  assert.equal(req.builder.rank, 'metic', 'an Archon\'s runner is capped');
+  const res = fakeRes();
+  let nexted = false;
+  auth.requireRank('archon')(req, res, () => { nexted = true; });
+  assert.equal(nexted, false);
+  assert.equal(res._status, 403);
+  // The same person's own CLI session keeps their rank: the cap is the login's, not the person's.
+  const cli = await throughRequireBuilder(ARCHON_CLI);
+  assert.equal(cli.req.builder.rank, 'archon');
+  assert.equal(cli.req.builder.runner, false);
+});
+
+test('a lower rank is never raised by the cap', () => {
+  const R = dbKernel.RANKS;
+  assert.equal(runnerLogin.capRunnerRank('xenos', R), 'xenos');
+  assert.equal(runnerLogin.capRunnerRank('metic', R), 'metic');
+  assert.equal(runnerLogin.capRunnerRank('olympian', R), 'metic');
+  assert.equal(runnerLogin.capRunnerRank('nonsense', R), 'nonsense', 'an unknown rank is left for requireRank to fail closed');
+});
+
+// ── system permissions ───────────────────────────────────────────────────────
+
+async function permissionGate(session, key, held) {
+  seams._reset();
+  seams.registerProvider('government', {
+    resolveBuilderPermissions: async () => held,
+    isSystem: catalog.isSystem,
+  });
+  const req = { builder: { id: 3, rank: 'archon' }, gdsSession: session, rawPermissionKeys: null };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requirePermission(key)(req, res, () => { nexted = true; });
+  seams._reset();
+  return { res, nexted };
+}
+
+test('a runner login is refused every system permission its builder holds', async () => {
+  const systemKeys = catalog.systemKeys().filter((k) => !catalog.isPrincipalKey(k));
+  assert.ok(systemKeys.includes('core.pin.move') && systemKeys.includes('autonomy.fence.manage'));
+  for (const key of systemKeys) {
+    const runner = await permissionGate(ARCHON_RUNNER, key, systemKeys);
+    assert.equal(runner.nexted, false, `${key} must be refused to a runner login`);
+    assert.equal(runner.res._status, 403);
+    const person = await permissionGate(ARCHON_CLI, key, systemKeys);
+    assert.equal(person.nexted, true, `${key} stays with the person's own session`);
+  }
+});
+
+test('a runner login keeps the ordinary permissions its builder holds', async () => {
+  const ordinary = catalog.permissionKeys().find((k) => catalog.isSystem(k) === false);
+  const r = await permissionGate(ARCHON_RUNNER, ordinary, [ordinary]);
+  assert.equal(r.nexted, true);
+});
+
+test('with no way to tell a system key, a runner holds nothing', () => {
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a', 'b']), undefined).size, 0);
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a']), () => null).size, 0, 'an unknown key drops');
+  assert.equal(runnerLogin.withoutSystemPermissions(new Set(['a']), () => { throw new Error('x'); }).size, 0);
+});
+
+test('a runner login never takes the owner door to a core move', async () => {
+  let ownerLookups = 0;
+  let pinGateCalled = 0;
+  const gate = authz.requireOwnProjectOrPin({
+    pinGate: (req, res) => { pinGateCalled++; res.status(403).json({ refused: true }); },
+    provisioning: { getInstanceById: async () => { ownerLookups++; return { hosting_shape: 'cloud-host', owner_builder_id: 3 }; } },
+    pool: {},
+    log: null,
+  });
+  const res = fakeRes();
+  let nexted = false;
+  await gate({ params: { id: '41' }, builder: { id: 3, runner: true } }, res, () => { nexted = true; });
+  assert.equal(nexted, false);
+  assert.equal(pinGateCalled, 1, 'it falls to the permission gate, which a runner fails');
+  assert.equal(ownerLookups, 0, 'the ownership door is never asked');
+  // The owner's own session still goes through the owner door.
+  let ownerNexted = false;
+  await gate({ params: { id: '41' }, builder: { id: 3, runner: false } }, fakeRes(), () => { ownerNexted = true; });
+  assert.equal(ownerNexted, true);
+});
+
+// ── the one-time code ────────────────────────────────────────────────────────
+
+// A pool double holding the codes table and the sessions inserted from it.
+function fakePool({ builderStatus = 'active' } = {}) {
+  const codes = [];
+  const sessions = [];
+  const client = {
+    async query(sql, params = []) {
+      if (/^(BEGIN|COMMIT|ROLLBACK)/.test(sql)) return { rows: [] };
+      if (/INSERT INTO runner_enrollment_codes/.test(sql)) {
+        const row = { id: codes.length + 1, builder_id: params[0], code_hash: params[1], label: params[2], expires_at: params[3], used_at: null };
+        codes.push(row);
+        return { rows: [{ id: row.id, expires_at: row.expires_at }] };
+      }
+      if (/UPDATE runner_enrollment_codes c\s+SET used_at/.test(sql)) {
+        const hit = codes.find((c) => c.code_hash === params[0] && !c.used_at && c.expires_at > new Date());
+        if (!hit) return { rows: [] };
+        hit.used_at = new Date();
+        return { rows: [{ id: hit.id, builder_id: hit.builder_id, label: hit.label, github_login: 'owner', status: builderStatus }] };
+      }
+      if (/INSERT INTO builder_sessions/.test(sql)) {
+        sessions.push({ builder_id: params[0], token_hash: params[1], source: params[2], user_agent: params[3] });
+        return { rows: [{ id: 500 + sessions.length }] };
+      }
+      if (/UPDATE runner_enrollment_codes SET used_session_id/.test(sql)) return { rows: [] };
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+    release() {},
+  };
+  return { codes, sessions, connect: async () => client, query: client.query };
+}
+
+test('a code is issued once, stored only as a hash, and expires in 15 minutes', async () => {
+  const pool = fakePool();
+  const now = Date.UTC(2026, 10, 6, 12, 0, 0);
+  const out = await runnerLogin.issueCode({ builderId: 3, label: 'nucbox\nm8', now }, pool);
+  assert.match(out.code, /^abr_[0-9a-f]{64}$/);
+  assert.equal(pool.codes.length, 1);
+  assert.equal(pool.codes[0].code_hash, dbKernel.sessionTokenHash(out.code));
+  assert.ok(!JSON.stringify(pool.codes).includes(out.code), 'the plaintext is never stored');
+  assert.equal(pool.codes[0].expires_at.getTime() - now, 15 * 60 * 1000);
+  assert.equal(pool.codes[0].label, 'nucbox m8', 'a control character in the label is flattened');
+});
+
+test('a code works exactly once and yields a runner session', async () => {
+  const pool = fakePool();
+  const { code } = await runnerLogin.issueCode({ builderId: 3, label: 'pc' }, pool);
+  const first = await runnerLogin.exchangeCode({ code, userAgent: 'setup/1' }, pool);
+  assert.equal(first.builder_id, 3);
+  assert.match(first.token, /^[0-9a-f]{64}$/);
+  assert.equal(pool.sessions.length, 1);
+  assert.equal(pool.sessions[0].source, 'runner');
+  assert.equal(pool.sessions[0].token_hash, dbKernel.sessionTokenHash(first.token), 'the token is stored only as a hash');
+  const again = await runnerLogin.exchangeCode({ code }, pool);
+  assert.deepEqual(again, { refused: 'code_invalid' }, 'a used code is refused');
+  assert.equal(pool.sessions.length, 1);
+});
+
+test('an expired, wrong or malformed code is refused with the same answer', async () => {
+  const pool = fakePool();
+  const { code } = await runnerLogin.issueCode({ builderId: 3, now: Date.now() - 16 * 60 * 1000 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: 'abr_' + '0'.repeat(64) }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: 'not-a-code' }, pool), { refused: 'code_invalid' });
+  assert.deepEqual(await runnerLogin.exchangeCode({ code: null }, pool), { refused: 'code_invalid' });
+  assert.equal(pool.sessions.length, 0);
+});
+
+test('an offboarded builder\'s code mints nothing', async () => {
+  const pool = fakePool({ builderStatus: 'inactive' });
+  const { code } = await runnerLogin.issueCode({ builderId: 3 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'builder_inactive' });
+  assert.equal(pool.sessions.length, 0);
+});
+
+// ── the routes ───────────────────────────────────────────────────────────────
+
+test('issuing a code is Metic+, cookie-only, and the exchange is a public auth route', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
+  assert.match(src, /router\.post\('\/auth\/runner-code\/issue', auth\.requireBuilder, auth\.requireRank\('metic', 'archon'\),/);
+  const issue = src.slice(src.indexOf("'/auth/runner-code/issue'"), src.indexOf("'/auth/runner-code/exchange'"));
+  assert.match(issue, /if \(!sessionCookieToken\(req\)\)/, 'a bearer (CLI or runner) cannot mint a login');
+  const rr = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js')).checkRouteRanks();
+  const ranks = Object.fromEntries(rr.routes.map((r) => [r.key, r.rank]));
+  assert.equal(ranks['POST /auth/runner-code/issue'], 'metic+archon');
+  assert.equal(ranks['POST /auth/runner-code/exchange'], 'public');
+  assert.equal(rr.ok, true);
+});
+
+// ── the claim and the publish ────────────────────────────────────────────────
+
+test('the claim route marks a runner login\'s claim autonomous from the session, never the body', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'claims.js'), 'utf8');
+  assert.match(src, /autonomous: !!\(req\.builder && req\.builder\.runner\),/);
+  assert.doesNotMatch(src, /autonomous: [^\n]*req\.body/);
+  assert.match(src, /if \(req\.builder && req\.builder\.runner\) \{\n\s*return res\.fail\('runner_batch_refused'/);
+  const db = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'db-claims.js'), 'utf8');
+  assert.match(db, /\$\{autonomous \? ', autonomous' : ''\}/);
+});
+
+const files = (...p) => p.map((x) => ({ path: x }));
+
+test('DONE WHEN: a runner claim under a person-looking worktree name is still refused a self-modifying publish', async () => {
+  const disguised = { worktree_name: 'fix-typo', requested_worktree_name: 'fix-typo', autonomous: true };
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, branch: 'fix-typo' }, {
+    readLatestClaim: async () => disguised,
+    getPullRequestFiles: async () => files('modules/autonomy/fence.js'),
+  });
+  assert.equal(r && r.code, 'self_modification');
+  assert.deepEqual(r.files, ['modules/autonomy/fence.js']);
+});
+
+test('a runner login publishing someone else\'s claim is checked too', async () => {
+  const person = { worktree_name: 'mine', requested_worktree_name: 'mine', autonomous: false };
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, publisherIsRunner: true }, {
+    readLatestClaim: async () => person,
+    getPullRequestFiles: async () => files('scripts/bongos/autobongos-run.js'),
+  });
+  assert.equal(r && r.code, 'self_modification');
+});
+
+test('a person\'s claim published by a person is still never checked', async () => {
+  let read = 0;
+  const r = await guard.runnerSelfEditRefusal({ taskId: 4242, prNumber: 77, publisherIsRunner: false }, {
+    readLatestClaim: async () => ({ worktree_name: 'mine', requested_worktree_name: null, autonomous: false }),
+    getPullRequestFiles: async () => { read++; return files('modules/autonomy/fence.js'); },
+  });
+  assert.equal(r, null);
+  assert.equal(read, 0);
+});
+
+test('the guard reads the autonomous mark from the claim row, and the route passes the publisher', async () => {
+  const seen = [];
+  await guard.readLatestClaim(4242, { query: async (sql) => { seen.push(sql); return { rows: [] }; } });
+  assert.match(seen[0], /c\.autonomous/);
+  const tasks = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'tasks.js'), 'utf8');
+  assert.match(tasks, /publisherIsRunner: !!\(req\.builder && req\.builder\.runner\)/);
+});
+
+test('the migration adds the source, the codes table and the claim mark, and stores no plaintext', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations', 'core_295_runner_logins.sql'), 'utf8');
+  assert.match(sql, /CHECK \(source IN \('cli', 'web', 'runner'\)\)/);
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS runner_enrollment_codes/);
+  assert.match(sql, /code_hash\s+text NOT NULL UNIQUE/);
+  assert.doesNotMatch(sql, /\bcode\s+text\b/, 'no plaintext code column');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS autonomous boolean NOT NULL DEFAULT false/);
+});

package/tests/autobongos_runner_login_db.mjs

@@ -0,0 +1,105 @@
+// tests/autobongos_runner_login_db.mjs — an Autobongos runner's one-time code against
+// a REAL Postgres (task 1004547, goal 1000139).
+//
+// tests/autobongos_runner_login.mjs proves the login DB-free, but its fake pool
+// re-implements the WHERE that burns a code, so it cannot catch that WHERE being
+// wrong. This file runs the real migration (core_295) and the real exchangeCode SQL:
+// a code works once even when two PCs race it, an expired code mints nothing, and
+// the session it mints carries source 'runner', which the widened CHECK admits.
+//
+// It SELF-SKIPS (exit 0) with no reachable Postgres, and refuses any database that
+// already has a `builders` table — it creates its own throwaway tables. Listed in
+// run-unit-tests.js's INTEGRATION set.
+//
+// Run:  createdb runner_login_scratch && DATABASE_URL=postgres:///runner_login_scratch node tests/autobongos_runner_login_db.mjs
+
+import pg from 'pg';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+
+const require = createRequire(import.meta.url);
+const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`autobongos_runner_login_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+const { rows: realRows } = await pool.query(`SELECT to_regclass('public.builders') IS NOT NULL AS has_builders`);
+if (realRows[0].has_builders) {
+  console.log('autobongos_runner_login_db.mjs SKIPPED — this database has a `builders` table, so it is not a scratch DB.');
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+// The minimum of the three core tables the migration alters, as 003_pms.sql made them.
+await pool.query(`
+  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
+  CREATE TABLE builders (id bigserial PRIMARY KEY, github_login text, status text NOT NULL DEFAULT 'active');
+  CREATE TABLE builder_sessions (
+    id bigserial PRIMARY KEY, builder_id bigint REFERENCES builders(id), token_hash text,
+    source text NOT NULL CHECK (source IN ('cli', 'web')), user_agent text, expires_at timestamptz);
+  CREATE TABLE claims (id bigserial PRIMARY KEY, task_id bigint);
+`);
+const HERE = path.dirname(url.fileURLToPath(import.meta.url));
+await pool.query(fs.readFileSync(path.join(HERE, '..', 'migrations', 'core_295_runner_logins.sql'), 'utf8'));
+// Re-running is a no-op (every step is IF NOT EXISTS / DROP IF EXISTS).
+await pool.query(fs.readFileSync(path.join(HERE, '..', 'migrations', 'core_295_runner_logins.sql'), 'utf8'));
+
+const runnerLogin = require('../src/bongos/runner-login.js');
+const { rows: [owner] } = await pool.query(`INSERT INTO builders (github_login) VALUES ('owner') RETURNING id`);
+const { rows: [gone] } = await pool.query(`INSERT INTO builders (github_login, status) VALUES ('gone', 'inactive') RETURNING id`);
+
+await t('a code trades for a runner session exactly once', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id, label: 'pc' }, pool);
+  const first = await runnerLogin.exchangeCode({ code }, pool);
+  assert.equal(String(first.builder_id), String(owner.id));
+  const { rows } = await pool.query('SELECT source, expires_at FROM builder_sessions WHERE id = $1', [first.session_id]);
+  assert.equal(rows[0].source, 'runner');
+  assert.equal(rows[0].expires_at, null, 'a runner login does not lapse; it is revoked');
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+});
+
+await t('two PCs racing one code: one wins, one session', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id }, pool);
+  const before = (await pool.query('SELECT count(*)::int AS n FROM builder_sessions')).rows[0].n;
+  const results = await Promise.all([runnerLogin.exchangeCode({ code }, pool), runnerLogin.exchangeCode({ code }, pool)]);
+  assert.equal(results.filter((r) => r.token).length, 1);
+  assert.equal(results.filter((r) => r.refused === 'code_invalid').length, 1);
+  const after = (await pool.query('SELECT count(*)::int AS n FROM builder_sessions')).rows[0].n;
+  assert.equal(after - before, 1);
+});
+
+await t('an expired code mints nothing', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: owner.id, now: Date.now() - 16 * 60 * 1000 }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'code_invalid' });
+  const { rows } = await pool.query('SELECT used_at FROM runner_enrollment_codes WHERE code_hash = $1', [require('../src/bongos/db-kernel.js').sessionTokenHash(code)]);
+  assert.equal(rows[0].used_at, null, 'an expired code is not even marked used');
+});
+
+await t('an offboarded builder\'s code mints nothing and stays unused', async () => {
+  const { code } = await runnerLogin.issueCode({ builderId: gone.id }, pool);
+  assert.deepEqual(await runnerLogin.exchangeCode({ code }, pool), { refused: 'builder_inactive' });
+  const { rows } = await pool.query(`SELECT count(*)::int AS n FROM builder_sessions WHERE builder_id = $1`, [gone.id]);
+  assert.equal(rows[0].n, 0);
+});
+
+await t('every claim reads not-autonomous by default; the mark is a real column', async () => {
+  const { rows } = await pool.query(`INSERT INTO claims (task_id) VALUES (1) RETURNING autonomous`);
+  assert.equal(rows[0].autonomous, false);
+});
+
+await pool.end();
+console.log(`\nautobongos_runner_login_db.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/design_tokens_generated.mjs

@@ -0,0 +1,56 @@
+// tests/design_tokens_generated.mjs — config/design-tokens.neutral.json is GENERATED
+// from the branding pack and the shared token sheet, and regenerates byte-identical
+// (task 1005082, goal 1000138).
+//
+// WHY. The hand-written file's spacing and motion had drifted from every page's
+// (4/8/16px against the 6/10/14px rhythm). The generator removes the hand; this
+// test is what notices a hand coming back, or a token-sheet edit nobody regenerated.
+//
+// Run:  node --test tests/design_tokens_generated.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gen = require(path.join(ROOT, 'modules', 'ui-design', 'scripts', 'gen-design-tokens.js'));
+
+test('the committed token file is exactly what the generator writes', () => {
+  const committed = fs.readFileSync(path.join(ROOT, 'config', 'design-tokens.neutral.json'), 'utf8');
+  assert.equal(committed, gen.build(),
+    'config/design-tokens.neutral.json is stale or hand-edited: run node modules/ui-design/scripts/gen-design-tokens.js');
+});
+
+test('every scale, radius and motion value is the shared sheet\'s --ds-* value', () => {
+  const vars = gen.readSheetVars(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'tokens.css'), 'utf8'));
+  const tokens = JSON.parse(gen.build());
+  for (const group of ['scale', 'radius', 'motion']) {
+    for (const [key, prop] of Object.entries(gen.MAP[group])) {
+      assert.equal(tokens[group][key], vars[prop], `${group}.${key} must be ${prop}`);
+    }
+  }
+  assert.equal(tokens.scale.xs, '6px', 'the rhythm starts at the 6px hair step');
+});
+
+test('a token-sheet change reaches the generated file (the generator reads the sheet, not a copy)', () => {
+  const sheet = ':root { --ds-space-hair: 7px; --ds-space-xs: 10px; --ds-space-sm: 14px; --ds-space-md: 22px;'
+    + ' --ds-space-lg: 34px; --ds-space-xl: 52px; --ds-radius-tile: 10px; --ds-radius-panel: 16px;'
+    + ' --ds-radius-pill: 999px; --ds-dur-fast: 150ms; --ds-dur-base: 200ms; --ds-dur-arrive: 700ms;'
+    + ' --ds-ease: cubic-bezier(.2, .7, .3, 1); }';
+  const pack = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'branding.neutral.json'), 'utf8'));
+  assert.equal(JSON.parse(gen.build({ sheet, pack })).scale.xs, '7px');
+});
+
+test('a --ds-* step the mapping needs but the sheet lost is an error, not a silent gap', () => {
+  const pack = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'branding.neutral.json'), 'utf8'));
+  assert.throws(() => gen.build({ sheet: ':root { --ds-space-hair: 6px; }', pack }), /is not declared/);
+});
+
+test('only the base :root block is read: the dark and reduced-motion restatements do not leak in', () => {
+  const vars = gen.readSheetVars(':root { --ds-dur-fast: 150ms; } @media (prefers-reduced-motion: reduce) { :root { --ds-dur-fast: 0ms; } }');
+  assert.equal(vars['--ds-dur-fast'], '150ms');
+});

package/tests/design_tokens_shared.mjs

@@ -0,0 +1,183 @@
+// tests/design_tokens_shared.mjs — the ONE shared token sheet every Cloud Bongos
+// surface loads (task 1005081, goal 1000138 "One Cloud Bongos design system").
+//
+// modules/ui-design/public/tokens.css holds the named scales — type sizes, spacing,
+// corners, shadows, motion, stacking layers — namespaced --ds-*, and the hall's own
+// scale names became aliases onto it. What this pins, DB-free and browser-free:
+//   * the sheet exists and defines every scale;
+//   * it never redefines the fifteen pack tokens (the pack must keep winning) and
+//     carries no colour literal except black/white with alpha (the Fifteen Rule);
+//   * its dark rule is written twice, byte-identical (the dark twins);
+//   * every surface loads it — the hall through style.css's @import (all 33 hall
+//     pages link style.css), the landing + hub pages, the status page and the three
+//     raise views through a <link> placed BEFORE their own sheet, so a surface's own
+//     values still win on source order;
+//   * the hall's old token names still resolve — each alias names a --ds-* token the
+//     sheet defines;
+//   * the one URL is served on every host, status. included (serve-internal.js's
+//     module-asset route used to step aside on a generic surface host).
+//
+// Run:  node --test tests/design_tokens_shared.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const URL_PATH = '/modules/ui-design/public/tokens.css';
+const SHEET = fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'public', 'tokens.css'), 'utf8');
+const decomment = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '');
+const CODE = decomment(SHEET);
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+const blockAfter = (src, marker) => {
+  const at = src.indexOf(marker);
+  assert.notEqual(at, -1, `missing ${marker}`);
+  const open = src.indexOf('{', at);
+  return src.slice(open + 1, src.indexOf('}', open));
+};
+const decls = (body) => Object.fromEntries([...body.matchAll(/(--[\w-]+)\s*:\s*([^;]+);/g)].map((m) => [m[1], m[2].trim()]));
+const ROOT_TOKENS = decls(blockAfter(CODE, ':root {'));
+
+test('the shared sheet defines every named scale', () => {
+  const scales = {
+    'type sizes': ['--ds-text-3xs', '--ds-text-2xs', '--ds-text-xs', '--ds-text-sm', '--ds-text-md', '--ds-text-lg', '--ds-text-xl', '--ds-text-2xl', '--ds-text-3xl', '--ds-text-4xl', '--ds-text-5xl', '--ds-text-title', '--ds-text-headline', '--ds-text-figure', '--ds-text-display'],
+    spacing: ['--ds-space-hair', '--ds-space-xs', '--ds-space-sm', '--ds-space-md', '--ds-space-lg', '--ds-space-xl'],
+    corners: ['--ds-radius-pill', '--ds-radius-panel', '--ds-radius-tile'],
+    shadows: ['--ds-shadow-pop'],
+    motion: ['--ds-dur-fast', '--ds-dur-base', '--ds-dur-slow', '--ds-ease', '--ds-ease-arrive'],
+    'stacking layers': ['--ds-z-progress', '--ds-z-topbar', '--ds-z-sidebar', '--ds-z-scrim', '--ds-z-drawer', '--ds-z-modal', '--ds-z-diagram-full'],
+  };
+  for (const [scale, names] of Object.entries(scales)) {
+    for (const n of names) assert.ok(ROOT_TOKENS[n], `${scale}: ${n} is defined on :root`);
+  }
+  // DESIGN.md's values, so loading the sheet moves nothing
+  assert.equal(ROOT_TOKENS['--ds-radius-pill'], '999px');
+  assert.equal(ROOT_TOKENS['--ds-radius-panel'], '16px');
+  assert.equal(ROOT_TOKENS['--ds-radius-tile'], '10px');
+  assert.deepEqual(['hair', 'xs', 'sm', 'md', 'lg', 'xl'].map((k) => ROOT_TOKENS[`--ds-space-${k}`]), ['6px', '10px', '14px', '22px', '34px', '52px']);
+  assert.equal(ROOT_TOKENS['--ds-ease'].replace(/\s+/g, ''), 'cubic-bezier(.2,.7,.3,1)', 'the one state easing');
+  assert.equal(ROOT_TOKENS['--ds-ease-arrive'].replace(/\s+/g, ''), 'cubic-bezier(.16,1,.3,1)', 'the entrance ease-out');
+  // the type sizes climb
+  const px = Object.entries(ROOT_TOKENS).filter(([k, v]) => k.startsWith('--ds-text-') && /^[\d.]+px$/.test(v)).map(([, v]) => parseFloat(v));
+  assert.deepEqual(px, [...px].sort((a, b) => a - b), 'the fixed type steps are declared small to large');
+});
+
+test('every name is --ds-* — no shared name can collide with a surface\'s own', () => {
+  // cosmos.css spends --line as a COLOUR and raise.css sets --radius to 10px: an
+  // un-namespaced shared token would silently change whichever surface lacked it
+  const names = [...CODE.matchAll(/(--[\w-]+)\s*:/g)].map((m) => m[1]);
+  assert.ok(names.length > 40);
+  assert.deepEqual(names.filter((n) => !n.startsWith('--ds-')), []);
+});
+
+test('it never redefines the fifteen pack tokens and holds no colour literal but black/white alpha', () => {
+  const pack = JSON.parse(read('config', 'branding.neutral.json')).theme.ui;
+  const fifteen = [...Object.keys(pack.colors).map((k) => '--' + k.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase())), '--font-display', '--font-body'];
+  assert.equal(fifteen.length, 15);
+  for (const t of fifteen) assert.doesNotMatch(CODE, new RegExp(`${t}\\s*:`), `${t} belongs to the pack`);
+  assert.doesNotMatch(CODE, /#[0-9a-f]{3,8}\b/i, 'no hex colour');
+  for (const m of CODE.matchAll(/rgba?\(([^)]*)\)/g)) {
+    const [r, g, b] = m[1].split(',').map((x) => parseFloat(x));
+    assert.ok((r === 0 && g === 0 && b === 0) || (r === 255 && g === 255 && b === 255), `only black/white with alpha: ${m[0]}`);
+  }
+  assert.doesNotMatch(CODE, /\b(hsla?|oklch|lab|lch)\(/, 'no other colour function');
+});
+
+test('the dark rule is written twice, byte-identical', () => {
+  const sw = blockAfter(CODE, 'html[data-theme="dark"], :root[data-mode="dark"] {');
+  const media = CODE.slice(CODE.indexOf('@media (prefers-color-scheme: dark)'));
+  const twin = blockAfter(media, 'html:not([data-theme]):not([data-mode="light"]) {');
+  assert.ok(sw.trim().length > 0);
+  assert.equal(sw.replace(/\s+/g, ' ').trim(), twin.replace(/\s+/g, ' ').trim());
+});
+
+test('the reduced-motion switch zeroes the motion scale', () => {
+  const rm = blockAfter(CODE.slice(CODE.indexOf('@media (prefers-reduced-motion: reduce)')), ':root {');
+  for (const n of Object.keys(ROOT_TOKENS).filter((k) => k.startsWith('--ds-dur-') || k === '--ds-stagger')) {
+    assert.match(rm, new RegExp(`${n}\\s*:\\s*0ms`), `${n} is zeroed under reduced motion`);
+  }
+});
+
+test('the hall loads it: style.css @imports it FIRST, and every hall page links style.css', () => {
+  const style = read('modules', 'hall-ui', 'public', 'style.css');
+  const imports = [...decomment(style).matchAll(/@import url\("([^"]+)"\)/g)].map((m) => m[1]);
+  assert.equal(imports[0], URL_PATH, 'the shared sheet is the first import, so the hall\'s own rules follow it');
+  const dir = path.join(ROOT, 'modules', 'hall-ui', 'public');
+  const pages = fs.readdirSync(dir).filter((f) => f.endsWith('.html'));
+  assert.ok(pages.length > 20);
+  for (const p of pages) assert.match(fs.readFileSync(path.join(dir, p), 'utf8'), /<link rel="stylesheet" href="\/builders\/style\.css/, `${p} links style.css`);
+});
+
+test('the landing, hub, status and raise pages link it before their own sheet', () => {
+  const tag = `<link rel="stylesheet" href="${URL_PATH}">`;
+  const pages = [
+    ...fs.readdirSync(path.join(ROOT, 'modules', 'public-landing', 'public')).filter((f) => f.endsWith('.html')).map((f) => ['modules', 'public-landing', 'public', f]),
+    ['modules', 'status-ui', 'public', 'index.html'],
+    ['modules', 'raise', 'views', 'page.html'], ['modules', 'raise', 'views', 'gate.html'], ['modules', 'raise', 'views', 'nda.html'],
+  ];
+  for (const p of pages) {
+    const html = read(...p);
+    const own = html.search(/<link rel="stylesheet" href="[^"]*(world|cosmos|style|raise)\.css/);
+    if (own === -1) continue; // a page with no surface sheet of its own (none today, but not this test's business)
+    const at = html.indexOf(tag);
+    assert.ok(at > -1, `${p.join('/')} links the shared sheet`);
+    assert.ok(at < own, `${p.join('/')} links it BEFORE its own sheet, so the surface's values still win`);
+  }
+});
+
+test('the hall\'s old token names still resolve — each alias names a defined --ds-* token', () => {
+  const style = decomment(read('modules', 'hall-ui', 'public', 'style.css'));
+  const want = ['--line', '--radius', '--radius-sm', '--radius-pill', '--sp-hair', '--sp-xs', '--sp-sm', '--sp-md', '--sp-lg', '--sp-xl',
+    '--shadow-pop', '--z-progress', '--z-topbar', '--z-sidebar', '--z-scrim', '--z-drawer', '--z-modal', '--z-diagram-full', '--label-size'];
+  for (const n of want) {
+    const m = style.match(new RegExp(`${n}\\s*:\\s*var\\((--ds-[\\w-]+)\\)`));
+    assert.ok(m, `${n} is an alias onto the shared sheet`);
+    assert.ok(ROOT_TOKENS[m[1]], `${n} → ${m[1]} is defined in tokens.css`);
+  }
+  // the four-step --space-* scale still rides the --sp-* aliases
+  for (const n of ['--space-1', '--space-2', '--space-3', '--space-4']) assert.match(style, new RegExp(`${n}\\s*:\\s*var\\(--sp-`));
+});
+
+// ── the one URL, on every host ────────────────────────────────────────────────
+// node:http, not fetch: fetch silently drops a Host override (tests/module_asset_subdomain.mjs).
+function get(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body, type: res.headers['content-type'] || '' }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the sheet is served at one path on the apex, the hall host and the status host', async () => {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    const port = server.address().port;
+    for (const host of ['example.com', 'builders.example.com', 'status.example.com']) {
+      const r = await get(port, URL_PATH, host);
+      assert.equal(r.status, 200, `${host} serves ${URL_PATH}`);
+      assert.match(r.type, /text\/css/, `${host} serves it as CSS`);
+      assert.match(r.body, /--ds-radius-panel:/, `${host} serves the shared sheet's bytes`);
+    }
+    // the status host still answers its OWN files first
+    const own = await get(port, '/style.css', 'status.example.com');
+    assert.equal(own.status, 200);
+    assert.doesNotMatch(own.body, /--ds-radius-panel:/);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+});

package/tests/government_session_scope.mjs

@@ -41,7 +41,8 @@ const scopes = require(path.join(GOV, 'session-scopes.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
 // Hand-written: the sources this instance accepts.
-const EXPECTED_SOURCES = ['cli', 'web', null];
+// 'runner' is an Autobongos PC's own login (task 1004547, src/bongos/runner-login.js).
+const EXPECTED_SOURCES = ['cli', 'web', 'runner', null];
 
 function fakeRes() {
   const res = {