@bongos/core 1.24.78 → 1.24.80

package/tests/blocker_tasks_named_db.mjs

@@ -43,8 +43,8 @@ try {
   await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'names','shipped','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
   // T2 first and with no name: the read must order by id and keep a null name.
   await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline,short_name)
-           VALUES ($1,$3,'Payout approvals','backlog',10,'feature','engineer','payout approvals'),
-                  ($2,$3,'#12','backlog',10,'feature','engineer',NULL)`, [T1, T2, VER]);
+           VALUES ($1,$3,'Payout approvals','backlog',10,'feature','artisan','payout approvals'),
+                  ($2,$3,'#12','backlog',10,'feature','artisan',NULL)`, [T1, T2, VER]);
   const holding = await blockers.createBlocker({ title: 'names fixture: holds two', bodyMd: '', source: 'test', sourceRef: `${REF}-a` });
   const empty = await blockers.createBlocker({ title: 'names fixture: holds none', bodyMd: '', source: 'test', sourceRef: `${REF}-b` });
   await blockers.linkBlockerToTask({ blockerId: holding.id, taskId: T2 }); // linked out of id order on purpose

package/tests/canonical_profile_url.mjs

@@ -280,7 +280,7 @@ const BUILDER = {
   total_credits: 12,
   karma: 3,
   created_at: '2026-01-01T00:00:00.000Z',
-  preferred_disciplines: ['engineer'],
+  preferred_disciplines: ['artisan'],
   // The private columns the whitelist exists to keep out. Sentinel values so a
   // raw-text scan of the serialized body bites even if a key were renamed.
   anthropic_email: 'SENTINEL-anthropic-email',

package/tests/cap_newcomer_tasks.mjs

@@ -23,31 +23,31 @@ function t(name, fn) {
 
 // A claimable feed row (only the fields capNewcomerTasks reads).
 const nc = (id, discipline) => ({ id, discipline, newcomer_friendly: true });
-const real = (id, discipline = 'engineer') => ({ id, discipline, newcomer_friendly: false });
+const real = (id, discipline = 'artisan') => ({ id, discipline, newcomer_friendly: false });
 const ids = (rows) => rows.map((r) => r.id);
 
-// ---- the reported case: 3 artist + 2 ideator newcomer seats ----
-t('caps an artist+ideator pool of 5 down to 3, both lanes represented', () => {
+// ---- the reported case: 3 artist + 2 artisan newcomer seats (was ideator before task 1005141 folded it into artist) ----
+t('caps an artist+artisan pool of 5 down to 3, both lanes represented', () => {
   const feed = [
     nc(1259, 'artist'), nc(1260, 'artist'), nc(1261, 'artist'),
-    nc(1176, 'ideator'), nc(1177, 'ideator'),
+    nc(1176, 'artisan'), nc(1177, 'artisan'),
   ];
   const out = capNewcomerTasks(feed);
   assert.equal(out.length, 3, 'exactly 3 newcomer rows kept');
-  // Round-robin SELECTS artist[0]=1259, ideator[0]=1176, artist[1]=1260; the
+  // Round-robin SELECTS artist[0]=1259, artisan[0]=1176, artist[1]=1260; the
   // output preserves INPUT order (we filter the ordered array), so 1260 (which
   // came before 1176 in the feed) lands ahead of it.
   assert.deepEqual(ids(out), [1259, 1260, 1176]);
   // Both disciplines are represented before a duplicate fills the third slot.
   const disciplines = new Set(out.map((r) => r.discipline));
-  assert.ok(disciplines.has('artist') && disciplines.has('ideator'));
+  assert.ok(disciplines.has('artist') && disciplines.has('artisan'));
 });
 
 // ---- non-newcomer (real) rows are never dropped ----
 t('real version tasks pass through untouched and unbounded', () => {
   const feed = [
     real(900), real(901), real(902), real(903),
-    nc(1259, 'artist'), nc(1260, 'artist'), nc(1261, 'artist'), nc(1176, 'ideator'),
+    nc(1259, 'artist'), nc(1260, 'artist'), nc(1261, 'artist'), nc(1176, 'artisan'),
   ];
   const out = capNewcomerTasks(feed);
   const reals = out.filter((r) => r.newcomer_friendly !== true);
@@ -59,19 +59,19 @@ t('real version tasks pass through untouched and unbounded', () => {
 // ---- ordering is preserved (we filter the input array, not re-sort) ----
 t('preserves original feed ordering across mixed rows', () => {
   const feed = [
-    real(900), nc(1259, 'artist'), real(901), nc(1176, 'ideator'),
-    nc(1260, 'artist'), nc(1261, 'artist'), nc(1177, 'ideator'),
+    real(900), nc(1259, 'artist'), real(901), nc(1176, 'artisan'),
+    nc(1260, 'artist'), nc(1261, 'artist'), nc(1177, 'artisan'),
   ];
   const out = capNewcomerTasks(feed);
-  // Kept newcomer ids (round-robin over [artist, ideator] groups by appearance):
-  //   artist[0]=1259, ideator[0]=1176, artist[1]=1260.
+  // Kept newcomer ids (round-robin over [artist, artisan] groups by appearance):
+  //   artist[0]=1259, artisan[0]=1176, artist[1]=1260.
   // Output keeps input order, dropping only un-kept newcomer rows (1261, 1177).
   assert.deepEqual(ids(out), [900, 1259, 901, 1176, 1260]);
 });
 
 // ---- no-op when at or under the cap ----
 t('returns the list unchanged when newcomer rows <= cap', () => {
-  const feed = [nc(1, 'artist'), nc(2, 'ideator'), real(3)];
+  const feed = [nc(1, 'artist'), nc(2, 'artisan'), real(3)];
   const out = capNewcomerTasks(feed);
   assert.equal(out.length, 3);
   assert.deepEqual(ids(out), [1, 2, 3]);
@@ -106,7 +106,7 @@ t('tolerates non-array input', () => {
 
 // ---- custom cap argument ----
 t('honors a custom cap', () => {
-  const feed = [nc(1, 'artist'), nc(2, 'ideator'), nc(3, 'artist'), nc(4, 'ideator')];
+  const feed = [nc(1, 'artist'), nc(2, 'artisan'), nc(3, 'artist'), nc(4, 'artisan')];
   assert.equal(capNewcomerTasks(feed, 2).length, 2);
   assert.deepEqual(ids(capNewcomerTasks(feed, 2)), [1, 2]);
 });

package/tests/character_creation.mjs

@@ -0,0 +1,294 @@
+// tests/character_creation.mjs — character creation and the three sprites (task 1005147,
+// BONGOS-V3 G2, criterion you-are-a-character-in-first-person).
+//
+// A builder picks one of three characters when they join, and the pick lives on their
+// ACCOUNT (core_297, PUT /me/character). These cases run the REAL craft-mode.js in a
+// small DOM stub and drive it the way the shell does once /me answers: no character
+// opens character creation; a pick is saved and worn; a held character is the only one
+// offered and the top bar wears its sprite; changing it is signing out. The server half
+// (migration, route, db write) is pinned beside them.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const CRAFT = fs.readFileSync(path.join(HALL, 'craft-mode.js'), 'utf8');
+const require = createRequire(import.meta.url);
+
+function el(tag) {
+  const attrs = {}, listeners = {};
+  const e = {
+    tagName: tag, id: '', className: '', dataset: {}, children: [], parentNode: null, _html: '', textContent: '',
+    classList: { _s: new Set(), add(c) { this._s.add(c); }, remove(c) { this._s.delete(c); }, toggle(c, on) { if (on) this._s.add(c); else this._s.delete(c); }, contains(c) { return this._s.has(c); } },
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    addEventListener(t, fn) { (listeners[t] ||= []).push(fn); },
+    fire(t, ev) { for (const fn of listeners[t] || []) fn(ev); },
+    appendChild(c) { c.parentNode = e; e.children.push(c); return c; },
+    removeChild(c) { e.children = e.children.filter((x) => x !== c); c.parentNode = null; },
+    contains() { return false; },
+    focus() {},
+    querySelector(sel) { return e._q(sel); },
+    querySelectorAll() { return []; },
+    set innerHTML(v) { e._html = String(v); e._err = null; }, get innerHTML() { return e._html; },
+    _q(sel) {
+      if (sel === '[data-char-error]' && /data-char-error/.test(e._html)) return (e._err ||= el('P'));
+      return null;
+    },
+  };
+  return e;
+}
+
+function boot({ store = {}, session = {}, put = () => ({ ok: true, status: 200, data: null }) } = {}) {
+  const root = el('HTML');
+  const body = el('BODY');
+  const requests = [];
+  const keyListeners = [];
+  const docObj = {
+    body, documentElement: root, activeElement: null, readyState: 'complete',
+    getElementById(id) {
+      if (id === 'craft-picker') return body.children.find((c) => c.id === 'craft-picker') || null;
+      return null;
+    },
+    querySelector: () => null, querySelectorAll: () => [],
+    createElement: (t) => el(t.toUpperCase()),
+    addEventListener(t, fn) { if (t === 'keydown') keyListeners.push(fn); },
+    removeEventListener(t, fn) { const i = keyListeners.indexOf(fn); if (i >= 0) keyListeners.splice(i, 1); },
+    dispatchEvent() { return true; },
+  };
+  const mk = (obj) => ({
+    getItem: (k) => (k in obj ? obj[k] : null),
+    setItem: (k, v) => { obj[k] = String(v); },
+    removeItem: (k) => { delete obj[k]; },
+  });
+  const win = {
+    OTB: realOTB(),
+    localStorage: mk(store), sessionStorage: mk(session),
+    location: { search: '', assign() {} },
+    matchMedia: () => ({ matches: false }),
+    BongosClient: {
+      createClient: () => ({
+        request(method, url, opts) {
+          requests.push({ method, url, body: opts && opts.body });
+          return Promise.resolve(put(method, url, opts));
+        },
+      }),
+    },
+  };
+  const sandbox = {
+    window: win, document: docObj, console, Promise,
+    CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  const picker = () => body.children.find((c) => c.id === 'craft-picker') || null;
+  const signedIn = { authed: true };
+  return { win, root, body, store, session, requests, keyListeners, picker, signedIn, C: win.OTBCraftMode };
+}
+const builder = { id: 7, github_login: 'ada', main_discipline: null };
+const flush = () => new Promise((r) => setImmediate(r));
+
+test('no character yet: character creation opens, three characters, nothing to dismiss', () => {
+  const t = boot();
+  assert.equal(t.C.characterGate(t.signedIn, { builder, character: null }), true, 'the gate holds the welcome and the picker back');
+  const p = t.picker();
+  assert.ok(p, 'the creation screen is up');
+  assert.match(p.innerHTML, /Choose your character/);
+  const doors = [...p.innerHTML.matchAll(/data-char-pick="([a-z]+)"/g)].map((m) => m[1]);
+  assert.deepEqual(doors, ['artisan', 'artist', 'patron'], 'Artisan, Artist, Patron — three, in that order');
+  for (const id of doors) assert.ok(p.innerHTML.includes(`/builders/characters/${id}.png`), `${id} stands on its sprite`);
+  assert.ok(!/data-craft-close/.test(p.innerHTML), 'no close button: the pick is the way through');
+  // Escape does not dismiss it.
+  let prevented = false;
+  for (const fn of t.keyListeners.slice()) fn({ key: 'Escape', preventDefault() { prevented = true; } });
+  assert.ok(prevented && t.picker(), 'Escape is swallowed and the screen stays');
+});
+
+test('an artist-led builder starts on the Artist door', () => {
+  const t = boot();
+  t.C.characterGate(t.signedIn, { builder: { ...builder, main_discipline: 'artist' }, character: null });
+  assert.match(t.picker().innerHTML, /craft-door--pre[^"]*" type="button" data-char-pick="artist"/);
+});
+
+test('picking saves the character to the account and the hall wears it', async () => {
+  const t = boot({ put: (m, u, o) => ({ ok: true, status: 200, data: { character: o.body.character } }) });
+  t.C.characterGate(t.signedIn, { builder, character: null });
+  const target = { closest: (sel) => (sel === 'button[data-char-pick]' ? { getAttribute: () => 'artist' } : null) };
+  t.picker().fire('click', { target });
+  await flush();
+  assert.deepEqual(JSON.parse(JSON.stringify(t.requests[0])), { method: 'PUT', url: '/api/bongos/me/character', body: { character: 'artist' } });
+  assert.equal(t.picker(), null, 'the screen closes');
+  assert.equal(t.root.dataset.craft, 'artist', 'the hall wears the character');
+  assert.equal(t.store['hall-character'], 'artist', 'remembered for the next first paint');
+  assert.equal(t.C.character(), 'artist');
+});
+
+test('a failed save keeps the screen up and says so', async () => {
+  const t = boot({ put: () => ({ ok: false, status: 500, data: null }) });
+  t.C.characterGate(t.signedIn, { builder, character: null });
+  const target = { closest: () => ({ getAttribute: () => 'artisan' }) };
+  t.picker().fire('click', { target });
+  await flush(); await flush();
+  assert.ok(t.picker(), 'still choosing');
+  const err = t.picker().querySelector('[data-char-error]');
+  assert.match(err.textContent, /could not be saved/);
+  assert.equal(err.hasAttribute('hidden'), false);
+});
+
+test('a held character is the only one offered, and the top bar wears its sprite', () => {
+  const t = boot();
+  assert.equal(t.C.characterGate(t.signedIn, { builder, character: 'artisan' }), false, 'nothing to create: the welcome may show');
+  assert.equal(t.picker(), null);
+  assert.equal(t.root.dataset.craft, 'artisan');
+  assert.equal(t.C.offered('artisan'), true);
+  assert.equal(t.C.offered('artist'), false, 'another character cannot be worn without signing out');
+  assert.equal(t.C.offered('patron'), false);
+  const sw = t.C.switchHtml();
+  assert.match(sw, /craft-switch--character/);
+  assert.match(sw, /data-craft-me/);
+  assert.match(sw, /\/builders\/characters\/artisan\.png/);
+  assert.ok(!/data-craft-opt=/.test(sw), 'the three-way switch is gone');
+  // A session's stored mode from before the character cannot override it.
+  t.session['hall-craft'] = 'patron';
+  assert.equal(t.C.current(), 'artisan');
+});
+
+test('the sprite is drawn on first paint from the last held character, before /me answers', () => {
+  const t = boot({ store: { 'hall-character': 'patron' } });
+  assert.match(t.C.switchHtml(), /\/builders\/characters\/patron\.png/);
+});
+
+test('an older core that says nothing about characters changes nothing', () => {
+  const t = boot();
+  assert.equal(t.C.characterGate(t.signedIn, { builder }), false);
+  assert.equal(t.picker(), null);
+  assert.equal(t.C.character(), undefined);
+  assert.equal(t.C.offered('artist'), true, 'the three crafts stay offered as before');
+});
+
+test('a visitor who is not signed in is never asked', () => {
+  const t = boot();
+  assert.equal(t.C.characterGate({ authed: false }, { character: null }), false);
+  assert.equal(t.picker(), null);
+});
+
+test('the character section never writes `hidden` onto the nav: a character only marks [data-craft-off]', () => {
+  const start = CRAFT.indexOf('// ---------- character creation (task 1005147');
+  const end = CRAFT.indexOf('// ---------- the shell\'s three calls');
+  const section = CRAFT.slice(start, end);
+  assert.ok(start > 0 && end > start);
+  assert.ok(!/nav-item|app-sidebar/.test(section), 'the character code does not touch the nav itself; applyNav does');
+});
+
+test('the owner\'s three sprites are on disk, one per character', () => {
+  for (const id of ['artisan', 'artist', 'patron']) {
+    const f = path.join(HALL, 'characters', id + '.png');
+    assert.ok(fs.existsSync(f), `${id}.png`);
+    const head = fs.readFileSync(f).subarray(0, 8);
+    assert.deepEqual([...head], [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], `${id}.png is a PNG`);
+  }
+});
+
+// ---------- the server half ----------
+test('core_297 adds the account column, and the CHECK names exactly the three characters', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations/core_297_builder_character.sql'), 'utf8');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS game_character text;/);
+  assert.match(sql, /game_character IN \('artisan', 'artist', 'patron'\)/);
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('core_297_builder_character'\)/);
+});
+
+test('PUT /me/character is a self-service write behind requireBuilder, and /me reports the character fail-open', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/me.js'), 'utf8');
+  assert.match(src, /router\.put\('\/me\/character', auth\.requireBuilder,/);
+  assert.match(src, /db\.setBuilderCharacter\(req\.builder\.id, raw\)/, 'only ever the caller\'s own row');
+  assert.match(src, /character: await characterP,/);
+  assert.match(src, /try \{ return await db\.getBuilderCharacter\(req\.builder\.id\); \} catch \(_\) \{ return null; \}/);
+});
+
+// The real route over HTTP: the real me.js router and error envelope, with only the
+// sign-in (auth.requireBuilder) and the two db calls stood in for.
+test('PUT /me/character over HTTP: sets, clears, and refuses with stable error codes', async () => {
+  const express = require('express');
+  const authPath = require.resolve('../src/bongos/auth.js');
+  const dbPath = require.resolve('../src/bongos/db.js');
+  const mePath = require.resolve('../src/bongos/routes/me.js');
+  const auth = require(authPath);
+  const db = require(dbPath);
+  const saved = { requireBuilder: auth.requireBuilder, setBuilderCharacter: db.setBuilderCharacter };
+  const writes = [];
+  auth.requireBuilder = (req, res, next) => {
+    if (req.get('x-test-signed-out')) return res.status(401).json({ error: { code: 'unauthorized' } });
+    req.builder = { id: 41, rank: 'xenos' };
+    next();
+  };
+  db.setBuilderCharacter = async (id, c) => {
+    writes.push([id, c]);
+    if (c !== null && !['artisan', 'artist', 'patron'].includes(c)) { const e = new Error('x'); e.code = 'invalid_character'; throw e; }
+    return c;
+  };
+  delete require.cache[mePath];
+  const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(require(mePath)());
+  const server = app.listen(0);
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const put = (body, headers = {}) => fetch(base + '/me/character', {
+    method: 'PUT', headers: { 'content-type': 'application/json', ...headers }, body: JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  try {
+    let r = await put({ character: 'artist' });
+    assert.equal(r.status, 200);
+    assert.equal(r.body.character, 'artist');
+    r = await put({ character: null });
+    assert.equal(r.status, 200, 'null is the deliberate clear (change character)');
+    assert.equal(r.body.character, null);
+    r = await put({});
+    assert.equal(r.status, 400);
+    assert.equal(r.body.error.code, 'character_required', 'a stable slug, not prose');
+    r = await put({ character: 'emperor' });
+    assert.equal(r.status, 422);
+    assert.equal(r.body.error.code, 'invalid_character');
+    r = await put({ character: 7 });
+    assert.equal(r.status, 400, 'a non-string is refused by the body schema');
+    r = await put({ character: 'artist', rank: 'archon' });
+    assert.equal(r.status, 400, 'strict: an unknown field (an attempt to write anything else) is refused');
+    r = await put({ character: 'artist' }, { 'x-test-signed-out': '1' });
+    assert.equal(r.status, 401, 'signed out never reaches the write');
+    assert.deepEqual(writes.map((w) => w[0]), [41, 41, 41], 'every write that ran was the caller\'s own row');
+  } finally {
+    server.close();
+    auth.requireBuilder = saved.requireBuilder;
+    db.setBuilderCharacter = saved.setBuilderCharacter;
+    delete require.cache[mePath];
+  }
+});
+
+test('setBuilderCharacter writes a character, clears with null, normalizes an old spelling, refuses anything else', async () => {
+  const poolPath = require.resolve('../src/bongos/pool.js');
+  const dbPath = require.resolve('../src/bongos/db.js');
+  const seen = [];
+  const real = require.cache[poolPath];
+  require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { query: async (sql, params) => { seen.push(params); return { rows: [{ game_character: params[1] }] }; } } } };
+  delete require.cache[dbPath];
+  try {
+    const db = require(dbPath);
+    assert.equal(await db.setBuilderCharacter(7, 'artist'), 'artist');
+    assert.equal(await db.setBuilderCharacter(7, null), null);
+    assert.equal(await db.setBuilderCharacter(7, 'ruler'), 'patron', 'the sprite\'s old name lands as Patron');
+    await assert.rejects(db.setBuilderCharacter(7, 'governor-general'), { code: 'invalid_character' });
+    await assert.rejects(db.setBuilderCharacter(7, 'ui'), { code: 'invalid_character' }, 'a discipline is not a character');
+    assert.deepEqual(seen.map((p) => p[0]), [7, 7, 7], 'every write is the one builder\'s own row');
+  } finally {
+    if (real) require.cache[poolPath] = real; else delete require.cache[poolPath];
+    delete require.cache[dbPath];
+  }
+});

package/tests/claim_gate_open_blocker.mjs

@@ -53,8 +53,8 @@ try {
   // Archon so no rank/newcomer gate interferes; the gate under test is OPEN_BLOCKER.
   await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'ob-w','ob-worker','OB Worker','archon')`, [WORKER]);
   // TRAP: ready (feed-hidden) with an open blocker linked. CONTROL: ready, clean.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'trap','ready',10,'feature','engineer')`, [TRAP, VER]);
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'control','ready',10,'feature','engineer')`, [CONTROL, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'trap','ready',10,'feature','artisan')`, [TRAP, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'control','ready',10,'feature','artisan')`, [CONTROL, VER]);
   await q(`INSERT INTO blockers (id,title,status) VALUES ($1,'Owner must flip the switch','open')`, [BLOCKER]);
   // blocker_ref is NOT NULL and part of the key; linkBlockerToTask writes 'blocker:<id>'.
   await q(`INSERT INTO task_blockers (task_id,blocker_id,blocker_ref) VALUES ($1,$2,$3)`, [TRAP, BLOCKER, `blocker:${BLOCKER}`]);

package/tests/claim_gate_rebase.mjs

@@ -60,11 +60,11 @@ try {
   // Archon so no rank/newcomer gate interferes; the gate under test is REBASE_REQUIRED.
   await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'cg-w','cg-worker','CG Worker','archon')`, [WORKER]);
   // STALLED: a confirmed task owned by WORKER, flagged needs_rebase.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'stalled','confirmed',10,'feature',$3,'engineer')`, [STALLED, VER, WORKER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'stalled','confirmed',10,'feature',$3,'artisan')`, [STALLED, VER, WORKER]);
   await q(`INSERT INTO claims (task_id,builder_id,claimed_at) VALUES ($1,$2, now())`, [STALLED, WORKER]);
   await db.flagTaskNeedsRebase(String(STALLED), 'strand:no_branch_no_tip');
   // FRESH: a ready, claimable task the worker will try to pick up.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh','ready',10,'feature','engineer')`, [FRESH, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh','ready',10,'feature','artisan')`, [FRESH, VER]);
 
   // 1) With STALLED flagged, claiming FRESH is refused with REBASE_REQUIRED.
   let threw = null;
@@ -116,13 +116,13 @@ try {
   await q(`UPDATE claims SET released_at = now() WHERE task_id = $1 AND released_at IS NULL`, [FRESH]);
 
   const seedStrand = async (id, reason, ageHours) => {
-    await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'aged','confirmed',10,'feature',$3,'engineer')`, [id, VER, WORKER]);
+    await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'aged','confirmed',10,'feature',$3,'artisan')`, [id, VER, WORKER]);
     await q(`INSERT INTO claims (task_id,builder_id,claimed_at) VALUES ($1,$2, now())`, [id, WORKER]);
     await db.flagTaskNeedsRebase(String(id), reason);
     await q(`UPDATE tasks SET needs_rebase_at = now() - ($2::bigint * interval '1 hour') WHERE id = $1`, [id, ageHours]);
   };
 
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh2','ready',10,'feature','engineer')`, [FRESH2, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh2','ready',10,'feature','artisan')`, [FRESH2, VER]);
 
   // 4) An unprovable strand AGED past the grace no longer refuses a claim.
   await seedStrand(AGED, 'strand:no_branch_no_tip', 48);
@@ -154,7 +154,7 @@ try {
   // 7) task 1004370 — the one task the gate lets through: a P1 kind=infra fix,
   //    the shape a CI-unblock is filed in. With AGED_OTHER still gating, claiming
   //    it succeeds; FRESH2 (a P1 feature) was refused in 6), so both halves count.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,priority,discipline) VALUES ($1,$2,'ci fix','ready',10,'infra',1,'engineer')`, [CIFIX, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,priority,discipline) VALUES ($1,$2,'ci fix','ready',10,'infra',1,'artisan')`, [CIFIX, VER]);
   const ciClaim = await db.claimTask({ taskId: String(CIFIX), builderId: String(WORKER), worktreeName: 'cg-cifix' });
   ok(ciClaim && Number(ciClaim.task_id) === CIFIX,
     'a P1 infra task is claimable while a rebase is owed — the CI-unblock fix is never gated out');
@@ -171,7 +171,7 @@ try {
   await q(`UPDATE tasks SET status='shipped', needs_rebase=false WHERE id=$1`, [AGED_OTHER]);
   await q(`UPDATE claims SET released_at = now() WHERE task_id = ANY($1::bigint[]) AND released_at IS NULL`, [[CIFIX]]);
   await seedStrand(GUARDED, 'strand:branch_modifies_executed_code:.gitattributes', 1);
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh3','ready',10,'feature','engineer')`, [FRESH3, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh3','ready',10,'feature','artisan')`, [FRESH3, VER]);
   const claim3 = await db.claimTask({ taskId: String(FRESH3), builderId: String(WORKER), worktreeName: 'cg-fresh3' });
   ok(claim3 && Number(claim3.task_id) === FRESH3, 'a confirmed task parked on a server-side guard does not refuse a new claim');
   ok((await db.needsRebaseTasksForBuilder(String(WORKER))).some((t) => Number(t.id) === GUARDED),

package/tests/claude_materialize.mjs

@@ -764,7 +764,7 @@ t('the materialise-at-claim trigger is DATA: the ui mode opts in, every other di
   const modes = JSON.parse(readFileSync(join(ROOT, 'scripts', 'bongos', 'discipline-modes.json'), 'utf8')).modes;
   assert.equal(modes.ui.materializeModuleSkills, true, 'a ui claim brings the skills /design names');
   assert.equal(modes.ui.skill, 'design', 'and still routes to /design');
-  for (const d of ['engineer', 'ideator', 'artist']) {
+  for (const d of ['artisan', 'artist']) {
     assert.ok(!modes[d].materializeModuleSkills, `${d} did not opt in, so its claim output is unchanged`);
   }
 });
@@ -951,6 +951,69 @@ t("the core's OWN deny list covers every file the CLI reads a session from, and
   }
 });
 
+// ---- task 1005186: the runner's own login file is denied like the builder's ----
+// Task 1005095 moved an Autobongos runner's session, heartbeat and run log under a folder of its
+// own, so every deny rule above (all under ~/.config) stopped short of it and a worker on a
+// runner device could read the runner's login.
+const hostProgram = require('../scripts/bongos/autobongos-host.js');
+const RUNNER_RULE = 'Read(~/.cloudbongos-runner/config/**)';
+
+t('the runner deny rule names the folder the device program actually uses, however the runner was installed', () => {
+  // Asked of the device program with a stand-in home, so a renamed folder fails HERE rather
+  // than leaving a rule that guards a place nothing writes to.
+  const home = join(tmpdir(), 'runner-deny-home');
+  const ruleFor = (env) => `Read(~/${relative(home, hostProgram.hostPaths(env, home).configRoot).split(sep).join('/')}/**)`;
+  assert.equal(ruleFor({}), RUNNER_RULE, 'the default install');
+  // AUTOBONGOS_HOME moves the runner's copy, logs and lock. It must NOT move the login:
+  // a login an environment variable can relocate is one the rule does not cover.
+  for (const custom of [join(home, 'elsewhere'), join(tmpdir(), 'not-even-under-home'), join(home, '.cloudbongos-runner')]) {
+    const env = { AUTOBONGOS_HOME: custom };
+    assert.equal(ruleFor(env), RUNNER_RULE, `AUTOBONGOS_HOME=${custom}`);
+    assert.equal(hostProgram.hostPaths(env, home).root, custom, 'while the rest of the runner does move');
+  }
+});
+
+t('the runner deny rule covers the files a runner keeps there: its session, the store, its heartbeat', () => {
+  // The same cli-lib and supervisor a runner runs, under the runner's config root.
+  const home = join(tmpdir(), 'runner-deny-home');
+  const root = hostProgram.hostPaths({}, home).configRoot;
+  const probe = `
+    const cli = require(${JSON.stringify(join(ROOT, 'scripts', 'bongos', 'cli-lib.js'))});
+    const run = require(${JSON.stringify(join(ROOT, 'scripts', 'bongos', 'autobongos-run.js'))});
+    process.stdout.write(JSON.stringify([...cli.SESSION_READ_PATHS, cli.sessionStoreDir(), run.heartbeatPath(), run.logPath()]));`;
+  const r = require('node:child_process').spawnSync(process.execPath, ['-e', probe], { encoding: 'utf8', env: { ...process.env, BONGOS_CONFIG_ROOT: root, AUTOBONGOS_HEARTBEAT_FILE: '', AUTOBONGOS_LOG_FILE: '' } });
+  assert.equal(r.status, 0, r.stderr);
+  const files = JSON.parse(r.stdout);
+  assert.ok(files.length >= 5);
+  const guarded = `${root}${sep}`;   // what Read(<root>/**) matches
+  for (const f of files) assert.ok(f.startsWith(guarded), `${f} sits outside the denied folder`);
+});
+
+t("the core's own deny list and the starter both carry the runner rule", () => {
+  const core = JSON.parse(readFileSync(join(ROOT, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+  assert.ok(core.includes(RUNNER_RULE), 'the core checkout is itself where a runner works');
+  assert.ok(starterDenyFor({}).includes(RUNNER_RULE));
+  assert.ok(starterDenyFor({ configDir: 'acme', envPrefix: 'ACME' }).includes(RUNNER_RULE), 'at the same fixed place whatever the instance is called');
+});
+
+t('a checkout-materialized instance keeps the runner rule at its fixed place through the rebrand', () => {
+  // An instance whose own name is the word in the folder's name: the rebrand must not
+  // carry the rule off to a folder no runner uses.
+  for (const branding of [{ configDir: 'acme', envPrefix: 'ACME' }, { configDir: 'cloudbongos' }, { configDir: 'otb', envPrefix: 'OTB' }]) {
+    const core = mkdtempSync(join(tmpdir(), 'w3-runner-core-'));
+    const inst = mkdtempSync(join(tmpdir(), 'w3-runner-inst-'));
+    mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
+    writeFileSync(join(core, '.claude', 'settings.json'), JSON.stringify({ permissions: { deny: [RUNNER_RULE] } }));
+    mkdirSync(join(inst, 'config'), { recursive: true });
+    writeFileSync(join(inst, 'config', 'branding.json'), JSON.stringify(branding));
+    m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+    const deny = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.deny;
+    assert.deepEqual(deny, [RUNNER_RULE], JSON.stringify(branding));
+    rmSync(core, { recursive: true, force: true });
+    rmSync(inst, { recursive: true, force: true });
+  }
+});
+
 t('a checkout-materialized instance keeps the session-store rule at its fixed anchor', () => {
   // The rebrand rewrites every `.config/<core dir>` literal, and the store's dir is one of them —
   // but the store does not move with the brand, so a rebranded rule guards a dir nothing reads.
@@ -1011,6 +1074,17 @@ t('an instance still on the allow-only starter GAINS the deny rules on its next
   f.cleanup();
 });
 
+t('an instance that already has a deny list gains the runner rule at its next upgrade (task 1005186)', () => {
+  // Every rule it had before this task, and not the new one.
+  const had = topUpDenyFor({ configDir: 'acme' }).filter((r) => r !== RUNNER_RULE);
+  const f = topUpFixture({ permissions: { allow: m.STARTER_ALLOW, deny: had } });
+  const res = m.materializeClaude({ coreRoot: f.core, instanceDir: f.inst, dryRun: false });
+  const after = JSON.parse(f.read());
+  assert.deepEqual(res.settingsDenyAdded, [RUNNER_RULE], 'the one rule it was missing, and it is named');
+  assert.deepEqual(after.permissions.deny, [...had, RUNNER_RULE], 'appended; nothing it had is moved or dropped');
+  f.cleanup();
+});
+
 t("an owner-edited settings.json keeps every rule of its own and only gains what's missing", () => {
   const f = topUpFixture({
     permissions: { allow: ['Bash(npm test:*)'], deny: ['Read(secrets/**)', 'Read(**/*.pem)'], ask: ['Bash(rm:*)'] },

package/tests/clawback_confirmed_backlog.mjs

@@ -60,9 +60,9 @@ try {
   // Two still-confirmed tasks (unlanded) + one legitimately shipped task.
   // discipline is required since core_247 (the column default 'unclassified' fails its CHECK).
   await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES
-           ($1,$4,'confirmed A','confirmed',20,'feature',$2,'engineer'),
-           ($5,$4,'confirmed B','confirmed',15,'feature',$3,'engineer'),
-           ($6,$4,'shipped legit','shipped',30,'feature',$2,'engineer')`, [T_A, A, B, VER, T_B, T_S]);
+           ($1,$4,'confirmed A','confirmed',20,'feature',$2,'artisan'),
+           ($5,$4,'confirmed B','confirmed',15,'feature',$3,'artisan'),
+           ($6,$4,'shipped legit','shipped',30,'feature',$2,'artisan')`, [T_A, A, B, VER, T_B, T_S]);
   // Seed the credits the OLD confirm-time rule would have paid (credit_log INSERT
   // fires the total_credits trigger, exactly like a real award).
   await q(`INSERT INTO credit_log (builder_id,task_id,delta,reason,description) VALUES

package/tests/collab_page.mjs

@@ -481,8 +481,8 @@ test('roleWord and roleLabel disagree exactly where they should', () => {
   // Executed, not grepped: the acronym exception has to survive both ways, or
   // "You asked uis" ships the next time a ui task files a help request.
   const { roleLabel, roleWord } = domUtils();
-  assert.equal(roleLabel('engineer'), 'Engineer');
-  assert.equal(roleWord('engineer'), 'engineer');
+  assert.equal(roleLabel('artisan'), 'Artisan');
+  assert.equal(roleWord('artisan'), 'artisan');
   assert.equal(roleLabel('ui'), 'UI');
   assert.equal(roleWord('ui'), 'UI', 'an acronym is not a common noun in any sentence');
   assert.equal(roleLabel('unclassified'), 'No role yet');
@@ -524,13 +524,13 @@ test('the mingle sub-line reads as English for every pair, and never shows the c
   const word = (d) => (OTB.roleIsUnset(d) ? '' : OTB.roleWord(d));
   const line = (a, b) => L.pairSentence(word(a), word(b));
 
-  assert.equal(line('engineer', 'artist'), 'An engineer — you are an artist. Mingle pairs across roles.');
-  assert.equal(line('artist', 'ideator'), 'An artist — you are an ideator. Mingle pairs across roles.');
+  assert.equal(line('artisan', 'artist'), 'An artisan — you are an artist. Mingle pairs across roles.');
+  assert.equal(line('artist', 'artisan'), 'An artist — you are an artisan. Mingle pairs across roles.');
 
   // 'ui' is the acronym exception roleWord() already makes, and it is why the article
   // cannot be a plain vowel test — "an UI" is how that shortcut fails.
-  assert.equal(line('ui', 'engineer'), 'A UI — you are an engineer. Mingle pairs across roles.');
-  assert.equal(line('engineer', 'ui'), 'An engineer — you are a UI. Mingle pairs across roles.');
+  assert.equal(line('ui', 'artisan'), 'A UI — you are an artisan. Mingle pairs across roles.');
+  assert.equal(line('artisan', 'ui'), 'An artisan — you are a UI. Mingle pairs across roles.');
 });
 
 test('a pair with an unset role drops the comparison rather than naming the default', () => {
@@ -541,7 +541,7 @@ test('a pair with an unset role drops the comparison rather than naming the defa
   // The defect this replaced rendered the database's own word — "A unclassified — you are
   // a engineer" — which is the example V2 names. Nothing a person did not choose may reach
   // the sentence, whichever side is missing.
-  for (const pair of [[OTB.ROLE_UNSET, 'engineer'], ['engineer', OTB.ROLE_UNSET], [null, 'artist'], ['', '']]) {
+  for (const pair of [[OTB.ROLE_UNSET, 'artisan'], ['artisan', OTB.ROLE_UNSET], [null, 'artist'], ['', '']]) {
     const out = L.pairSentence(word(pair[0]), word(pair[1]));
     assert.equal(out, 'Mingle pairs across roles.', `pair ${JSON.stringify(pair)}`);
     assert.doesNotMatch(out, /unclassified/);
@@ -550,9 +550,8 @@ test('a pair with an unset role drops the comparison rather than naming the defa
 
 test('aOrAn is the article rule, stated once', () => {
   const L = lib();
-  assert.equal(L.aOrAn('engineer'), 'an');
+  assert.equal(L.aOrAn('artisan'), 'an');
   assert.equal(L.aOrAn('artist'), 'an');
-  assert.equal(L.aOrAn('ideator'), 'an');
   assert.equal(L.aOrAn('UI'), 'a', 'the acronym is spoken "you-eye", so it takes "a"');
   assert.equal(L.aOrAn('ui'), 'a');
 });

package/tests/collab_self_settling.mjs

@@ -257,8 +257,8 @@ test('a craft the caller does not hold is dropped before it binds', async () =>
   // The C01 hole, one surface over: a craft value that did not come from the
   // caller's own profile must never widen a scope.
   const r = recorder();
-  await help.listArchivedForBuilder({ builderId: 7, crafts: ['wizard', 'ideator'] }, { pool: r.pool });
-  assert.deepEqual(r.calls[0].params[1], ['ideator']);
+  await help.listArchivedForBuilder({ builderId: 7, crafts: ['wizard', 'artist'] }, { pool: r.pool });
+  assert.deepEqual(r.calls[0].params[1], ['artist']);
 });
 
 test('the archive ROUTE reads crafts from the profile and takes nothing from the query', () => {