@bongos/core 1.24.79 → 1.24.81

package/tests/github_repo_invite.mjs

@@ -0,0 +1,379 @@
+// tests/github_repo_invite.mjs — inviting a person to the project's GitHub repo from
+// inside Bongos: POST + GET /github/repo-invite, and the two github-repos helpers.
+//
+// The load-bearing assertions:
+//   • the repo is the PROJECT's own (repo-info), never read from the request, so a
+//     typed name cannot point the owner's token at another repository
+//   • the access offered is always READ ('pull'): 'push', 'admin' and anything else is
+//     refused with a 400 before GitHub is touched (owner decision: no write access)
+//   • the status read is strict too: a stray repo= is refused, never ignored
+//   • no repo connected -> 409 no_project_repo, and GitHub is never called
+//   • a bad GitHub name is a clean 400 before any token or GitHub touch
+//   • GitHub's own refusals come back as sentences: 403 -> not_repo_admin (409, never
+//     a 403, which the page reads as "sign in again"), 401 drops the stored token
+//   • the helper sends PUT /collaborators/{login} with the permission, and reads
+//     'pending' from the open invitations when the person is not yet a collaborator
+//
+// DB-free + network-free: the token, repo-info and the helpers are stubbed on their
+// cached module objects (the github_repo_visibility.mjs pattern).
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+process.env.BUILDER_SECRET_KEY = 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+const githubRepos = require(path.join(ROOT, 'src/bongos/github-repos.js'));
+const repoInfo = require(path.join(ROOT, 'src/bongos/repo-info.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const { GithubApiError } = githubRepos;
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {});
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle;
+}
+
+// The two repo-invite helpers reach the router through its deps seam (see routes/github.js).
+let routerDeps = {};
+
+function stub({ repo = { owner: 'jaxri', repo: 'mercury' }, invite, state } = {}) {
+  const orig = {
+    get: db.getGithubToken, del: db.deleteGithubToken,
+    info: repoInfo.loadRepoInfo,
+  };
+  const calls = { invite: [], state: [], del: 0 };
+  db.getGithubToken = async () => ({ token: 'tok', scope: 'repo read:user' });
+  db.deleteGithubToken = async () => { calls.del++; };
+  repoInfo.loadRepoInfo = () => repo;
+  routerDeps = {
+    inviteRepoCollaborator: async (_t, a) => { calls.invite.push(a); return invite(); },
+    repoInviteState: async (_t, a) => { calls.state.push(a); return state(); },
+  };
+  const restore = () => {
+    db.getGithubToken = orig.get; db.deleteGithubToken = orig.del;
+    routerDeps = {};
+    repoInfo.loadRepoInfo = orig.info;
+  };
+  return { calls, restore };
+}
+
+const post = () => finalHandler(buildGithubRouter(routerDeps), 'post', '/github/repo-invite');
+const get = () => finalHandler(buildGithubRouter(routerDeps), 'get', '/github/repo-invite');
+const reqOf = (body) => ({ builder: { id: 1 }, body });
+
+test('POST: invites to the PROJECT repo, read-only by default', async () => {
+  const s = stub({ invite: () => ({ state: 'invited', invitation_id: 9, permission: 'pull' }) });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: '@octocat' }), res);
+    assert.equal(res._status, 201);
+    assert.equal(res._body.repo, 'jaxri/mercury');
+    assert.deepEqual(s.calls.invite, [{ owner: 'jaxri', name: 'mercury', login: 'octocat', permission: 'pull' }]);
+  } finally { s.restore(); }
+});
+
+test('POST: a repo named in the request is refused — the project repo is the only target', async () => {
+  const s = stub({ invite: () => ({ state: 'invited', permission: 'pull' }) });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat', repo: 'someone-else/secret', owner: 'x', name: 'y' }), res);
+    assert.equal(res._status, 400, 'unknown fields are refused, so no field can aim the token elsewhere');
+    assert.equal(s.calls.invite.length, 0);
+  } finally { s.restore(); }
+});
+
+test('POST: write access can never be granted — push, admin and the rest are refused before GitHub', async () => {
+  const s = stub({ invite: () => ({ state: 'invited', permission: 'pull' }) });
+  try {
+    const ok = fakeRes();
+    await post()(reqOf({ github_login: 'octocat', permission: 'pull' }), ok);
+    assert.equal(s.calls.invite[0].permission, 'pull');
+    for (const bad of ['push', 'admin', 'maintain', 'triage', 'write', '']) {
+      const res = fakeRes();
+      await post()(reqOf({ github_login: 'octocat', permission: bad }), res);
+      assert.equal(res._status, 400, `permission ${JSON.stringify(bad)} must 400`);
+    }
+    assert.equal(s.calls.invite.length, 1, 'GitHub is only called for the one read-only request');
+  } finally { s.restore(); }
+});
+
+test('POST: already a collaborator answers 200, not a second invitation', async () => {
+  const s = stub({ invite: () => ({ state: 'already_collaborator', permission: 'pull' }) });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat' }), res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.state, 'already_collaborator');
+  } finally { s.restore(); }
+});
+
+test('POST: a malformed GitHub name is a clean 400 before any GitHub touch', async () => {
+  const s = stub({ invite: () => ({}) });
+  try {
+    for (const bad of ['', '-lead', 'a b', 'a/b', 'x'.repeat(40), 'javascript:alert(1)']) {
+      const res = fakeRes();
+      await post()(reqOf({ github_login: bad }), res);
+      assert.equal(res._status, 400, `login ${JSON.stringify(bad)} must 400`);
+    }
+    assert.equal(s.calls.invite.length, 0);
+  } finally { s.restore(); }
+});
+
+test('POST: a project with no repository is a 409 and GitHub is never called', async () => {
+  const s = stub({ repo: { error: 'no_repo_info' }, invite: () => ({}) });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat' }), res);
+    assert.equal(res._status, 409);
+    assert.equal(res._body.error.code, 'no_project_repo');
+    assert.equal(s.calls.invite.length, 0);
+  } finally { s.restore(); }
+});
+
+test('POST: GitHub 403 is a 409 not_repo_admin (never a 403); 401 drops the token and re-prompts', async () => {
+  const denied = stub({ invite: () => { throw new GithubApiError('x', { status: 403, code: 'not_repo_admin' }); } });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat' }), res);
+    assert.equal(res._status, 409);
+    assert.equal(res._body.error.code, 'not_repo_admin');
+  } finally { denied.restore(); }
+  const expired = stub({ invite: () => { throw new GithubApiError('x', { status: 401, code: 'github_unauthorized' }); } });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat' }), res);
+    assert.equal(res._status, 403);
+    assert.equal(res._body.error.code, 'repo_scope_required');
+    assert.equal(expired.calls.del, 1);
+  } finally { expired.restore(); }
+});
+
+test('GET: reports where one person stands on the project repo', async () => {
+  const s = stub({ state: () => ({ state: 'pending', invitation_id: 9 }) });
+  try {
+    const res = fakeRes();
+    await get()({ builder: { id: 1 }, query: { github_login: 'octocat' } }, res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.state, 'pending');
+    assert.deepEqual(s.calls.state, [{ owner: 'jaxri', name: 'mercury', login: 'octocat' }]);
+  } finally { s.restore(); }
+});
+
+// ---- the helpers, against a fake fetch ----
+
+function fakeFetch(map) {
+  const seen = [];
+  const f = async (url, opts = {}) => {
+    seen.push({ url, method: opts.method || 'GET', body: opts.body || null });
+    const hit = map.find((m) => url.includes(m.match) && (m.method || 'GET') === (opts.method || 'GET'));
+    const r = hit || { status: 500 };
+    return { status: r.status, ok: r.status >= 200 && r.status < 300, json: async () => r.body };
+  };
+  f.seen = seen;
+  return f;
+}
+
+test('inviteRepoCollaborator: PUTs the permission, 201 = invited, 204 = already in', async () => {
+  const f1 = fakeFetch([{ match: '/collaborators/octocat', method: 'PUT', status: 201, body: { id: 5 } }]);
+  const a = await githubRepos.inviteRepoCollaborator('t', { owner: 'o', name: 'n', login: 'octocat', fetchImpl: f1 });
+  assert.deepEqual(a, { state: 'invited', invitation_id: 5, permission: 'pull' });
+  assert.equal(f1.seen[0].method, 'PUT');
+  assert.deepEqual(JSON.parse(f1.seen[0].body), { permission: 'pull' });
+  const f2 = fakeFetch([{ match: '/collaborators/octocat', method: 'PUT', status: 204 }]);
+  const b = await githubRepos.inviteRepoCollaborator('t', { owner: 'o', name: 'n', login: 'octocat', permission: 'pull', fetchImpl: f2 });
+  assert.equal(b.state, 'already_collaborator');
+  for (const bad of ['push', 'admin', 'maintain', 'triage']) {
+    await assert.rejects(
+      githubRepos.inviteRepoCollaborator('t', { owner: 'o', name: 'n', login: 'octocat', permission: bad, fetchImpl: f2 }),
+      (e) => e.code === 'bad_permission',
+      `${bad} must be refused by the helper itself, before any request`,
+    );
+  }
+  assert.equal(f2.seen.length, 1, 'only the one read-only request reached GitHub');
+});
+
+test('repoInviteState: collaborator, pending (case-insensitive) or none', async () => {
+  const yes = fakeFetch([{ match: '/collaborators/octocat', status: 204 }]);
+  assert.equal((await githubRepos.repoInviteState('t', { owner: 'o', name: 'n', login: 'octocat', fetchImpl: yes })).state, 'collaborator');
+  const pending = fakeFetch([
+    { match: '/collaborators/octocat', status: 404 },
+    { match: '/invitations', status: 200, body: [{ id: 3, invitee: { login: 'OctoCat' }, permissions: 'read' }] },
+  ]);
+  const p = await githubRepos.repoInviteState('t', { owner: 'o', name: 'n', login: 'octocat', fetchImpl: pending });
+  assert.equal(p.state, 'pending');
+  assert.equal(p.invitation_id, 3);
+  const none = fakeFetch([
+    { match: '/collaborators/octocat', status: 404 },
+    { match: '/invitations', status: 200, body: [{ id: 4, invitee: { login: 'someone' } }] },
+  ]);
+  assert.equal((await githubRepos.repoInviteState('t', { owner: 'o', name: 'n', login: 'octocat', fetchImpl: none })).state, 'none');
+});
+
+// ---- the hall's invite box (modules/hall-ui/public/watch-repo-invite.js), run in a vm ----
+
+import fs from 'node:fs';
+import vm from 'node:vm';
+
+function loadBox(calls = []) {
+  const win = {};
+  const sandbox = { window: win, document: {}, encodeURIComponent, console };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/watch-repo-invite.js'), 'utf8'), sandbox);
+  const postJson = async (p, b) => { calls.push([p, b]); return { state: 'invited' }; };
+  return win.OTBWatchRepoInvite.make({ api: {}, API: '/api/bongos', postJson, $: () => null });
+}
+
+test('hall box: the invite is read-only and there is no access choice to make', () => {
+  const box = loadBox();
+  const html = box.formFieldsHtml();
+  assert.match(html, /id="gate-invite-repo" checked/, 'the repository invite is on by default');
+  assert.match(html, /read-only/, 'the label says what they get, in the one word every sentence uses');
+  assert.doesNotMatch(html, /<select|<option|push|admin|maintain|triage/i, 'no write or admin choice is drawn');
+  const form = { querySelector: (s) => (s === '#gate-invite-repo' ? { checked: true } : { value: 'push' }) };
+  assert.equal(JSON.stringify(box.readForm(form)), JSON.stringify({ want: true }), 'only the tick is read; there is no access level to pick');
+});
+
+test('hall box: the repository button shows for a GitHub name, never a stand-in name', () => {
+  const box = loadBox();
+  const ghost = (attrs, label) => `<b ${attrs}>${label}</b>`;
+  assert.match(box.rowButtonHtml({ github_login: 'octocat' }, ghost), /data-gate-gh/);
+  assert.equal(box.rowButtonHtml({ github_login: '~google-person' }, ghost), '');
+  assert.equal(box.rowButtonHtml({ github_login: '' }, ghost), '');
+});
+
+test('hall box: inviteToRepo posts to the repository route, and a refusal never throws', async () => {
+  const calls = [];
+  const box = loadBox(calls);
+  const ok = await box.inviteToRepo('octocat');
+  assert.equal(JSON.stringify(calls[0]), JSON.stringify(['/github/repo-invite', { github_login: 'octocat' }]));
+  assert.match(ok.text, /must accept it/);
+  const win = {};
+  const sandbox = { window: win, document: {}, encodeURIComponent, console };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/watch-repo-invite.js'), 'utf8'), sandbox);
+  const refused = win.OTBWatchRepoInvite.make({
+    api: {}, API: '/api/bongos', $: () => null,
+    postJson: async () => { const e = new Error('Reconnect GitHub'); e.code = 'repo_scope_required'; throw e; },
+  });
+  const r = await refused.inviteToRepo('octocat');
+  assert.equal(r.ok, false);
+  assert.equal(r.signin, true, 'a missing GitHub permission offers the reconnect link');
+  assert.match(r.text, /did not go through/);
+  assert.doesNotMatch(r.text, /hall invite/, 'the helper says nothing of a hall invite: a row has none');
+  // The FORM sends the hall invite first, so only its note says the admission stands.
+  const note = { textContent: '', appendChild() {} };
+  const winF = {};
+  const sbF = { window: winF, document: { createElement: () => ({}) }, encodeURIComponent, console };
+  vm.createContext(sbF);
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/watch-repo-invite.js'), 'utf8'), sbF);
+  winF.OTBWatchRepoInvite.make({ api: {}, API: '/api/bongos', $: () => note, postJson: async () => ({}) }).showRepoNote(r);
+  assert.match(note.textContent, /^The hall invite went through\. The GitHub repository invite did not go through/);
+});
+
+test('GET: a stray repo= (or any other parameter) is refused, never ignored', async () => {
+  const s = stub({ state: () => ({ state: 'none' }) });
+  try {
+    const res = fakeRes();
+    await get()({ builder: { id: 1 }, query: { github_login: 'octocat', repo: 'someone-else/secret' } }, res);
+    assert.equal(res._status, 400);
+    assert.equal(s.calls.state.length, 0, 'GitHub is never asked');
+    const noName = fakeRes();
+    await get()({ builder: { id: 1 }, query: {} }, noName);
+    assert.equal(noName._status, 400);
+  } finally { s.restore(); }
+});
+
+test('POST: the helper\'s own bad_permission is a 400, never a 502', async () => {
+  const s = stub({ invite: () => { throw new GithubApiError('x', { status: 400, code: 'bad_permission' }); } });
+  try {
+    const res = fakeRes();
+    await post()(reqOf({ github_login: 'octocat' }), res);
+    assert.equal(res._status, 400);
+    assert.equal(res._body.error.code, 'bad_permission');
+  } finally { s.restore(); }
+});
+
+// ---- the row button (gateGithubStep) and the message that follows it ----
+
+function fakeRow() {
+  const out = { textContent: '', children: [], appendChild(c) { this.children.push(c); } };
+  const row = { querySelector: (s) => (s === '[data-gh-state]' ? out : null) };
+  const attrs = { 'data-login': 'octocat', 'data-gh-mode': 'check' };
+  const btn = {
+    textContent: 'GitHub repository', disabled: true,
+    getAttribute: (k) => attrs[k], setAttribute: (k, v) => { attrs[k] = v; },
+    closest: () => row, attrs,
+  };
+  return { btn, out };
+}
+function loadStep({ get: getAnswer, post: postAnswer }) {
+  const win = { location: { assign() {} } };
+  const doc = { createElement: () => ({ set href(v) { this._h = v; }, get href() { return this._h; }, textContent: '' }) };
+  const sandbox = { window: win, document: doc, encodeURIComponent, console };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/watch-repo-invite.js'), 'utf8'), sandbox);
+  return win.OTBWatchRepoInvite.make({
+    api: { request: async () => getAnswer() }, API: '/api/bongos', $: () => null,
+    postJson: async () => postAnswer(),
+  }).gateGithubStep;
+}
+
+test('row button: check reads pending, then Send again invites read-only and says nothing of a hall invite', async () => {
+  const step = loadStep({
+    get: () => ({ status: 200, ok: true, data: { state: 'pending' } }),
+    post: () => { const e = new Error('GitHub could not be reached.'); e.code = 'github_error'; throw e; },
+  });
+  const { btn, out } = fakeRow();
+  await step(btn);
+  assert.match(out.textContent, /waiting for them to accept/);
+  assert.equal(btn.attrs['data-gh-mode'], 'send');
+  assert.equal(btn.disabled, false, 'the button is usable again');
+  await step(btn); // now the send, which fails
+  assert.match(out.textContent, /did not go through/);
+  assert.doesNotMatch(out.textContent, /hall invite went through/, 'a row never claims a hall invite just happened');
+  assert.equal(btn.attrs['data-gh-mode'], 'send', 'a failed send stays a send, so the retry is one click');
+});
+
+test('row button: not invited, collaborator, and a missing GitHub permission offers the reconnect link', async () => {
+  const none = fakeRow();
+  await loadStep({ get: () => ({ status: 200, ok: true, data: { state: 'none' } }), post: () => ({}) })(none.btn);
+  assert.match(none.out.textContent, /Not on the GitHub repository/);
+  assert.match(none.btn.textContent, /read-only repository invite/);
+  const yes = fakeRow();
+  await loadStep({ get: () => ({ status: 200, ok: true, data: { state: 'collaborator' } }), post: () => ({}) })(yes.btn);
+  assert.match(yes.out.textContent, /On the GitHub repository/);
+  const scope = fakeRow();
+  await loadStep({
+    get: () => ({ status: 403, ok: false, data: { error: { code: 'repo_scope_required', message: 'Grant repository access.' } } }),
+    post: () => ({}),
+  })(scope.btn);
+  assert.equal(scope.out.textContent, 'Grant repository access.');
+  assert.equal(scope.out.children.length, 1, 'the reconnect link is appended');
+  assert.match(scope.out.children[0].href, /auth\/web\/start\?return=.*repos=1/);
+});
+
+test('hall box: a row only gets its status span where it has the button', () => {
+  const box = loadBox();
+  assert.match(box.rowStateHtml({ status: 'invited', expired: false, github_login: 'octocat' }), /data-gh-state/);
+  for (const r of [
+    { status: 'pending', github_login: 'octocat' },
+    { status: 'dismissed', github_login: 'octocat' },
+    { status: 'invited', expired: true, github_login: 'octocat' },
+    { status: 'invited', github_login: '~google-person' },
+  ]) assert.equal(box.rowStateHtml(r), '', `no span for ${JSON.stringify(r)}`);
+});

package/tests/goal_criterion_confirm_ui.mjs

@@ -129,7 +129,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
       // the same reason categoryChip is: an undefined helper throws mid-render.
       roleAxisLabel: () => 'Role',
       roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
-      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'artisan', label: 'Artisan' }, { value: 'artist', label: 'Artist' }],
       roleIsUnset: (d) => !d || d === 'unclassified',
       ROLE_UNSET: 'unclassified',
       escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch])),

package/tests/goal_invite_consent.mjs

@@ -146,7 +146,7 @@ function harness({ pendingRequests = [] } = {}) {
       // the same reason categoryChip is: an undefined helper throws mid-render.
       roleAxisLabel: () => 'Role',
       roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
-      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+      roleOptions: () => [{ value: '', label: '— any —' }, { value: 'artisan', label: 'Artisan' }, { value: 'artist', label: 'Artist' }],
       roleIsUnset: (d) => !d || d === 'unclassified',
       ROLE_UNSET: 'unclassified',
       escapeHtml: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),

package/tests/goal_map_page.mjs

@@ -434,9 +434,9 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<main id="hall-main" class="sky-stage">/, 'the sky is drawn in the stage, the skip link\'s target');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
   // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
-  assert.deepEqual(scripts(html).filter((s) => !['dom-utils.js', 'shell-game.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  assert.deepEqual(scripts(html).filter((s) => !['dom-utils.js', 'shell-game.js', 'shell-trail.js', 'craft-mode.js', 'shell.js', 'visor.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // Both doors load the shell (tasks 1004327, 1004430); the SKY's files are the same.
-  const skyScripts = (h) => scripts(h).filter((s) => !['dom-utils.js', 'shell-game.js', 'shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
+  const skyScripts = (h) => scripts(h).filter((s) => !['dom-utils.js', 'shell-game.js', 'shell-trail.js', 'craft-mode.js', 'shell.js', 'visor.js'].includes(s[0]));
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');
   assert.equal(html.match(/thinking\.css\?v=([^"]+)/)[1], thinking.match(/thinking\.css\?v=([^"]+)/)[1]);
   assert.match(read('thinking.css'), /body\[data-page\] \.sky-stage \{/, 'the sheet dresses the one stage both doors draw in inside the hall');

package/tests/goal_sort_staleness.mjs

@@ -277,7 +277,7 @@ await test('the board pipeline survives the real corpus size (~1,400 rows), meas
     title: `Task number ${i} of the corpus`,
     version_id: 'BONGOS-V1',
     kind: ['feature', 'bug', 'infra'][i % 3],
-    discipline: ['engineer', 'artist', 'ideator'][i % 3],
+    discipline: ['artisan', 'artist', 'artist'][i % 3],
     created_by: i % 5 === 0 ? null : String(1000000 + (i % 7)),
     goal_id: String(1000000 + (i % 40)),
     updated_at: new Date(now - (i % 90) * DAY).toISOString(),

package/tests/goal_spec_task.mjs

@@ -98,7 +98,7 @@ test('createTask itself adds the edge — every create vector inherits it', asyn
     if (/INSERT INTO tasks/.test(sql)) return { rows: [{ id: '777', goal_id: params[22], source: params[11], source_ref: params[12] }] };
     return inner(sql, params);
   };
-  const row = await db.createTask({ versionId: 'V9', goalId: 42, title: 'Build the page', kind: 'feature', discipline: 'engineer', creditsReward: 5 }, { client: c });
+  const row = await db.createTask({ versionId: 'V9', goalId: 42, title: 'Build the page', kind: 'feature', discipline: 'artisan', creditsReward: 5 }, { client: c });
   assert.equal(row.id, '777');
   assert.deepEqual(c.edges, [[777, 500]]);
 });

package/tests/goal_spec_task_db.mjs

@@ -60,7 +60,7 @@ try {
   ok((await edges(specTask.id)).length === 0, 'the spec task does not wait on itself');
 
   // 1) A task filed into the goal waits on the spec task, and the claim gate says so.
-  const work = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the first page', kind: 'feature', discipline: 'engineer', creditsReward: 10 });
+  const work = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the first page', kind: 'feature', discipline: 'artisan', creditsReward: 10 });
   ok((await edges(work.id)).includes(Number(specTask.id)), 'a filed task carries an edge to the spec task');
   // unsatisfiedDeps is the read the claim gate refuses on (db-claims.js: a non-empty
   // answer throws DEPS_NOT_SHIPPED). The full claim path is not driven here — its own
@@ -74,12 +74,12 @@ try {
   ok((await statusOf(work.id)) === 'ready', `the waiting task auto-promotes to ready (got ${await statusOf(work.id)})`);
 
   // 3) A task filed after the spec shipped waits on nothing.
-  const later = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the second page', kind: 'feature', discipline: 'engineer' });
+  const later = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the second page', kind: 'feature', discipline: 'artisan' });
   ok((await edges(later.id)).length === 0, 'a shipped spec gates nothing new');
 
   // 4) A goal made WITHOUT a spec task behaves exactly as before.
   const plain = await db.createGoal({ versionId: VER, title: 'CLI goal', createdBy: WORKER });
-  const plainTask = await db.createTask({ versionId: VER, goalId: plain.id, title: 'Build the third page', kind: 'feature', discipline: 'engineer' });
+  const plainTask = await db.createTask({ versionId: VER, goalId: plain.id, title: 'Build the third page', kind: 'feature', discipline: 'artisan' });
   ok((await edges(plainTask.id)).length === 0, 'a goal with no spec task adds no edge');
 
   // 5) A task MOVED into a goal with an open spec task waits on it too.

package/tests/grade_engine.mjs

@@ -25,7 +25,7 @@ const engine = grader.gradeEngine;
 const api = require('../src/module-api');
 const llmCache = require('../src/bongos/llm-cache.js');
 
-const TASK = { id: 4242, title: 'Fixture task', description: 'Add helper X. Acceptance: X exported.', kind: 'feature', discipline: 'engineer', version_id: 'BONGOS-V2', est_minutes: 60 };
+const TASK = { id: 4242, title: 'Fixture task', description: 'Add helper X. Acceptance: X exported.', kind: 'feature', discipline: 'artisan', version_id: 'BONGOS-V2', est_minutes: 60 };
 const DIFF = 'diff --git a/modules/example/a.js b/modules/example/a.js\n--- a/modules/example/a.js\n+++ b/modules/example/a.js\n@@ -1 +1 @@\n-const a = 1;\n+const a = 2; // changed value here\n';
 const DS = { files_changed: 1, lines_added: 1, lines_removed: 1 };
 
@@ -79,7 +79,7 @@ test('the code panel is registered as work-type #1 and is the default', () => {
   // throwing inside the grade step (the task 1002659 posture).
   assert.equal(engine.resolveWorkType({}), code);
   assert.equal(engine.resolveWorkType({ workType: 'no-such-type' }), code);
-  assert.equal(engine.resolveWorkType({ task: { discipline: 'engineer', kind: 'feature' } }), code);
+  assert.equal(engine.resolveWorkType({ task: { discipline: 'artisan', kind: 'feature' } }), code);
 });
 
 test('registerWorkType refuses a malformed or conflicting work-type at registration', () => {

package/tests/grader_no_artifact.mjs

@@ -33,7 +33,7 @@ const TASK = {
   id: '1004011',
   title: 'Close the thing',
   kind: 'bug',
-  discipline: 'engineer',
+  discipline: 'artisan',
   version_id: 'BONGOS-V2',
   description: 'Acceptance: scripts/x.js must read the configured value, not a literal.',
 };

package/tests/grader_prompt_fencing.mjs

@@ -203,7 +203,7 @@ test('computeVerdict still passes a clean grade (fence change is presentation-on
 const noArtifact = require('../modules/grading/grader-no-artifact.js');
 
 const naArgs = () => ({
-  task: { id: '1', title: 'T', kind: 'bug', discipline: 'engineer', description: 'Acceptance: X.' },
+  task: { id: '1', title: 'T', kind: 'bug', discipline: 'artisan', description: 'Acceptance: X.' },
   valueSummary: 'nothing was needed',
   notes: 'the premise was already false',
 });

package/tests/grader_prompt_window_bound.mjs

@@ -53,7 +53,7 @@ const ONE_FILE = [{ file: 'a.js', content: `// ${BUNDLE_MARKER}\n${'x'.repeat(50
 async function run({ contextBundle, outcomes }) {
   const prompts = [];
   const r = await runWorker(quality, {
-    task: { id: 1003648, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' },
+    task: { id: 1003648, title: 't', description: 'd', kind: 'bug', discipline: 'artisan' },
     valueSummary: 'v', diff: DIFF_MARKER, changedFiles: ['a.js'], diffStats: {},
     model: 'claude-haiku-4-5-20251001', runOpts: {}, contextBundle,
     runSubagentFn: async ({ prompt }) => {

package/tests/grader_reader_lens.mjs

@@ -189,7 +189,7 @@ test('scope keys off the ONE existing predicate, not a second copy', () => {
   // Sanity: the predicate really does discriminate.
   assert.equal(hasCopyOrVisualWork({ discipline: 'artist' }), true);
   assert.equal(hasCopyOrVisualWork({ module_key: 'hall-ui' }), true);
-  assert.equal(hasCopyOrVisualWork({ module_key: 'grading', discipline: 'engineer' }), false);
+  assert.equal(hasCopyOrVisualWork({ module_key: 'grading', discipline: 'artisan' }), false);
 });
 
 // ---- 6. STANDARD -----------------------------------------------------------
@@ -291,7 +291,7 @@ test('the copy lens is scoped by the files the work changed', () => {
   // Task 1004201: the grader hands the predicate the files the work changed, so
   // an unlabelled UI ship gets the lens at grade time.
   assert.match(shipSrc, /hasCopyOrVisualWork\(task, changedFiles\)/, 'the grader passes its own diff');
-  const unlabelled = { module_key: null, discipline: 'engineer' };
+  const unlabelled = { module_key: null, discipline: 'artisan' };
   assert.equal(hasCopyOrVisualWork(unlabelled, ['modules/hall-ui/public/goal-forest-lib.js']), true);
   assert.equal(hasCopyOrVisualWork(unlabelled, ['modules/hall-ui/module.json', 'scripts/bongos/claim.js']), false);
 });

package/tests/grader_severity_gate.mjs

@@ -144,7 +144,7 @@ test('narc: ff=5 with only nits → concerns (not fail)', () => {
 // ---- prompt carries the policy -------------------------------------------
 
 test('every worker prompt carries the STYLE_ADVISORY paragraph', () => {
-  const args = { task: { id: 1, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' }, valueSummary: 'v', diff: '+ x', changedFiles: ['x.js'] };
+  const args = { task: { id: 1, title: 't', description: 'd', kind: 'bug', discipline: 'artisan' }, valueSummary: 'v', diff: '+ x', changedFiles: ['x.js'] };
   for (const w of [narc, quality, hacker, efficiency]) {
     const p = w.buildPrompt(args);
     assert.match(p, /Severity policy — style findings are ADVISORY/, `${w.KIND || 'worker'} prompt must carry the policy`);

package/tests/grader_unbacked_score.mjs

@@ -43,7 +43,7 @@ async function test(name, fn) {
 // hand-built row would have hidden it.
 async function row(worker, output) {
   return runWorker(worker, {
-    task: { id: 1002903, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' },
+    task: { id: 1002903, title: 't', description: 'd', kind: 'bug', discipline: 'artisan' },
     valueSummary: 'v', diff: '+ const x = 1;', changedFiles: ['a.js'], diffStats: {},
     model: 'claude-sonnet-5', runOpts: {},
     runSubagentFn: async () => ({ stdout: JSON.stringify(output), run_ms: 5, cost_usd: 0 }),

package/tests/hall_approval_queue.mjs

@@ -304,7 +304,7 @@ await test('a refusal is the server\'s words, and nothing is marked decided', as
 });
 
 await test('a builder who may not decide reads the queue with a sentence, not two dead buttons', async () => {
-  const b = bootPanel({ answers: { [APPROVALS]: queueFor({ crafts: ['engineer'], tasks: TASKS.map((t) => ({ ...t, artist_id: '99' })) }), [vis(41)]: slotsFor(41) } });
+  const b = bootPanel({ answers: { [APPROVALS]: queueFor({ crafts: ['artisan'], tasks: TASKS.map((t) => ({ ...t, artist_id: '99' })) }), [vis(41)]: slotsFor(41) } });
   await b.panel.open(); await settle(); await settle();
   assert.equal(b.q('[data-approve]'), null);
   assert.equal(b.q('[data-open-note]'), null);

package/tests/hall_board_world.mjs

@@ -399,8 +399,8 @@ test('RUN: the Standing card carries the three facts, the place as "2nd of 4", a
   assert.match(html, /<dt>Preferred work<\/dt><dd>Not set yet<\/dd>/, 'the mock\'s copy for an empty preference');
   assert.doesNotMatch(html, /profile__(needs|budget|rebase)/, 'the banners are not in the card');
   const withPrefs = bootHallRender({ me: ME, leaderboard: [] });
-  withPrefs.api.renderProfile({ ...ME.builder, preferred_disciplines: ['engineer', 'ui'] });
-  assert.match(withPrefs.el('home-standing-body').innerHTML, /<dd>engineer, ui<\/dd>/);
+  withPrefs.api.renderProfile({ ...ME.builder, preferred_disciplines: ['artisan', 'ui'] });
+  assert.match(withPrefs.el('home-standing-body').innerHTML, /<dd>artisan, ui<\/dd>/);
   assert.match(withPrefs.el('home-standing-body').innerHTML, /<dt>Leaderboard place<\/dt><dd>—<\/dd>/, 'no roll yet: a dash, not a wrong place');
 });
 

package/tests/hall_builders_page_pass.mjs

@@ -69,7 +69,7 @@ function hallRender(joinability) {
         // the same reason categoryChip is: an undefined helper throws mid-render.
         roleAxisLabel: () => 'Role',
         roleLabel: (d) => (!d ? '' : d === 'unclassified' ? 'No role yet' : d === 'ui' ? 'UI' : d.charAt(0).toUpperCase() + d.slice(1)),
-        roleOptions: () => [{ value: '', label: '— any —' }, { value: 'engineer', label: 'Engineer' }, { value: 'artist', label: 'Artist' }],
+        roleOptions: () => [{ value: '', label: '— any —' }, { value: 'artisan', label: 'Artisan' }, { value: 'artist', label: 'Artist' }],
         roleIsUnset: (d) => !d || d === 'unclassified',
         ROLE_UNSET: 'unclassified',
         escapeHtml,
@@ -152,7 +152,8 @@ test('A: the quiet fill is a defined variant, not an inline colour', () => {
   const m = css.match(/([^{}]*\.landing__btn--quiet[\s,][^{}]*)\{([^{}]*)\}/);
   assert.ok(m, 'controls.css defines .landing__btn--quiet');
   const block = m[2];
-  assert.match(block, /background:\s*transparent/, 'the quiet variant is the ghost');
+  // Helm (task 1005192, ADR 0402): the ghost takes the hall's press fill, and nothing without the hall's tier
+  assert.match(block, /background:\s*var\(--press-fill, transparent\)/, 'the quiet variant is the ghost');
   assert.deepEqual(block.match(/#[0-9a-f]{3,8}\b/gi) || [], [], 'the variant carries no literal colour');
   // Same geometry as the request button means it inherits .landing__btn's
   // min-height and padding rather than restating them.