@consiliency/agent-board-schema 1.28.0 → 1.38.0

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.28.0",
+  "packageVersion": "1.38.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 127,
-  "aggregateSha256": "c550b9a50fadba563b30975d911079bdd96f59ac64a752553df9fcfb5df0e6d4",
+  "migrationCount": 137,
+  "aggregateSha256": "bfe0b978234464938428a66199b75d2f8d028706517b4674f9ae11cae34c52d1",
   "migrations": [
     {
       "order": 0,
@@ -1191,6 +1191,96 @@
       "sourceRef": "message-board",
       "bytes": 67493,
       "sha256": "7522e32c61f8845e511255d94d273d98eb7b72b2f906976c3a2494629927462d"
+    },
+    {
+      "order": 127,
+      "id": "20260910000100_agent_board_ceiling_lock_comment_truth",
+      "filename": "20260910000100_agent_board_ceiling_lock_comment_truth.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7087,
+      "sha256": "b8ddc658be347d9e7207111968d0b8de7a88759cb3cf181f61c4ef306086f384"
+    },
+    {
+      "order": 128,
+      "id": "20260911000100_agent_board_ledger_revoked_board_creation",
+      "filename": "20260911000100_agent_board_ledger_revoked_board_creation.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 22749,
+      "sha256": "4291af2bd6c93b7d9f8ec596f41dc62edf941ea10a51529df04e223d1cbc50c5"
+    },
+    {
+      "order": 129,
+      "id": "20260912000100_agent_board_receipt_subject_gate",
+      "filename": "20260912000100_agent_board_receipt_subject_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 19033,
+      "sha256": "1083f7720ccab9c9b422415f2a8eb743de5d84b0ab8d8689059bd355514e9aa9"
+    },
+    {
+      "order": 130,
+      "id": "20260913000100_agent_board_task_thread_lock_order",
+      "filename": "20260913000100_agent_board_task_thread_lock_order.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 17738,
+      "sha256": "259a05c4a6603518ab449e799fcb235b0e16a6650954cb2db19b436c0a7a1e83"
+    },
+    {
+      "order": 131,
+      "id": "20260914000100_agent_board_claim_subject_gate",
+      "filename": "20260914000100_agent_board_claim_subject_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 34342,
+      "sha256": "88207b2e3f28ec8022ad4ca921721ebba877668042c66b5ac74c85e4c8cefc21"
+    },
+    {
+      "order": 132,
+      "id": "20260915000100_agent_board_fedsession_stored_identity_gate",
+      "filename": "20260915000100_agent_board_fedsession_stored_identity_gate.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 18615,
+      "sha256": "5a8f4abb822e30c2a695a310bb1742f2565bb2afd0b6a06cad43fcbdd106ad5e"
+    },
+    {
+      "order": 133,
+      "id": "20260916000100_agent_board_federated_identity_injective_slug",
+      "filename": "20260916000100_agent_board_federated_identity_injective_slug.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 84162,
+      "sha256": "d9f05e18094954f2e4ee32bf7b129f0a9ffc39bc800a5efa9cf7938e1555c8dc"
+    },
+    {
+      "order": 134,
+      "id": "20260917000100_agent_board_invite_no_downgrade",
+      "filename": "20260917000100_agent_board_invite_no_downgrade.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 24929,
+      "sha256": "c205a9a679dca059979972b49c89c3b1b3b8f8e2039bd7675a10578f49f9b35a"
+    },
+    {
+      "order": 135,
+      "id": "20260918000100_agent_board_signed_write_enforced_repoint",
+      "filename": "20260918000100_agent_board_signed_write_enforced_repoint.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 9965,
+      "sha256": "f76dd01744029bfd0088bd4f6cf6fa5cb93e3c9b7fa5559ad83857cf7f4eb8ce"
+    },
+    {
+      "order": 136,
+      "id": "20260919000100_agent_board_signed_write_model_key",
+      "filename": "20260919000100_agent_board_signed_write_model_key.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7204,
+      "sha256": "464ae39acbd96330c5ad1c753fa1204ca290baa0d6f82d7d30d0ead4d2944d37"
     }
   ],
   "excludedBridge": {

package/src/deployment-drift-script.test.mjs

@@ -0,0 +1,424 @@
+// Tests for the SHIPPED deployment-drift SCRIPT — scripts/check-deployment-drift.mjs.
+//
+// WHY THIS FILE EXISTS. deployment-drift.test.mjs covers `evaluate()`, the decision. It
+// does not load the script at all, and an audit measured the consequence: flipping the
+// final line's exit mapping from `UNKNOWN -> 2` to `UNKNOWN -> 0` left the whole suite
+// green, and deleting `makeScrub` entirely left it green. The exit mapping is the property
+// the PR exists for and the scrubber is its security property; both were pinned by nothing.
+//
+// So these tests run the real script as a SUBPROCESS and assert its exit code and its
+// output. Nothing here reimplements it.
+//
+// HERMETIC BY CONSTRUCTION. The script shells out to `npm view` and `git`, and fetches
+// over the network. All three are controlled, and none of them reaches outside this box:
+//   - `npm` and `git` are shell shims on a prepended PATH. They also append their argv to
+//     a log, which is how the `-L` range below is asserted.
+//   - `globalThis.fetch` is replaced by a preloaded module (`--import`), so no request is
+//     ever issued. No real project ref is ever named.
+// The tests therefore do not depend on network reachability, on npm auth, or on the
+// clone depth of the checkout running them.
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, chmodSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(HERE, "..", "..", ".."); // packages/agent-board-schema/src -> repo root
+const SCRIPT = join(ROOT, "scripts", "check-deployment-drift.mjs");
+const PKG_JSON = join(ROOT, "packages", "agent-board-schema", "package.json");
+const MANIFEST = join(ROOT, "packages", "agent-board-schema", "schema-manifest.json");
+
+const MERGED = JSON.parse(readFileSync(PKG_JSON, "utf8")).version;
+const MANIFEST_JSON = JSON.parse(readFileSync(MANIFEST, "utf8"));
+
+// A version several minors BELOW merged, derived so this does not rot when merged bumps.
+function minorsBelow(v, n) {
+  const [maj, min, pat] = v.split(".").map(Number);
+  return `${maj}.${Math.max(0, min - n)}.${pat}`;
+}
+function minorsAbove(v, n) {
+  const [maj, min, pat] = v.split(".").map(Number);
+  return `${maj}.${min + n}.${pat}`;
+}
+const FRESH_BUMP = new Date(Date.now() - 3_600_000).toISOString();
+// Postgres renders timestamptz with a space and a two-digit offset; the script's own
+// parser exists for that shape, so the fixture uses it rather than an ISO string.
+const pgStamp = (msAgo) => new Date(Date.now() - msAgo).toISOString().replace("T", " ").replace(/Z$/, "+00");
+// A record that agrees with the repo on every field the check compares.
+const consistentRow = (over = {}) => ({
+  package_version: MERGED,
+  schema_version: MANIFEST_JSON.schemaVersion,
+  bundle_digest: MANIFEST_JSON.aggregateSha256,
+  installed_at: pgStamp(1_800_000), // 30 minutes ago — after FRESH_BUMP
+  ...over,
+});
+
+// A canary that is NOT a credential: it never authenticated anything and is not a real
+// token shape. The 20-character prefix is the thing an audit saw printed verbatim.
+const CANARY = "canary_token_shape_A_not_a_real_secret_value";
+const CANARY_PREFIX = CANARY.slice(0, 20); // "canary_token_shape_A"
+
+let SHIMS;
+let ARGV_LOG;
+let PRELOAD;
+
+beforeAll(() => {
+  SHIMS = mkdtempSync(join(tmpdir(), "drift-shims-"));
+  ARGV_LOG = join(SHIMS, "argv.log");
+
+  // One arg per line, `--` between invocations, so an assertion can read exact argv rather
+  // than a space-joined approximation.
+  const logArgv = 'printf -- "--\\n" >> "$DRIFT_ARGV_LOG"; for a in "$@"; do printf "%s\\n" "$a" >> "$DRIFT_ARGV_LOG"; done';
+
+  writeFileSync(
+    join(SHIMS, "npm"),
+    `#!/bin/sh\n${logArgv}\n[ -n "\${FAKE_NPM_VERSION:-}" ] || exit 1\nprintf "%s\\n" "$FAKE_NPM_VERSION"\n`,
+  );
+  writeFileSync(
+    join(SHIMS, "git"),
+    `#!/bin/sh\n${logArgv}\ncase " $* " in\n  *" rev-parse "*) printf "%s\\n" "\${FAKE_SHALLOW:-false}" ;;\n  *" log "*) [ -n "\${FAKE_BUMP_ISO:-}" ] || exit 1; printf "%s\\n" "$FAKE_BUMP_ISO" ;;\n  *) exit 1 ;;\nesac\n`,
+  );
+  chmodSync(join(SHIMS, "npm"), 0o755);
+  chmodSync(join(SHIMS, "git"), 0o755);
+
+  // No request leaves this machine.
+  //
+  // The throwing modes carry their probe EARLY in the string, so a passing redaction
+  // assertion cannot be truncation in disguise. The RESOLVING modes exist because a review
+  // found every mode here threw: `readRunning`'s success mapping and its no-record branch
+  // were unreachable from any test, so the only board outcomes ever exercised were the
+  // error ones. A stub that can only fail cannot pin what happens when the call works.
+  PRELOAD = join(SHIMS, "no-network.mjs");
+  writeFileSync(
+    PRELOAD,
+    [
+      'const mode = process.env.FAKE_FETCH_MODE || "";',
+      "const respond = (status, body) => ({",
+      "  ok: status >= 200 && status < 300,",
+      "  status,",
+      "  json: async () => body,",
+      "});",
+      "globalThis.fetch = async () => {",
+      '  if (mode === "board-row") return respond(200, [JSON.parse(process.env.FAKE_BOARD_ROW)]);',
+      '  if (mode === "board-no-record") return respond(200, []);',
+      '  if (mode === "board-http-error") return respond(401, { message: "unauthorized" });',
+      '  if (mode === "echo-token-prefix") {',
+      "    throw new Error(`connect ${String(process.env.SUPABASE_ACCESS_TOKEN).slice(0, 20)} ECONNREFUSED upstream`);",
+      "  }",
+      '  if (mode === "foreign-github") throw new Error("upstream gho_OTHERPARTYCRED_9999 rejected while proxying");',
+      '  if (mode === "foreign-unknown-shape") throw new Error("upstream zt9f3k1QweRtyUiOpAsDf rejected while proxying");',
+      '  if (mode === "foreign-vendor-only") throw new Error("upstream xoxb-SLACKBOTTOKENEXAMPLE rejected while proxying");',
+      '  if (mode === "foreign-aws-secret") throw new Error("upstream wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY rejected");',
+      // The seat's measured over-redaction: a URL inside the RESPONSE text is eaten by the
+      // generic layer, because a path has the same shape as a base64 secret. Note the ref
+      // embedded here differs from the one passed on the command line, so an assertion
+      // about the endpoint cannot be satisfied by this string surviving.
+      '  if (mode === "http-500-with-url") {',
+      '    throw new Error("HTTP 500 from https://api.supabase.com/v1/projects/some-other-ref-in-the-message/database/query");',
+      "  }",
+      '  throw new Error("network disabled in test");',
+      "};",
+      "",
+    ].join("\n"),
+  );
+});
+
+afterAll(() => {
+  if (SHIMS) rmSync(SHIMS, { recursive: true, force: true });
+});
+
+function runScript(args = [], env = {}) {
+  const r = spawnSync(process.execPath, [SCRIPT, ...args], {
+    cwd: ROOT,
+    encoding: "utf8",
+    timeout: 60_000,
+    env: {
+      ...process.env,
+      PATH: `${SHIMS}:${process.env.PATH}`,
+      NODE_OPTIONS: `--import ${pathToFileURL(PRELOAD).href}`,
+      DRIFT_ARGV_LOG: ARGV_LOG,
+      FAKE_BUMP_ISO: FRESH_BUMP,
+      FAKE_SHALLOW: "false",
+      FAKE_FETCH_MODE: "",
+      SUPABASE_ACCESS_TOKEN: CANARY,
+      ...env,
+    },
+  });
+  return { ...r, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+// ---------------------------------------------------------------------------
+// The exit mapping. This is the whole point of the change, and it was pinned by nothing:
+// `UNKNOWN -> 0` left all 38 evaluate() tests green.
+// ---------------------------------------------------------------------------
+describe("the shipped script's exit mapping", () => {
+  it("exits 0 when merged and published agree — OK is reachable", () => {
+    const r = runScript([], { FAKE_NPM_VERSION: MERGED });
+    expect(r.status).toBe(0);
+    expect(r.out).toMatch(/no drift/);
+  });
+
+  it("exits 1 on real drift — DRIFT is not folded into success", () => {
+    const r = runScript([], { FAKE_NPM_VERSION: minorsBelow(MERGED, 10) });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/DRIFT/);
+  });
+
+  it("exits 2 when a leg cannot be determined — UNKNOWN is NOT a pass", () => {
+    // npm shim exits non-zero: the published version is undeterminable.
+    const r = runScript([], { FAKE_NPM_VERSION: "" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/UNKNOWN/);
+  });
+
+  it("exits 2, not 0, when the board leg cannot be read", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "network disabled",
+    });
+    expect(r.status).toBe(2);
+  });
+
+  it("rejects a non-numeric threshold with exit 2 rather than passing everything", () => {
+    const r = runScript(["--max-days", "not-a-number"], { FAKE_NPM_VERSION: MERGED });
+    expect(r.status).toBe(2);
+  });
+
+  it("refuses to date the bump on a shallow clone, so an unpublished gap is UNKNOWN", () => {
+    // FAKE_SHALLOW was never true in any test, so the shallow-clone refusal the previous
+    // round added was driven by nothing. Making isShallowClone() return false
+    // unconditionally reds this: the shimmed bump date would come back fresh and a
+    // one-version gap would report OK / exit 0.
+    const r = runScript([], { FAKE_NPM_VERSION: minorsBelow(MERGED, 1), FAKE_SHALLOW: "true" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/bump date could not be determined/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The board leg. Every mocked fetch used to THROW, so `readRunning`'s success mapping and
+// its no-record branch were unreachable from any test and only the error outcomes were
+// ever exercised.
+// ---------------------------------------------------------------------------
+describe("the board leg, when the query actually succeeds", () => {
+  const boardArgs = ["--board", "fixture-ref-not-a-real-project"];
+
+  it("maps a consistent install record to OK — the success path is reachable at all", () => {
+    const r = runScript(boardArgs, {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "board-row",
+      FAKE_BOARD_ROW: JSON.stringify(consistentRow()),
+    });
+    expect(r.status).toBe(0);
+    expect(r.out).toMatch(/record consistent/);
+  });
+
+  it("treats an empty result set as NO install record — DRIFT, not an empty pass", () => {
+    const r = runScript(boardArgs, { FAKE_NPM_VERSION: MERGED, FAKE_FETCH_MODE: "board-no-record" });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/NO install record/);
+  });
+
+  it("treats a non-2xx response as UNKNOWN, not as an absent record", () => {
+    const r = runScript(boardArgs, { FAKE_NPM_VERSION: MERGED, FAKE_FETCH_MODE: "board-http-error" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/HTTP 401/);
+    // The status-code path names the endpoint too. Without this, only the exception path's
+    // `endpointOf` was pinned and this one could lose it silently.
+    expect(r.out).toContain("POST /v1/projects/fixture-ref-not-a-real-project/database/query");
+  });
+
+  it("reports a board AHEAD of merged as DRIFT, end to end — it exits 1, not 0", () => {
+    // The round-3 reproduction: a board running a version main does not have, with a
+    // digest and schema_version that MATCH, reported ok and exited 0.
+    const r = runScript(boardArgs, {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "board-row",
+      FAKE_BOARD_ROW: JSON.stringify(consistentRow({ package_version: minorsAbove(MERGED, 1) })),
+    });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/AHEAD of merged/);
+    expect(r.out).not.toMatch(/record consistent/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The scrubber, end to end through the shipped script. Deleting `makeScrub` left the
+// previous suite green.
+// ---------------------------------------------------------------------------
+describe("credentials never reach the output", () => {
+  it("redacts a TRUNCATED echo of the token we hold, not just an exact match", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "echo-token-prefix",
+    });
+    expect(r.out).not.toContain(CANARY);
+    expect(r.out).not.toContain(CANARY_PREFIX);
+    // Proves redaction did the work, not the 200-character truncation.
+    expect(r.out).toMatch(/<redacted>/);
+    expect(r.status).toBe(2);
+  });
+
+  // The probe from the original finding. NOTE, because a commit message got this wrong:
+  // this probe is matched by the vendor layer AND by the generic layer, so it does NOT
+  // isolate either one — deleting the vendor layer leaves it green. It pins that the
+  // reported probe stops printing, nothing more. The isolating probe is the next test.
+  it("redacts a foreign credential of a KNOWN vendor shape we never held", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-github",
+    });
+    expect(r.out).not.toContain("gho_OTHERPARTYCRED_9999");
+    expect(r.out).not.toContain("OTHERPARTYCRED");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts a vendor-prefixed credential the generic layer CANNOT see — pins layer 2 alone", () => {
+    // All letters after the prefix, so the generic layer's digit lookahead fails and only
+    // the vendor-prefix layer can catch it. Deleting that layer reds this and nothing else.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-vendor-only",
+    });
+    expect(r.out).not.toContain("xoxb-SLACKBOTTOKENEXAMPLE");
+    expect(r.out).not.toContain("SLACKBOTTOKEN");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts an AWS secret access key — the `/` that split it out of the old class", () => {
+    // `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` printed intact: the old generic class
+    // excluded `/`, so it split into 13-, 7- and 18-character pieces and the 18-character
+    // piece was all letters. Long and mixed-class — inside what the header claimed to
+    // cover. Each surviving fragment is asserted separately, so a partial leak fails too.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-aws-secret",
+    });
+    expect(r.out).not.toContain("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");
+    expect(r.out).not.toContain("wJalrXUtnFEMI");
+    expect(r.out).not.toContain("bPxRfiCYEXAMPLEKEY");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts a foreign credential of an UNKNOWN shape — the generic mixed-class layer", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-unknown-shape",
+    });
+    expect(r.out).not.toContain("zt9f3k1QweRtyUiOpAsDf");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("an HTTP failure still names the board and the endpoint even when the message is redacted", () => {
+    // Redaction must not be able to destroy diagnosability. The generic layer eats URL
+    // paths (a path and a base64 secret have the same shape), so the ref and the endpoint
+    // are printed from this process's OWN variables rather than recovered from the
+    // response. Removing `endpointOf(ref)` from the error string reds this.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "http-500-with-url",
+    });
+    // The path we supplied survives in full...
+    expect(r.out).toContain("POST /v1/projects/fixture-ref-not-a-real-project/database/query");
+    // ...while the path that came back over the network was still redacted, so the
+    // assertion above cannot be passing on the response text.
+    expect(r.out).not.toContain("some-other-ref-in-the-message");
+    expect(r.out).toMatch(/<redacted>/);
+    expect(r.status).toBe(2);
+  });
+
+  it("never places a credential in a child process's argv", () => {
+    runScript(["--board", "fixture-ref-not-a-real-project"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "network disabled",
+    });
+    const argv = readFileSync(ARGV_LOG, "utf8");
+    expect(argv).not.toContain(CANARY);
+    expect(argv).not.toContain(CANARY_PREFIX);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Manifest expectations: the exact field, not a pattern.
+// ---------------------------------------------------------------------------
+describe("the digest expectation comes from the named manifest field", () => {
+  it("carries schema-manifest.json's aggregateSha256 into the facts", () => {
+    const r = runScript(["--json"], { FAKE_NPM_VERSION: MERGED });
+    const doc = JSON.parse(r.stdout);
+    expect(MANIFEST_JSON.aggregateSha256).toBeTruthy();
+    expect(doc.facts.expectedDigest).toBe(MANIFEST_JSON.aggregateSha256);
+    expect(doc.facts.expectedSchemaVersion).toBe(MANIFEST_JSON.schemaVersion);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The `git log -L` range. A seat reported that `/"version":/,+1` spans TWO lines, so an
+// edit to the ADJACENT line would reset the bump date. Measured on git 2.55, `,+N` is N
+// lines TOTAL, so `,+1` is one line and the finding is refuted. This test pins BOTH halves
+// so the refutation is not just a comment: it reads the range the script actually passes,
+// then runs REAL git with that exact range against a fixture where the line after
+// `"version":` was edited later than the version itself.
+// ---------------------------------------------------------------------------
+describe("the bump date comes from the version line alone", () => {
+  const git = (cwd, args, env = {}) =>
+    spawnSync("git", args, { cwd, encoding: "utf8", env: { ...process.env, ...env } });
+
+  function fixtureRepo(dir) {
+    mkdirSync(dir, { recursive: true });
+    const commit = (msg, body, iso) => {
+      writeFileSync(join(dir, "package.json"), body);
+      git(dir, ["add", "-A"]);
+      git(dir, ["-c", "user.email=t@example.invalid", "-c", "user.name=t", "commit", "-qm", msg], {
+        GIT_AUTHOR_DATE: iso,
+        GIT_COMMITTER_DATE: iso,
+      });
+    };
+    git(dir, ["init", "-q", "."]);
+    const doc = (v, d) => `{\n  "name": "x",\n  "version": "${v}",\n  "description": "${d}",\n  "type": "module"\n}\n`;
+    commit("base", doc("1.0.0", "one"), "2026-01-01T00:00:00Z");
+    commit("bump", doc("1.1.0", "one"), "2026-02-01T00:00:00Z");
+    commit("adjacent-line-edit", doc("1.1.0", "TWO"), "2026-06-01T00:00:00Z");
+  }
+
+  it("passes a range that selects the version bump and NOT the adjacent-line edit", () => {
+    // 1. what range does the shipped script actually pass?
+    runScript([], { FAKE_NPM_VERSION: MERGED });
+    const lines = readFileSync(ARGV_LOG, "utf8").split("\n");
+    const i = lines.lastIndexOf("-L");
+    expect(i).toBeGreaterThan(-1);
+    const range = lines[i + 1];
+    expect(range).toMatch(/:packages\/agent-board-schema\/package\.json$/);
+
+    // 2. does that range, under REAL git, select only the version line?
+    const dir = mkdtempSync(join(tmpdir(), "drift-Lfixture-"));
+    try {
+      fixtureRepo(dir);
+      // The fixture must really have the three commits; an empty `git log` result would
+      // otherwise satisfy `not.toBe("adjacent-line-edit")` while asserting nothing.
+      expect((git(dir, ["log", "--format=%s"]).stdout ?? "").trim().split("\n")).toEqual([
+        "adjacent-line-edit",
+        "bump",
+        "base",
+      ]);
+      // The range itself contains colons (`/"version":/,+1`), so split on the LAST one.
+      const spec = `${range.slice(0, range.lastIndexOf(":"))}:package.json`;
+      const out = git(dir, ["log", "-1", "--format=%s", "-L", spec]).stdout ?? "";
+      const subject = out.split("\n")[0].trim();
+      expect(subject).toBe("bump");
+      expect(subject).not.toBe("adjacent-line-edit");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("the script under test is the one that ships", () => {
+  it("is the file CI runs", () => {
+    expect(existsSync(SCRIPT)).toBe(true);
+    expect(readFileSync(join(ROOT, ".github", "workflows", "ci.yml"), "utf8")).toContain(
+      "node scripts/check-deployment-drift.mjs",
+    );
+  });
+});