@consiliency/agent-board-schema 1.35.0 → 1.38.0

package/migrations/20260919000100_agent_board_signed_write_model_key.sql

@@ -0,0 +1,107 @@
+-- SIGNEDWRITEMODEL (message-board#326) — a self-describing sibling for
+-- `signed_write_enforced` in the bundle/schema handshake.
+--
+-- THE PROBLEM. After #324 the flag has the right VALUE and the wrong NAME. It is
+-- called "signed write enforced" and it tests "the signed path is operator-only".
+-- Those are different propositions, and a boolean cannot say which one it means.
+-- The consequence is already written down in specs/operations.md: a reader must
+-- combine the flag with `installed_bundle_version` to know which MEANING they are
+-- looking at — below 1.37.0 it tests the model 20260718000800 abandoned, at or
+-- above it tests the current one. That works and it asks every reader to carry a
+-- version boundary in their head.
+--
+-- WHY NOT RENAME OR RETIRE, which is the strongest argument in this area.
+-- packages/agent-board-client/src/compatibility.ts recognises a health response
+-- with a runtime TYPE GUARD:
+--     "schema_version" in value && "signed_write_enforced" in value && "ready" in value
+-- Drop the key and every deployed client stops recognising a HEALTHY board's
+-- response as a health response at all. The other spelling of retirement — keep
+-- the key, pin it false/null forever — is a permanently-lying instrument, which is
+-- precisely the harm #310 names. Retirement loses both ways, which is why #324
+-- re-pointed rather than replaced, and why this migration ADDS.
+--
+-- WHY ADDING IS SAFE, and how far that claim goes. The guard requires those three
+-- keys to be PRESENT; it does not enumerate the payload. Checked rather than
+-- assumed: no consumer in this repository asserts an exhaustive key set over
+-- `get_bundle_compatibility()` — the pgTAP consumers read individual keys with
+-- `->>`, and the client reads named fields. A consumer OUTSIDE this repository
+-- that pins the whole object would still be broken by any added key, which is a
+-- property of adding keys and not of this one.
+--
+-- NOT PROPOSED: gating on it. A sound gate is constructible
+-- (`installed_bundle_version >= 1.37.0 AND flag true`) but semver strings need
+-- real comparison, and the recorded version is what the materializer WROTE, not
+-- necessarily what is APPLIED. That makes a good argument and a bad gate, so this
+-- ships as a decode hint like the boolean beside it.
+--
+-- FUTURE-PROOFING is the actual point. The next posture change adds a new VALUE
+-- here rather than silently re-pointing a boolean for a second time — which is
+-- exactly what #310 was.
+--
+-- CREATE OR REPLACE with the identical signature, so the existing ACL survives.
+-- The grants are restated anyway and the COMMENT rewritten, because a recreated
+-- SECURITY DEFINER function that does not restate them is the gate-bypass this
+-- repo has already shipped once (#118). `anon` is deliberately NOT granted.
+
+CREATE OR REPLACE FUNCTION agent_board.get_bundle_compatibility()
+ RETURNS jsonb
+ LANGUAGE sql
+ STABLE SECURITY DEFINER
+ SET search_path TO 'agent_board', 'pg_temp'
+AS $function$
+  select jsonb_build_object(
+    'schema_version', (select version from agent_board.schema_version limit 1),
+    'installed_bundle_version', (select package_version from agent_board.bundle_installation limit 1),
+    'installed_bundle_digest', (select bundle_digest from agent_board.bundle_installation limit 1),
+    'installed_schema_version', (select schema_version from agent_board.bundle_installation limit 1),
+    'source_commit', (select source_commit from agent_board.bundle_installation limit 1),
+    -- #326: which PROPOSITION the boolean below is answering, said out loud, so a
+    -- reader does not have to consult a version boundary to decode it. A constant
+    -- rather than a derivation: it names the model this bundle's predicate encodes,
+    -- which is a fact about the migration you are reading, not about the database.
+    'signed_write_model', 'operator-only-gateway',
+    -- #310: enforcement means the SIGNED path stays operator-only, not that the unsigned path is
+    -- unreachable. See 20260918000100's header for what this does and does not establish.
+    'signed_write_enforced', (
+      -- The anchor. A schema with no signed gateway grants none of them, which would make the
+      -- second clause vacuously true; requiring the gateway to exist is what stops "enforced"
+      -- from meaning "nothing to enforce".
+      exists (
+        select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+         where n.nspname = 'agent_board'
+           and p.proname = 'signed_send_direct_message'
+      )
+      and not exists (
+        -- Catalog-derived over pg_proc ROWS: covers all seven gateways and every overload of
+        -- each, and asks the privilege RESOLVER rather than reading a direct-grant view.
+        select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+         cross join (values ('authenticated'), ('anon')) as r(rolname)
+         where n.nspname = 'agent_board'
+           and p.proname like 'signed\_%'
+           and pg_catalog.has_function_privilege(r.rolname, p.oid, 'EXECUTE')
+      )
+    ),
+    -- Ready only once the materializer has recorded an install AND the schema
+    -- version handshake resolves.
+    'ready', (
+      (select version from agent_board.schema_version limit 1) is not null
+      and exists (select 1 from agent_board.bundle_installation)
+    ),
+    'checked_at', now()
+  );
+$function$;
+
+-- Restated rather than relied upon. CREATE OR REPLACE preserves the ACL, but this repo has
+-- already shipped a gate-bypass by recreating a SECURITY DEFINER function without restating its
+-- privileges, so the rule is to restate them in the same migration every time. `anon` is
+-- deliberately NOT granted: it did not hold EXECUTE before this migration and must not gain it.
+revoke all on function agent_board.get_bundle_compatibility() from public;
+grant execute on function agent_board.get_bundle_compatibility() to authenticated;
+grant execute on function agent_board.get_bundle_compatibility() to service_role;
+
+comment on function agent_board.get_bundle_compatibility() is
+  'Bundle/schema handshake for adopters. `signed_write_model` NAMES the proposition the boolean beside it answers -- `operator-only-gateway` means "the signed gateway exists and no agent_board.signed_* function (all overloads, via has_function_privilege) is EXECUTE-able by authenticated or anon". Read the pair: the model says WHAT is being tested, `signed_write_enforced` says whether it HOLDS. PRESENCE of this key implies the current meaning and needs no semver comparison. ABSENCE does NOT imply the retired one: the boolean changed meaning at bundle 1.37.0 and this key starts at 1.38.0, so on exactly 1.37.x the key is absent while a FALSE is a REAL regression. Absent means consult installed_bundle_version, not "nothing to see". Neither field is a gate. Neither tests that a writer derives its actor from the session and gates -- that half is asserted in agent_board_signed_write_enforced.test.sql, and ONLY for the unsigned counterpart of a signed_* gateway, so a writer with no signed twin is outside both instruments. #310, #326.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consiliency/agent-board-schema",
-  "version": "1.35.0",
+  "version": "1.38.0",
   "description": "Canonical, immutable, exact-pinnable agent_board schema bundle: ordered SQL migrations, digest + compatibility manifest, and deterministic materialize/plan/check tooling for adopters.",
   "repository": "https://github.com/Consiliency/message-board.git",
   "type": "module",

package/schema-manifest.json

@@ -2,7 +2,7 @@
   "schema": "agent_board_schema_manifest.v1",
   "interface": "IF-0-MBPLANE-BUNDLE-1",
   "package": "@consiliency/agent-board-schema",
-  "packageVersion": "1.35.0",
+  "packageVersion": "1.38.0",
   "schemaVersion": 8,
   "minClientVersion": "1.1.0",
   "source": {
@@ -46,8 +46,8 @@
       "usage": "upsert (retention/monitoring defaults; on conflict do nothing)"
     }
   ],
-  "migrationCount": 134,
-  "aggregateSha256": "f63027fa44451c55a39fcc8f463df6ae6f4b92765578be053d8bf3b9a2bee07e",
+  "migrationCount": 137,
+  "aggregateSha256": "bfe0b978234464938428a66199b75d2f8d028706517b4674f9ae11cae34c52d1",
   "migrations": [
     {
       "order": 0,
@@ -1254,6 +1254,33 @@
       "sourceRef": "message-board",
       "bytes": 84162,
       "sha256": "d9f05e18094954f2e4ee32bf7b129f0a9ffc39bc800a5efa9cf7938e1555c8dc"
+    },
+    {
+      "order": 134,
+      "id": "20260917000100_agent_board_invite_no_downgrade",
+      "filename": "20260917000100_agent_board_invite_no_downgrade.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 24929,
+      "sha256": "c205a9a679dca059979972b49c89c3b1b3b8f8e2039bd7675a10578f49f9b35a"
+    },
+    {
+      "order": 135,
+      "id": "20260918000100_agent_board_signed_write_enforced_repoint",
+      "filename": "20260918000100_agent_board_signed_write_enforced_repoint.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 9965,
+      "sha256": "f76dd01744029bfd0088bd4f6cf6fa5cb93e3c9b7fa5559ad83857cf7f4eb8ce"
+    },
+    {
+      "order": 136,
+      "id": "20260919000100_agent_board_signed_write_model_key",
+      "filename": "20260919000100_agent_board_signed_write_model_key.sql",
+      "origin": "message-board-forward",
+      "sourceRef": "message-board",
+      "bytes": 7204,
+      "sha256": "464ae39acbd96330c5ad1c753fa1204ca290baa0d6f82d7d30d0ead4d2944d37"
     }
   ],
   "excludedBridge": {

package/src/deployment-drift-script.test.mjs

@@ -0,0 +1,424 @@
+// Tests for the SHIPPED deployment-drift SCRIPT — scripts/check-deployment-drift.mjs.
+//
+// WHY THIS FILE EXISTS. deployment-drift.test.mjs covers `evaluate()`, the decision. It
+// does not load the script at all, and an audit measured the consequence: flipping the
+// final line's exit mapping from `UNKNOWN -> 2` to `UNKNOWN -> 0` left the whole suite
+// green, and deleting `makeScrub` entirely left it green. The exit mapping is the property
+// the PR exists for and the scrubber is its security property; both were pinned by nothing.
+//
+// So these tests run the real script as a SUBPROCESS and assert its exit code and its
+// output. Nothing here reimplements it.
+//
+// HERMETIC BY CONSTRUCTION. The script shells out to `npm view` and `git`, and fetches
+// over the network. All three are controlled, and none of them reaches outside this box:
+//   - `npm` and `git` are shell shims on a prepended PATH. They also append their argv to
+//     a log, which is how the `-L` range below is asserted.
+//   - `globalThis.fetch` is replaced by a preloaded module (`--import`), so no request is
+//     ever issued. No real project ref is ever named.
+// The tests therefore do not depend on network reachability, on npm auth, or on the
+// clone depth of the checkout running them.
+import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, chmodSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(HERE, "..", "..", ".."); // packages/agent-board-schema/src -> repo root
+const SCRIPT = join(ROOT, "scripts", "check-deployment-drift.mjs");
+const PKG_JSON = join(ROOT, "packages", "agent-board-schema", "package.json");
+const MANIFEST = join(ROOT, "packages", "agent-board-schema", "schema-manifest.json");
+
+const MERGED = JSON.parse(readFileSync(PKG_JSON, "utf8")).version;
+const MANIFEST_JSON = JSON.parse(readFileSync(MANIFEST, "utf8"));
+
+// A version several minors BELOW merged, derived so this does not rot when merged bumps.
+function minorsBelow(v, n) {
+  const [maj, min, pat] = v.split(".").map(Number);
+  return `${maj}.${Math.max(0, min - n)}.${pat}`;
+}
+function minorsAbove(v, n) {
+  const [maj, min, pat] = v.split(".").map(Number);
+  return `${maj}.${min + n}.${pat}`;
+}
+const FRESH_BUMP = new Date(Date.now() - 3_600_000).toISOString();
+// Postgres renders timestamptz with a space and a two-digit offset; the script's own
+// parser exists for that shape, so the fixture uses it rather than an ISO string.
+const pgStamp = (msAgo) => new Date(Date.now() - msAgo).toISOString().replace("T", " ").replace(/Z$/, "+00");
+// A record that agrees with the repo on every field the check compares.
+const consistentRow = (over = {}) => ({
+  package_version: MERGED,
+  schema_version: MANIFEST_JSON.schemaVersion,
+  bundle_digest: MANIFEST_JSON.aggregateSha256,
+  installed_at: pgStamp(1_800_000), // 30 minutes ago — after FRESH_BUMP
+  ...over,
+});
+
+// A canary that is NOT a credential: it never authenticated anything and is not a real
+// token shape. The 20-character prefix is the thing an audit saw printed verbatim.
+const CANARY = "canary_token_shape_A_not_a_real_secret_value";
+const CANARY_PREFIX = CANARY.slice(0, 20); // "canary_token_shape_A"
+
+let SHIMS;
+let ARGV_LOG;
+let PRELOAD;
+
+beforeAll(() => {
+  SHIMS = mkdtempSync(join(tmpdir(), "drift-shims-"));
+  ARGV_LOG = join(SHIMS, "argv.log");
+
+  // One arg per line, `--` between invocations, so an assertion can read exact argv rather
+  // than a space-joined approximation.
+  const logArgv = 'printf -- "--\\n" >> "$DRIFT_ARGV_LOG"; for a in "$@"; do printf "%s\\n" "$a" >> "$DRIFT_ARGV_LOG"; done';
+
+  writeFileSync(
+    join(SHIMS, "npm"),
+    `#!/bin/sh\n${logArgv}\n[ -n "\${FAKE_NPM_VERSION:-}" ] || exit 1\nprintf "%s\\n" "$FAKE_NPM_VERSION"\n`,
+  );
+  writeFileSync(
+    join(SHIMS, "git"),
+    `#!/bin/sh\n${logArgv}\ncase " $* " in\n  *" rev-parse "*) printf "%s\\n" "\${FAKE_SHALLOW:-false}" ;;\n  *" log "*) [ -n "\${FAKE_BUMP_ISO:-}" ] || exit 1; printf "%s\\n" "$FAKE_BUMP_ISO" ;;\n  *) exit 1 ;;\nesac\n`,
+  );
+  chmodSync(join(SHIMS, "npm"), 0o755);
+  chmodSync(join(SHIMS, "git"), 0o755);
+
+  // No request leaves this machine.
+  //
+  // The throwing modes carry their probe EARLY in the string, so a passing redaction
+  // assertion cannot be truncation in disguise. The RESOLVING modes exist because a review
+  // found every mode here threw: `readRunning`'s success mapping and its no-record branch
+  // were unreachable from any test, so the only board outcomes ever exercised were the
+  // error ones. A stub that can only fail cannot pin what happens when the call works.
+  PRELOAD = join(SHIMS, "no-network.mjs");
+  writeFileSync(
+    PRELOAD,
+    [
+      'const mode = process.env.FAKE_FETCH_MODE || "";',
+      "const respond = (status, body) => ({",
+      "  ok: status >= 200 && status < 300,",
+      "  status,",
+      "  json: async () => body,",
+      "});",
+      "globalThis.fetch = async () => {",
+      '  if (mode === "board-row") return respond(200, [JSON.parse(process.env.FAKE_BOARD_ROW)]);',
+      '  if (mode === "board-no-record") return respond(200, []);',
+      '  if (mode === "board-http-error") return respond(401, { message: "unauthorized" });',
+      '  if (mode === "echo-token-prefix") {',
+      "    throw new Error(`connect ${String(process.env.SUPABASE_ACCESS_TOKEN).slice(0, 20)} ECONNREFUSED upstream`);",
+      "  }",
+      '  if (mode === "foreign-github") throw new Error("upstream gho_OTHERPARTYCRED_9999 rejected while proxying");',
+      '  if (mode === "foreign-unknown-shape") throw new Error("upstream zt9f3k1QweRtyUiOpAsDf rejected while proxying");',
+      '  if (mode === "foreign-vendor-only") throw new Error("upstream xoxb-SLACKBOTTOKENEXAMPLE rejected while proxying");',
+      '  if (mode === "foreign-aws-secret") throw new Error("upstream wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY rejected");',
+      // The seat's measured over-redaction: a URL inside the RESPONSE text is eaten by the
+      // generic layer, because a path has the same shape as a base64 secret. Note the ref
+      // embedded here differs from the one passed on the command line, so an assertion
+      // about the endpoint cannot be satisfied by this string surviving.
+      '  if (mode === "http-500-with-url") {',
+      '    throw new Error("HTTP 500 from https://api.supabase.com/v1/projects/some-other-ref-in-the-message/database/query");',
+      "  }",
+      '  throw new Error("network disabled in test");',
+      "};",
+      "",
+    ].join("\n"),
+  );
+});
+
+afterAll(() => {
+  if (SHIMS) rmSync(SHIMS, { recursive: true, force: true });
+});
+
+function runScript(args = [], env = {}) {
+  const r = spawnSync(process.execPath, [SCRIPT, ...args], {
+    cwd: ROOT,
+    encoding: "utf8",
+    timeout: 60_000,
+    env: {
+      ...process.env,
+      PATH: `${SHIMS}:${process.env.PATH}`,
+      NODE_OPTIONS: `--import ${pathToFileURL(PRELOAD).href}`,
+      DRIFT_ARGV_LOG: ARGV_LOG,
+      FAKE_BUMP_ISO: FRESH_BUMP,
+      FAKE_SHALLOW: "false",
+      FAKE_FETCH_MODE: "",
+      SUPABASE_ACCESS_TOKEN: CANARY,
+      ...env,
+    },
+  });
+  return { ...r, out: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+}
+
+// ---------------------------------------------------------------------------
+// The exit mapping. This is the whole point of the change, and it was pinned by nothing:
+// `UNKNOWN -> 0` left all 38 evaluate() tests green.
+// ---------------------------------------------------------------------------
+describe("the shipped script's exit mapping", () => {
+  it("exits 0 when merged and published agree — OK is reachable", () => {
+    const r = runScript([], { FAKE_NPM_VERSION: MERGED });
+    expect(r.status).toBe(0);
+    expect(r.out).toMatch(/no drift/);
+  });
+
+  it("exits 1 on real drift — DRIFT is not folded into success", () => {
+    const r = runScript([], { FAKE_NPM_VERSION: minorsBelow(MERGED, 10) });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/DRIFT/);
+  });
+
+  it("exits 2 when a leg cannot be determined — UNKNOWN is NOT a pass", () => {
+    // npm shim exits non-zero: the published version is undeterminable.
+    const r = runScript([], { FAKE_NPM_VERSION: "" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/UNKNOWN/);
+  });
+
+  it("exits 2, not 0, when the board leg cannot be read", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "network disabled",
+    });
+    expect(r.status).toBe(2);
+  });
+
+  it("rejects a non-numeric threshold with exit 2 rather than passing everything", () => {
+    const r = runScript(["--max-days", "not-a-number"], { FAKE_NPM_VERSION: MERGED });
+    expect(r.status).toBe(2);
+  });
+
+  it("refuses to date the bump on a shallow clone, so an unpublished gap is UNKNOWN", () => {
+    // FAKE_SHALLOW was never true in any test, so the shallow-clone refusal the previous
+    // round added was driven by nothing. Making isShallowClone() return false
+    // unconditionally reds this: the shimmed bump date would come back fresh and a
+    // one-version gap would report OK / exit 0.
+    const r = runScript([], { FAKE_NPM_VERSION: minorsBelow(MERGED, 1), FAKE_SHALLOW: "true" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/bump date could not be determined/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The board leg. Every mocked fetch used to THROW, so `readRunning`'s success mapping and
+// its no-record branch were unreachable from any test and only the error outcomes were
+// ever exercised.
+// ---------------------------------------------------------------------------
+describe("the board leg, when the query actually succeeds", () => {
+  const boardArgs = ["--board", "fixture-ref-not-a-real-project"];
+
+  it("maps a consistent install record to OK — the success path is reachable at all", () => {
+    const r = runScript(boardArgs, {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "board-row",
+      FAKE_BOARD_ROW: JSON.stringify(consistentRow()),
+    });
+    expect(r.status).toBe(0);
+    expect(r.out).toMatch(/record consistent/);
+  });
+
+  it("treats an empty result set as NO install record — DRIFT, not an empty pass", () => {
+    const r = runScript(boardArgs, { FAKE_NPM_VERSION: MERGED, FAKE_FETCH_MODE: "board-no-record" });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/NO install record/);
+  });
+
+  it("treats a non-2xx response as UNKNOWN, not as an absent record", () => {
+    const r = runScript(boardArgs, { FAKE_NPM_VERSION: MERGED, FAKE_FETCH_MODE: "board-http-error" });
+    expect(r.status).toBe(2);
+    expect(r.out).toMatch(/HTTP 401/);
+    // The status-code path names the endpoint too. Without this, only the exception path's
+    // `endpointOf` was pinned and this one could lose it silently.
+    expect(r.out).toContain("POST /v1/projects/fixture-ref-not-a-real-project/database/query");
+  });
+
+  it("reports a board AHEAD of merged as DRIFT, end to end — it exits 1, not 0", () => {
+    // The round-3 reproduction: a board running a version main does not have, with a
+    // digest and schema_version that MATCH, reported ok and exited 0.
+    const r = runScript(boardArgs, {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "board-row",
+      FAKE_BOARD_ROW: JSON.stringify(consistentRow({ package_version: minorsAbove(MERGED, 1) })),
+    });
+    expect(r.status).toBe(1);
+    expect(r.out).toMatch(/AHEAD of merged/);
+    expect(r.out).not.toMatch(/record consistent/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The scrubber, end to end through the shipped script. Deleting `makeScrub` left the
+// previous suite green.
+// ---------------------------------------------------------------------------
+describe("credentials never reach the output", () => {
+  it("redacts a TRUNCATED echo of the token we hold, not just an exact match", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "echo-token-prefix",
+    });
+    expect(r.out).not.toContain(CANARY);
+    expect(r.out).not.toContain(CANARY_PREFIX);
+    // Proves redaction did the work, not the 200-character truncation.
+    expect(r.out).toMatch(/<redacted>/);
+    expect(r.status).toBe(2);
+  });
+
+  // The probe from the original finding. NOTE, because a commit message got this wrong:
+  // this probe is matched by the vendor layer AND by the generic layer, so it does NOT
+  // isolate either one — deleting the vendor layer leaves it green. It pins that the
+  // reported probe stops printing, nothing more. The isolating probe is the next test.
+  it("redacts a foreign credential of a KNOWN vendor shape we never held", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-github",
+    });
+    expect(r.out).not.toContain("gho_OTHERPARTYCRED_9999");
+    expect(r.out).not.toContain("OTHERPARTYCRED");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts a vendor-prefixed credential the generic layer CANNOT see — pins layer 2 alone", () => {
+    // All letters after the prefix, so the generic layer's digit lookahead fails and only
+    // the vendor-prefix layer can catch it. Deleting that layer reds this and nothing else.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-vendor-only",
+    });
+    expect(r.out).not.toContain("xoxb-SLACKBOTTOKENEXAMPLE");
+    expect(r.out).not.toContain("SLACKBOTTOKEN");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts an AWS secret access key — the `/` that split it out of the old class", () => {
+    // `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` printed intact: the old generic class
+    // excluded `/`, so it split into 13-, 7- and 18-character pieces and the 18-character
+    // piece was all letters. Long and mixed-class — inside what the header claimed to
+    // cover. Each surviving fragment is asserted separately, so a partial leak fails too.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-aws-secret",
+    });
+    expect(r.out).not.toContain("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY");
+    expect(r.out).not.toContain("wJalrXUtnFEMI");
+    expect(r.out).not.toContain("bPxRfiCYEXAMPLEKEY");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("redacts a foreign credential of an UNKNOWN shape — the generic mixed-class layer", () => {
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "foreign-unknown-shape",
+    });
+    expect(r.out).not.toContain("zt9f3k1QweRtyUiOpAsDf");
+    expect(r.out).toMatch(/<redacted>/);
+  });
+
+  it("an HTTP failure still names the board and the endpoint even when the message is redacted", () => {
+    // Redaction must not be able to destroy diagnosability. The generic layer eats URL
+    // paths (a path and a base64 secret have the same shape), so the ref and the endpoint
+    // are printed from this process's OWN variables rather than recovered from the
+    // response. Removing `endpointOf(ref)` from the error string reds this.
+    const r = runScript(["--board", "fixture-ref-not-a-real-project", "--json"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "http-500-with-url",
+    });
+    // The path we supplied survives in full...
+    expect(r.out).toContain("POST /v1/projects/fixture-ref-not-a-real-project/database/query");
+    // ...while the path that came back over the network was still redacted, so the
+    // assertion above cannot be passing on the response text.
+    expect(r.out).not.toContain("some-other-ref-in-the-message");
+    expect(r.out).toMatch(/<redacted>/);
+    expect(r.status).toBe(2);
+  });
+
+  it("never places a credential in a child process's argv", () => {
+    runScript(["--board", "fixture-ref-not-a-real-project"], {
+      FAKE_NPM_VERSION: MERGED,
+      FAKE_FETCH_MODE: "network disabled",
+    });
+    const argv = readFileSync(ARGV_LOG, "utf8");
+    expect(argv).not.toContain(CANARY);
+    expect(argv).not.toContain(CANARY_PREFIX);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Manifest expectations: the exact field, not a pattern.
+// ---------------------------------------------------------------------------
+describe("the digest expectation comes from the named manifest field", () => {
+  it("carries schema-manifest.json's aggregateSha256 into the facts", () => {
+    const r = runScript(["--json"], { FAKE_NPM_VERSION: MERGED });
+    const doc = JSON.parse(r.stdout);
+    expect(MANIFEST_JSON.aggregateSha256).toBeTruthy();
+    expect(doc.facts.expectedDigest).toBe(MANIFEST_JSON.aggregateSha256);
+    expect(doc.facts.expectedSchemaVersion).toBe(MANIFEST_JSON.schemaVersion);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The `git log -L` range. A seat reported that `/"version":/,+1` spans TWO lines, so an
+// edit to the ADJACENT line would reset the bump date. Measured on git 2.55, `,+N` is N
+// lines TOTAL, so `,+1` is one line and the finding is refuted. This test pins BOTH halves
+// so the refutation is not just a comment: it reads the range the script actually passes,
+// then runs REAL git with that exact range against a fixture where the line after
+// `"version":` was edited later than the version itself.
+// ---------------------------------------------------------------------------
+describe("the bump date comes from the version line alone", () => {
+  const git = (cwd, args, env = {}) =>
+    spawnSync("git", args, { cwd, encoding: "utf8", env: { ...process.env, ...env } });
+
+  function fixtureRepo(dir) {
+    mkdirSync(dir, { recursive: true });
+    const commit = (msg, body, iso) => {
+      writeFileSync(join(dir, "package.json"), body);
+      git(dir, ["add", "-A"]);
+      git(dir, ["-c", "user.email=t@example.invalid", "-c", "user.name=t", "commit", "-qm", msg], {
+        GIT_AUTHOR_DATE: iso,
+        GIT_COMMITTER_DATE: iso,
+      });
+    };
+    git(dir, ["init", "-q", "."]);
+    const doc = (v, d) => `{\n  "name": "x",\n  "version": "${v}",\n  "description": "${d}",\n  "type": "module"\n}\n`;
+    commit("base", doc("1.0.0", "one"), "2026-01-01T00:00:00Z");
+    commit("bump", doc("1.1.0", "one"), "2026-02-01T00:00:00Z");
+    commit("adjacent-line-edit", doc("1.1.0", "TWO"), "2026-06-01T00:00:00Z");
+  }
+
+  it("passes a range that selects the version bump and NOT the adjacent-line edit", () => {
+    // 1. what range does the shipped script actually pass?
+    runScript([], { FAKE_NPM_VERSION: MERGED });
+    const lines = readFileSync(ARGV_LOG, "utf8").split("\n");
+    const i = lines.lastIndexOf("-L");
+    expect(i).toBeGreaterThan(-1);
+    const range = lines[i + 1];
+    expect(range).toMatch(/:packages\/agent-board-schema\/package\.json$/);
+
+    // 2. does that range, under REAL git, select only the version line?
+    const dir = mkdtempSync(join(tmpdir(), "drift-Lfixture-"));
+    try {
+      fixtureRepo(dir);
+      // The fixture must really have the three commits; an empty `git log` result would
+      // otherwise satisfy `not.toBe("adjacent-line-edit")` while asserting nothing.
+      expect((git(dir, ["log", "--format=%s"]).stdout ?? "").trim().split("\n")).toEqual([
+        "adjacent-line-edit",
+        "bump",
+        "base",
+      ]);
+      // The range itself contains colons (`/"version":/,+1`), so split on the LAST one.
+      const spec = `${range.slice(0, range.lastIndexOf(":"))}:package.json`;
+      const out = git(dir, ["log", "-1", "--format=%s", "-L", spec]).stdout ?? "";
+      const subject = out.split("\n")[0].trim();
+      expect(subject).toBe("bump");
+      expect(subject).not.toBe("adjacent-line-edit");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("the script under test is the one that ships", () => {
+  it("is the file CI runs", () => {
+    expect(existsSync(SCRIPT)).toBe(true);
+    expect(readFileSync(join(ROOT, ".github", "workflows", "ci.yml"), "utf8")).toContain(
+      "node scripts/check-deployment-drift.mjs",
+    );
+  });
+});