@mindrian_os/install 1.13.0-beta.11 → 1.13.0-beta.13

package/lib/memory/navigation-hook-resolver.test.cjs

@@ -0,0 +1,177 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 122-04 -- navigation-hook-resolver tests (new suite; registered in the Feynman runner).
+ * ============================================================================================
+ * Asserts the ONE surgical edit in lib/core/framework-chain-composer.cjs:
+ * proposeNextFramework() now resolves the next framework's /mos: command via
+ * lib/workflow/command-resolver.cjs commandsForFramework() (the only door),
+ * degrades to command:null when the registry has no command for it (degrade,
+ * do not fabricate -- WORKFLOW-LAYER-SPEC reliability rule 5), and carries a
+ * workflow array (the resolver's composeWorkflow for the multi-hop chain) as
+ * data on the proposal. mapFrameworkToCommandSlug() delegates to the resolver.
+ * The navigation engine / offer presenter / hooks are NOT touched.
+ *
+ * Registered in lib/memory/run-feynman-tests.cjs TEST_FILES[] and in
+ * tests/run-all-122.sh CJS_SUITES (as ../lib/memory/navigation-hook-resolver.test.cjs).
+ * Run: node lib/memory/navigation-hook-resolver.test.cjs
+ * Exit 0 on pass; throws (node:assert) on any fail.
+ *
+ * Assertion groups:
+ *   1. framework-chain-composer.cjs source requires ../workflow/command-resolver
+ *      (the surgical edit is in place) and references composeWorkflow.
+ *   2. proposeNextFramework(completed, edges).command === commandsForFramework(next)[0]
+ *      (or null when there is none). Tested on a registered next framework
+ *      (Business Model Canvas -> Lean Canvas -> /mos:lean-canvas) and an
+ *      unregistered one (X -> A Wholly Imaginary Framework -> null).
+ *   3. proposeNextFramework returns a workflow array shaped like composeWorkflow
+ *      ([{ step, framework, command|null, optional }], 1-indexed, in order),
+ *      and for a multi-hop FEEDS_INTO chain it includes the successors.
+ *   4. mapFrameworkToCommandSlug delegates to the resolver (a registered
+ *      framework slug round-trips), falls back to the legacy table for an
+ *      unknown name, and stays exported alongside FRAMEWORK_TO_COMMAND_SLUG
+ *      and KNOWN_FRAMEWORKS (122-05 prunes the legacy table, not this plan).
+ *   5. The engine / presenter / hooks are NOT touched: framework-chain-composer.cjs
+ *      is the only file that gained the resolver require (we assert the
+ *      navigation-engine source did NOT gain a command-resolver require).
+ */
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const COMPOSER_PATH = path.join(REPO_ROOT, 'lib', 'core', 'framework-chain-composer.cjs');
+const ENGINE_PATH = path.join(REPO_ROOT, 'lib', 'core', 'navigation-engine.cjs');
+
+const composer = require('../core/framework-chain-composer.cjs');
+const resolver = require('../workflow/command-resolver.cjs');
+
+let passed = 0;
+function test(name, fn) {
+  fn();
+  process.stdout.write('  ok  ' + name + '\n');
+  passed += 1;
+}
+
+// ---------------------------------------------------------------------------
+// 1. the surgical edit is in place (source requires the resolver)
+// ---------------------------------------------------------------------------
+test('framework-chain-composer.cjs requires ../workflow/command-resolver and references composeWorkflow', function () {
+  const src = fs.readFileSync(COMPOSER_PATH, 'utf8');
+  assert.ok(/require\(['"]\.\.\/workflow\/command-resolver(\.cjs)?['"]\)/.test(src),
+    'framework-chain-composer.cjs must require ../workflow/command-resolver');
+  assert.ok(/command-resolver/.test(src), 'source mentions command-resolver');
+  assert.ok(/composeWorkflow/.test(src), 'source mentions composeWorkflow (the multi-step path)');
+});
+
+// ---------------------------------------------------------------------------
+// 2. proposeNextFramework.command === resolver answer (or null)
+// ---------------------------------------------------------------------------
+test('proposeNextFramework.command === commandsForFramework(next)[0] (or null when there is none)', function () {
+  // Registered next framework: Lean Canvas -> /mos:lean-canvas.
+  const registeredEdges = [
+    { from: 'Business Model Canvas', to: 'Lean Canvas', confidence: 0.85, phase_indicator: 'thesis' },
+  ];
+  const p = composer.proposeNextFramework('Business Model Canvas', registeredEdges);
+  assert.ok(p !== null, 'a 0.85-confidence edge yields a proposal');
+  const expected = resolver.commandsForFramework('Lean Canvas');
+  assert.strictEqual(p.command, expected.length > 0 ? expected[0] : null,
+    'command must equal commandsForFramework(next)[0]; got: ' + p.command);
+  assert.ok(typeof p.command === 'string' && p.command.indexOf('/mos:') === 0,
+    'Lean Canvas IS registered, so command must be a /mos: string; got: ' + p.command);
+
+  // Unregistered next framework -> command is null (degrade, not fabricate).
+  const unregEdges = [
+    { from: 'X', to: 'A Wholly Imaginary Framework', confidence: 0.8, phase_indicator: null },
+  ];
+  const u = composer.proposeNextFramework('X', unregEdges);
+  assert.ok(u !== null, 'a 0.8-confidence edge yields a proposal even when the next has no command');
+  assert.strictEqual(u.command, null, 'unregistered next framework -> command:null; got: ' + u.command);
+  // It still matches the resolver: commandsForFramework returns [] for it.
+  assert.deepStrictEqual(resolver.commandsForFramework('A Wholly Imaginary Framework'), []);
+});
+
+// ---------------------------------------------------------------------------
+// 3. proposeNextFramework.workflow is a composeWorkflow-shaped array
+// ---------------------------------------------------------------------------
+test('proposeNextFramework.workflow is a composeWorkflow array; a multi-hop chain includes the successors', function () {
+  // Single hop: workflow = composeWorkflow([completed, next]).
+  const single = composer.proposeNextFramework('Business Model Canvas', [
+    { from: 'Business Model Canvas', to: 'Lean Canvas', confidence: 0.85, phase_indicator: null },
+  ]);
+  assert.ok(Array.isArray(single.workflow), 'workflow is an array');
+  assert.ok(single.workflow.length >= 2, 'workflow includes [completed, next]');
+  single.workflow.forEach(function (s, i) {
+    assert.strictEqual(s.step, i + 1, 'workflow is 1-indexed and in order');
+    assert.ok('framework' in s && 'command' in s && 'optional' in s, 'workflow step shape');
+    assert.ok(s.command === null || (typeof s.command === 'string' && s.command.indexOf('/mos:') === 0),
+      'workflow step command is a /mos: string or null');
+  });
+  assert.strictEqual(single.workflow[0].framework, 'Business Model Canvas');
+  assert.strictEqual(single.workflow[1].framework, 'Lean Canvas');
+
+  // Multi-hop FEEDS_INTO: BQ -> Domain Selection -> JTBD. The workflow walks
+  // the highest-confidence chain and composeWorkflow attaches the commands.
+  const multi = composer.proposeNextFramework('Beautiful Question Framework', [
+    { from: 'Beautiful Question Framework', to: 'Domain Selection', confidence: 0.9, phase_indicator: null },
+    { from: 'Domain Selection', to: 'Jobs to Be Done (JTBD)', confidence: 0.85, phase_indicator: null },
+    { from: 'Jobs to Be Done (JTBD)', to: 'PWS Value Proposition', confidence: 0.8, phase_indicator: null },
+  ]);
+  assert.ok(Array.isArray(multi.workflow));
+  // [completed, +3 hops] -> 4 steps (collectForwardChain caps at 3 hops).
+  assert.strictEqual(multi.workflow.length, 4, 'workflow includes the 3-hop chain; got ' + multi.workflow.length);
+  assert.deepStrictEqual(multi.workflow.map(function (s) { return s.framework; }),
+    ['Beautiful Question Framework', 'Domain Selection', 'Jobs to Be Done (JTBD)', 'PWS Value Proposition']);
+  // And the workflow equals what the resolver would compose for that chain.
+  assert.deepStrictEqual(multi.workflow,
+    resolver.composeWorkflow(['Beautiful Question Framework', 'Domain Selection', 'Jobs to Be Done (JTBD)', 'PWS Value Proposition']));
+
+  // composer.collectForwardChain is also directly exercisable.
+  assert.deepStrictEqual(
+    composer.collectForwardChain('Beautiful Question Framework', [
+      { from: 'Beautiful Question Framework', to: 'Domain Selection', confidence: 0.9 },
+      { from: 'Domain Selection', to: 'Jobs to Be Done (JTBD)', confidence: 0.85 },
+    ], 3),
+    ['Beautiful Question Framework', 'Domain Selection', 'Jobs to Be Done (JTBD)']
+  );
+});
+
+// ---------------------------------------------------------------------------
+// 4. mapFrameworkToCommandSlug delegates to the resolver; exports preserved
+// ---------------------------------------------------------------------------
+test('mapFrameworkToCommandSlug delegates to the resolver; FRAMEWORK_TO_COMMAND_SLUG + KNOWN_FRAMEWORKS still exported', function () {
+  // A registered framework: the slug round-trips through the resolver.
+  const cmds = resolver.commandsForFramework('Lean Canvas');
+  assert.ok(cmds.length > 0);
+  assert.strictEqual(composer.mapFrameworkToCommandSlug('Lean Canvas'), cmds[0].replace(/^\/mos:/, ''));
+  assert.strictEqual(composer.mapFrameworkToCommandSlug('Domain Selection'),
+    resolver.commandsForFramework('Domain Selection')[0].replace(/^\/mos:/, ''));
+  // An unknown name: falls back to the legacy table / FALLBACK_COMMAND_SLUG.
+  assert.strictEqual(composer.mapFrameworkToCommandSlug('A Wholly Imaginary Framework'), composer.FALLBACK_COMMAND_SLUG);
+  assert.strictEqual(typeof composer.mapFrameworkToCommandSlug('Lean Canvas'), 'string',
+    'mapFrameworkToCommandSlug always returns a slug string (it keeps a non-null fallback)');
+  // Exports preserved (122-05 prunes FRAMEWORK_TO_COMMAND_SLUG; not this plan).
+  assert.strictEqual(typeof composer.proposeNextFramework, 'function');
+  assert.strictEqual(typeof composer.mapFrameworkToCommandSlug, 'function');
+  assert.ok(composer.FRAMEWORK_TO_COMMAND_SLUG && typeof composer.FRAMEWORK_TO_COMMAND_SLUG === 'object');
+  assert.ok(Array.isArray(composer.KNOWN_FRAMEWORKS) && composer.KNOWN_FRAMEWORKS.length > 0);
+});
+
+// ---------------------------------------------------------------------------
+// 5. the engine / presenter / hooks are NOT touched (only the composer gained the resolver require)
+// ---------------------------------------------------------------------------
+test('navigation-engine.cjs did NOT gain a command-resolver require (the surgical edit is composer-only)', function () {
+  const engineSrc = fs.readFileSync(ENGINE_PATH, 'utf8');
+  assert.ok(!/command-resolver/.test(engineSrc),
+    'navigation-engine.cjs must not require command-resolver (the resolver wiring is in framework-chain-composer.cjs only)');
+  // Sanity: the composer's require IS there (the only file that should have it among these two).
+  const composerSrc = fs.readFileSync(COMPOSER_PATH, 'utf8');
+  assert.ok(/command-resolver/.test(composerSrc));
+});
+
+process.stdout.write('\nnavigation-hook-resolver.test.cjs: ' + passed + ' assertion groups PASSED\n');
+process.exit(0);

package/lib/memory/run-feynman-tests.cjs

@@ -1166,6 +1166,49 @@ const TEST_FILES = [
   path.join(REPO_ROOT, 'tests', 'test-precommit-hook-aliases.cjs'),
   path.join(REPO_ROOT, 'tests', 'test-canon-crossref-completeness.cjs'),
   path.join(REPO_ROOT, 'tests', 'test-part-9-invariant.cjs'),
+  // Phase 109-01 regression: the nodes-provenance migration drops + recreates
+  // every view/trigger that references `nodes` around the table rebuild. Seeds
+  // a room.db with an rs_discoveries-style view (+ a second view + a trigger),
+  // runs the migration, asserts no throw + views/trigger still work + idempotent
+  // re-run. Guards against the phase-109-migration-view-drop-collision bug
+  // (migration used to crash openRoomDb for any room.db carrying the Phase-89
+  // rs_discoveries view: "error in view rs_discoveries: no such table: main.nodes").
+  path.join(REPO_ROOT, 'tests', 'test-navigation-migration-views.cjs'),
+  // Phase 109 SQL Context-Memory Navigation Spine: the 15 test suites that the
+  // Plan 109-00 Task 4 registration originally specified but that a later refactor
+  // dropped from this array before main HEAD (the originals ran via direct
+  // `node tests/test-*.cjs` and `bash tests/run-all.sh` throughout the phase).
+  // Re-registered by Plan 109-12 (bookkeeping reconciliation). Mapping:
+  //   test-navigation-acceptance.cjs                          -> 109-10 (NAV-109-09 load-bearing acceptance gate; zero non-SQLite reads)
+  //   test-navigation-focus.cjs                               -> 109-02 (NAV-109-01 session_focus + auto-focus cascade)
+  //   test-navigation-neighborhood.cjs                        -> 109-04 (NAV-109-02 recursive-CTE ranking correctness)
+  //   test-navigation-perf-10k.cjs                            -> 109-04 (NAV-109-02 perf: cold p95 <200ms / warm <50ms)
+  //   test-navigation-memory-events.cjs                       -> 109-03 (NAV-109-03 closed-15 event enum + findRecentChanges)
+  //   test-navigation-insights.cjs                            -> 109-05 (NAV-109-04 7 insight primitives + templated explanations)
+  //   test-navigation-chokepoint-hook.cjs                     -> 109-06 (NAV-109-05 no direct room-db.cjs imports outside allow-list)
+  //   test-navigation-packet-builder.cjs                      -> 109-07 (NAV-109-06 buildBrainPacket shape per D-06)
+  //   test-navigation-packet-part8-leak.cjs                   -> 109-07 (NAV-109-06 Part 8 JSON.stringify leak tripwires)
+  //   test-brain-ingestion-part-9-invariant.cjs               -> 109-08 (NAV-109-07 storeBrainSuggestions proposed-only + invariant SQL = 0)
+  //   test-room-home-vs-brain-derivation-regression.cjs       -> 109-09 (NAV-109-08 getRoomHomeView + Phase 90 deriveSection regression fence)
+  //   test-canon-part-9-ratification.cjs                      -> 109-11 (NAV-109-09 Canon Part 9 structural assertions)
+  //   test-navigation-migration-idempotent.cjs                -> 109-01 (migration twice = no-op; 12-column nodes schema)
+  //   test-navigation-migration-backfill.cjs                  -> 109-01 (properties JSON backfill + status_aliases mapping)
+  //   test-navigation-migration-coexistence.cjs               -> 109-01 (navigation API + assumptions.validity coexist mid-migration)
+  path.join(REPO_ROOT, 'tests', 'test-navigation-acceptance.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-focus.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-neighborhood.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-perf-10k.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-memory-events.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-insights.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-chokepoint-hook.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-packet-builder.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-packet-part8-leak.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-brain-ingestion-part-9-invariant.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-room-home-vs-brain-derivation-regression.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-canon-part-9-ratification.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-migration-idempotent.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-migration-backfill.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-navigation-migration-coexistence.cjs'),
   // Phase 89-07 Wave 0 (graph-native HARD RULE; ReverseSalientAgent dual-surface).
   path.join(REPO_ROOT, 'tests', 'test-reverse-salient-agent.cjs'),
   path.join(REPO_ROOT, 'tests', 'test-reverse-salient-cascade-emit.cjs'),
@@ -1208,6 +1251,65 @@ const TEST_FILES = [
   path.join(REPO_ROOT, 'lib', 'memory', 'command-registry.test.cjs'),
   // Phase 122-03: the chain recommender (recommendFrameworkChain via FEEDS_INTO).
   path.join(REPO_ROOT, 'lib', 'memory', 'chain-recommender.test.cjs'),
+  // Phase 122-04: the navigation-hook surgical edit (framework-chain-composer
+  // routed through the resolver) + the suggest-next integration test.
+  path.join(REPO_ROOT, 'lib', 'memory', 'navigation-hook-resolver.test.cjs'),
+  path.join(REPO_ROOT, 'lib', 'memory', 'suggest-next-workflow.test.cjs'),
+  // Phase 122-05: the workflow-layer end-to-end test (frontmatter -> registry
+  // --check -> resolver.composeWorkflow(acceptance example) -> the degrade case
+  // -> validateChainAutonomy stop-point) + the Canon Part 8 zero-Brain-mutation
+  // grep sweep.
+  path.join(REPO_ROOT, 'lib', 'memory', 'workflow-layer-e2e.test.cjs'),
+  // Phase 110-00: Brain Context Packet Contract Wave 0 substrate (4 stubs filled by Plans 110-01 / 110-04 / 110-05).
+  //   test-brain-packet-schema-check.cjs              -> 110-01 (PACKET-110-01 + -02: the --check schema tripwire)
+  //   test-brain-packet-validation-per-job.cjs        -> 110-05 (PACKET-110-03 + -04 + -07 + -08: 12-job in/out + privacy + dual-path)
+  //   test-brain-packet-part8-invariant-per-job.cjs   -> 110-05 (PACKET-110-06 round-trip + D-11(d) adversarial sweep)
+  //   test-brain-packet-precommit-hook.cjs            -> 110-04 (PACKET-110-05 D-08 layer-2 hook)
+  path.join(REPO_ROOT, 'tests', 'test-brain-packet-schema-check.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-brain-packet-validation-per-job.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-brain-packet-part8-invariant-per-job.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-brain-packet-precommit-hook.cjs'),
+  // Phase 123 (install-lifecycle-harness) block.
+  //   Plan 123-01: release.sh semver bump algebra + two-commit form + dirty-repo guard + Step 9.5 rename.
+  //     Tests A-E (semver assertions) GREEN immediately; Tests F/G (release.sh
+  //     structural) RED until Plan 123-01 Task 2 rewrites release.sh -- intended RED->GREEN.
+  //   Plan 123-02: install-state record + data/deployment-surfaces.json manifest +
+  //     active-plugin-root.cjs topology classification. Tests 1+4+6 (topology /
+  //     Canon Part 8 / early-write ordering) GREEN after Task 1; Tests 2+3
+  //     (record write hermetic / idempotent re-run) GREEN after Task 2;
+  //     Test 5 (manifest schema) GREEN after Task 3.
+  //   Plan 123-03: doctor classes I (install-state + topology + 6-way version-
+  //     of-record consistency) + J (deployment-surface manifest reconciliation)
+  //     + aggressive --fix (legacy migration backup-verify-remove; never
+  //     touches a dev-clone) + Bug-7 fix (marketplace-cache topology is
+  //     HEALTHY, not drift). Tests RED until Task 2 lands class I + class J
+  //     in scripts/doctor.cjs -- intended RED->GREEN.
+  //   Plan 123-04: doctor --acceptance (release-gate-as-a-command) -- 5-point
+  //     pre-tag checklist + 7-point full checklist + --light-npx opt-in; wired
+  //     into release.sh as hard aborts (Step 6.6 pre-tag, Step 9.6 post-publish);
+  //     scripts/release-beta-smoke.sh retired. Tests RED until Task 2 lands
+  //     --acceptance in scripts/doctor.cjs AND Task 3 wires release.sh + deletes
+  //     release-beta-smoke.sh -- intended RED->GREEN.
+  //   Plan 123-05: cache-prune helper (HARNESS-123-13) + doc/test sweep
+  //     (HARNESS-123-14). 6 hermetic scenarios for pruneMarketplaceCache
+  //     (active + N most-recent kept; corrupt installed_plugins.json -> skip;
+  //     dryRun -> no mutation; belt+suspenders active-dir protection; Canon
+  //     Part 8 grep clean). Tests GREEN after Task 1 lands
+  //     lib/core/cache-prune.cjs.
+  //   Plan 123-07: resolve-brain-key.cjs (HARNESS-123-15) + brain-client.cjs
+  //     getApiKey() delegation (HARNESS-123-16). 9 hermetic scenarios cover
+  //     order (env -> ~/.mindrian.env -> CWD .env -> not-found), SEC-02
+  //     POSIX 0o077 reject, Canon Part 8 zero-network grep, the brain-client
+  //     delegation spy, brain-client preconditions, and the FLAG-3
+  //     env-aware-home structural assertion. rbk.1-6 + rbk.9 GREEN after
+  //     Task 1; rbk.7 + rbk.8 GREEN after Task 2 (brain-client rewire).
+  path.join(REPO_ROOT, 'tests', 'test-release-bump-algebra.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-install-state-record.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-doctor-class-i.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-doctor-class-j.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-doctor-acceptance.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-cache-prune.cjs'),
+  path.join(REPO_ROOT, 'tests', 'test-resolve-brain-key.cjs'),
 ];
 
 // Exit code convention for child tests:

package/lib/memory/security-trifecta.test.cjs

@@ -290,14 +290,31 @@ test('brain-client.cjs has zero legacy .replace(/"/g, ...) injection patterns',
   );
 });
 
-test('brain-client.cjs guards .env reads with checkFilePermissions', () => {
+test('SEC-02 .env gating lives in resolve-brain-key.cjs (Phase 123 Plan-07)', () => {
+  // Phase 123 Plan-07: getApiKey() now delegates to lib/core/resolve-brain-key.cjs,
+  // which owns the SEC-02 POSIX 0o077 permission check for both ~/.mindrian.env
+  // and CWD .env. The brain-client.cjs::checkFilePermissions() helper remains
+  // exported via _test for backward-compat (and unit-test surface above), but
+  // the live gating call sites moved one layer down. The invariant is:
+  //   1. brain-client.cjs requires resolve-brain-key.cjs (delegation lives).
+  //   2. resolve-brain-key.cjs contains the 0o077 mask check (SEC-02 lives).
+  // Both must hold; either failure is a regression that re-introduces the
+  // pre-Plan-07 multiple-resolver disease.
   const brainPath = path.resolve(__dirname, '..', 'core', 'brain-client.cjs');
-  const src = fs.readFileSync(brainPath, 'utf8');
-  const matches = src.match(/checkFilePermissions\s*\(/g) || [];
-  // 1 definition + 2 getApiKey call sites (cwd .env + ~/.mindrian.env) = 3.
+  const resolverPath = path.resolve(__dirname, '..', 'core', 'resolve-brain-key.cjs');
+  const brainSrc = fs.readFileSync(brainPath, 'utf8');
+  const resolverSrc = fs.readFileSync(resolverPath, 'utf8');
   assert.ok(
-    matches.length >= 3,
-    `expected >= 3 checkFilePermissions occurrences, got ${matches.length}`
+    /require\(['"][^'"]*resolve-brain-key[^'"]*['"]\)/.test(brainSrc),
+    'brain-client.cjs must require resolve-brain-key.cjs (Phase 123 Plan-07 delegation)'
+  );
+  assert.ok(
+    /0o077/.test(resolverSrc),
+    'resolve-brain-key.cjs must contain the SEC-02 0o077 mask check'
+  );
+  assert.ok(
+    /process\.platform/.test(resolverSrc),
+    'resolve-brain-key.cjs must short-circuit the SEC-02 check on Windows (process.platform)'
   );
 });
 

package/lib/memory/suggest-next-workflow.test.cjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+'use strict';
+
+/*
+ * Copyright (c) 2026 Mindrian. BSL 1.1.
+ *
+ * Phase 122-04 -- suggest-next-workflow integration test (new suite; registered in the Feynman runner).
+ * ====================================================================================================
+ * The end-to-end check for the Workflow Layer's user-facing slice:
+ *   - a fixture room with a ProblemType -> /mos:suggest-next returns a COMMAND
+ *     SEQUENCE (a step-numbered framework list AND at least one /mos: token),
+ *     and every /mos: it emits exists in data/command-registry.json (no
+ *     hallucinated command);
+ *   - a synthetic chain that includes /mos:hat-briefing -> validateChainAutonomy
+ *     reports it as a blocker (the /mos:act --chain stop point);
+ *   - /mos:pipeline --from-problem-type <x> derives a Brain-derived command
+ *     chain (the helper prints a run order of registered /mos: commands);
+ *   - /mos:act --chain stops at the first non-autonomous_safe step (here,
+ *     /mos:hat-briefing for Six Thinking Hats).
+ *
+ * Hermetic: a tmp room dir + a STATE.md with "Problem Type: ill-defined" (no
+ * network -- recommendFrameworkChain degrades to [seed] without offline edges,
+ * and that seed is what the room's ProblemType maps to via problem-type-router).
+ *
+ * Registered in lib/memory/run-feynman-tests.cjs TEST_FILES[] and in
+ * tests/run-all-122.sh CJS_SUITES (as ../lib/memory/suggest-next-workflow.test.cjs).
+ * Run: node lib/memory/suggest-next-workflow.test.cjs
+ * Exit 0 on pass; throws (node:assert) on any fail.
+ */
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const REGISTRY_PATH = path.join(REPO_ROOT, 'data', 'command-registry.json');
+const SUGGEST_SCRIPT = path.join(REPO_ROOT, 'scripts', 'suggest-next-command.cjs');
+const PIPELINE_SCRIPT = path.join(REPO_ROOT, 'scripts', 'pipeline-command.cjs');
+const ACT_SCRIPT = path.join(REPO_ROOT, 'scripts', 'act-command.cjs');
+
+const resolver = require('../workflow/command-resolver.cjs');
+const recommender = require('../brain/chain-recommender.cjs');
+
+const registry = JSON.parse(fs.readFileSync(REGISTRY_PATH, 'utf8'));
+const REGISTERED_COMMANDS = new Set((registry.commands || []).map(function (c) { return c && c.command; }));
+
+let passed = 0;
+function test(name, fn) {
+  fn();
+  process.stdout.write('  ok  ' + name + '\n');
+  passed += 1;
+}
+
+// Extract /mos:... tokens from a string.
+function extractCommands(text) {
+  const m = String(text).match(/\/mos:[a-z][a-z0-9-]*/g);
+  return m ? m.slice() : [];
+}
+
+// A fixture room: a tmp dir with a STATE.md carrying a ProblemType line.
+function makeFixtureRoom(problemTypeLine) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'p122-04-suggest-'));
+  const roomDir = path.join(root, 'room');
+  fs.mkdirSync(roomDir, { recursive: true });
+  fs.writeFileSync(path.join(roomDir, 'STATE.md'),
+    '# Room State\n\n' + problemTypeLine + '\n\nStage: discovery\n');
+  return { root: root, roomDir: roomDir };
+}
+function rmFixture(fx) { try { fs.rmSync(fx.root, { recursive: true, force: true }); } catch (_e) {} }
+
+// ---------------------------------------------------------------------------
+// 1. fixture room with a ProblemType -> /mos:suggest-next returns a command SEQUENCE
+// ---------------------------------------------------------------------------
+test('a fixture room with a ProblemType -> /mos:suggest-next prints a step-numbered command sequence; every /mos: is registered', function () {
+  const fx = makeFixtureRoom('Problem Type: ill-defined');
+  try {
+    const res = spawnSync(process.execPath, [SUGGEST_SCRIPT, '--room', fx.roomDir], { encoding: 'utf8' });
+    assert.strictEqual(res.status, 0, 'suggest-next-command.cjs exits 0; stderr: ' + (res.stderr || ''));
+    const out = res.stdout || '';
+    // It is a SEQUENCE: a "Command sequence" header + a step-numbered list + at least one /mos: token.
+    assert.ok(/command sequence/i.test(out), 'output names a command sequence; got:\n' + out);
+    assert.ok(/^\s*\d+\.\s/m.test(out), 'output has a step-numbered list; got:\n' + out);
+    assert.ok(/recommended framework chain/i.test(out), 'output shows the framework chain too');
+    const cmds = extractCommands(out);
+    assert.ok(cmds.length >= 1, 'output emits at least one /mos: command; got:\n' + out);
+    // Every /mos: it emits in the SEQUENCE/chain is a registered command (the
+    // footer cross-references /mos:status, /mos:pipeline -- also registered).
+    for (const c of cmds) {
+      assert.ok(REGISTERED_COMMANDS.has(c), 'emitted command must exist in data/command-registry.json: ' + c + '\nfull output:\n' + out);
+    }
+    // And the methodology command in the sequence is the resolver's answer for
+    // the IDP seed framework -- not a hallucinated one (in particular, NOT
+    // /mos:jtbd, which does not exist).
+    assert.ok(!/\/mos:jtbd\b/.test(out), 'must not emit the non-existent /mos:jtbd');
+  } finally {
+    rmFixture(fx);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 2. direct: recommendFrameworkChain + composeWorkflow for the IDP room state
+// ---------------------------------------------------------------------------
+test('recommendFrameworkChain({roomState:{problemType:"ill-defined"}}) -> composeWorkflow -> a chain of registered commands (no hallucination)', function () {
+  const chain = recommender.recommendFrameworkChain({ roomState: { problemType: 'ill-defined' } });
+  assert.ok(Array.isArray(chain) && chain.length >= 1, 'a non-empty framework chain');
+  const wf = resolver.composeWorkflow(chain);
+  assert.ok(Array.isArray(wf) && wf.length === chain.length);
+  wf.forEach(function (s, i) {
+    assert.strictEqual(s.step, i + 1);
+    assert.ok('framework' in s && 'command' in s && 'optional' in s);
+    if (s.command !== null) {
+      assert.ok(typeof s.command === 'string' && s.command.indexOf('/mos:') === 0);
+      assert.ok(REGISTERED_COMMANDS.has(s.command), 'composeWorkflow only ever yields registered commands: ' + s.command);
+    } else {
+      assert.strictEqual(s.optional, true, 'a command-less step is marked optional (run it manually)');
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 3. a synthetic chain including /mos:hat-briefing -> validateChainAutonomy flags it
+// ---------------------------------------------------------------------------
+test('a synthetic chain that includes /mos:hat-briefing -> validateChainAutonomy reports it as a blocker (the /mos:act --chain stop point)', function () {
+  // Six Thinking Hats resolves to /mos:hat-briefing (autonomous_safe: false in
+  // the registry) as its first command -- so a chain through it is the stop point.
+  const sixHatsCmds = resolver.commandsForFramework('Six Thinking Hats');
+  assert.ok(sixHatsCmds.length > 0 && sixHatsCmds[0] === '/mos:hat-briefing',
+    'Six Thinking Hats resolves to /mos:hat-briefing first; got: ' + JSON.stringify(sixHatsCmds));
+  const wf = resolver.composeWorkflow(['Beautiful Question Framework', 'Six Thinking Hats']);
+  const report = resolver.validateChainAutonomy(wf);
+  assert.strictEqual(report.runnable, false, 'a chain with /mos:hat-briefing is not fully runnable');
+  assert.ok(Array.isArray(report.blockers) && report.blockers.length >= 1);
+  const blocked = report.blockers.find(function (b) { return b && b.command === '/mos:hat-briefing'; });
+  assert.ok(blocked, 'the blocker names /mos:hat-briefing; report: ' + JSON.stringify(report));
+  assert.strictEqual(blocked.step, 2, 'the blocker is step 2 (the second step in the chain)');
+  // Step 1 (/mos:beautiful-question, autonomous_safe) is NOT a blocker.
+  assert.ok(!report.blockers.some(function (b) { return b && b.step === 1; }), 'step 1 is autonomous_safe -- not a blocker');
+});
+
+// ---------------------------------------------------------------------------
+// 4. /mos:pipeline --from-problem-type ill-defined prints a Brain-derived command chain
+// ---------------------------------------------------------------------------
+test('/mos:pipeline --from-problem-type ill-defined prints a run order of registered /mos: commands', function () {
+  const res = spawnSync(process.execPath, [PIPELINE_SCRIPT, '--from-problem-type', 'ill-defined'], { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, 'pipeline-command.cjs exits 0; stderr: ' + (res.stderr || ''));
+  const out = res.stdout || '';
+  assert.ok(/brain-derived framework chain/i.test(out), 'output names the Brain-derived chain; got:\n' + out);
+  assert.ok(/run order/i.test(out), 'output shows a run order; got:\n' + out);
+  const cmds = extractCommands(out);
+  assert.ok(cmds.length >= 1, 'output emits at least one /mos: command');
+  for (const c of cmds) {
+    assert.ok(REGISTERED_COMMANDS.has(c), 'pipeline run-order command must be registered: ' + c + '\nfull output:\n' + out);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// 5. /mos:act --chain --from-framework "Six Thinking Hats" stops at the first non-autonomous step
+// ---------------------------------------------------------------------------
+test('/mos:act --chain stops at the first non-autonomous_safe step (Six Thinking Hats -> /mos:hat-briefing)', function () {
+  const res = spawnSync(process.execPath, [ACT_SCRIPT, '--chain', '--from-framework', 'Six Thinking Hats'], { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, 'act-command.cjs exits 0; stderr: ' + (res.stderr || ''));
+  const out = res.stdout || '';
+  assert.ok(/\[GATE\]/.test(out), 'output renders a needs-you-here gate; got:\n' + out);
+  assert.ok(/not autonomous_safe/i.test(out), 'the gate cites the autonomy reason');
+  assert.ok(/\/mos:hat-briefing/.test(out), 'the gate names /mos:hat-briefing (the stop point)');
+  assert.ok(/runnable:\s*false/i.test(out), 'validateChainAutonomy reported runnable=false');
+  // Every /mos: it prints is registered.
+  for (const c of extractCommands(out)) {
+    assert.ok(REGISTERED_COMMANDS.has(c), 'act --chain command must be registered: ' + c + '\nfull output:\n' + out);
+  }
+});
+
+process.stdout.write('\nsuggest-next-workflow.test.cjs: ' + passed + ' assertion groups PASSED\n');
+process.exit(0);