@bongos/core 1.18.3 → 1.18.19

package/tests/publish_branch_route.mjs

@@ -225,6 +225,47 @@ await t('getPublishStatus: no PR for the head → none', async () => {
   assert.equal(s.deploy_status, 'none');
 });
 
+// task 1002472 — an instance with NO deploy-prod.yml must not wait on it forever.
+// The 404 is unambiguous: the /pulls fetch above already threw if the repo were
+// unreachable, so a 404 HERE means the workflow file is absent — permanent, not
+// transient. Anything else (5xx/403/network) stays 'pending' so a real deploy is
+// still waited on.
+await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deploy-prod.yml)', async () => {
+  const mergeSha = 'd'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(404, { message: 'Not Found' });
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.merged, true);
+  assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
+});
+
+await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (transient stays transient)', async () => {
+  const mergeSha = 'e'.repeat(40);
+  const mk = (code) => async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(code, { message: 'nope' });
+    throw new Error('unexpected ' + url);
+  };
+  for (const code of [500, 502, 403]) {
+    const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
+    assert.equal(s.deploy_status, 'pending', `${code} must NOT be read as "no workflow"`);
+  }
+});
+
+await t('getPublishStatus: merged, workflow EXISTS but no successful run yet → pending', async () => {
+  const mergeSha = 'f'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(200, { workflow_runs: [{ head_sha: mergeSha, status: 'in_progress', conclusion: null }] });
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending', 'a real deploy in flight is still waited on');
+});
+
 // ===========================================================================
 // Layer 2 — STRUCTURAL guard: the publish routes are requireBuilder and carry
 // NO allowBoxScope (so a box-scoped session is denied — #919 regression guard).
@@ -418,5 +459,17 @@ await t('landConfirmed: true ONLY when merged AND deploy-prod succeeded', async
   assert.equal(gp.landConfirmed({}), false);
 });
 
+// task 1002472 — an instance that deploys by pin-bump (package-core → bongos
+// upgrade, ADR 0108) has no deploy-prod.yml to succeed. Waiting on one pins every
+// merged PR at 'pending' forever. MERGED is still mandatory: 'unconfigured' relaxes
+// only the deploy half, and landProvenForTask still has to prove the land is THIS
+// task's before anything ships.
+await t('landConfirmed: unconfigured deploy counts as landed, but ONLY when merged', async () => {
+  assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'unconfigured' }), true, 'no deploy workflow → the merge IS the land');
+  assert.equal(gp.landConfirmed({ merged: false, deploy_status: 'unconfigured' }), false, 'not merged → never a land');
+  assert.equal(gp.landConfirmed({ pr_state: 'open', merged: false, deploy_status: 'unconfigured' }), false);
+  assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'none' }), false, 'none ≠ unconfigured — no PR at all is not a land');
+});
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);

package/tests/publish_reconciler.mjs

@@ -58,11 +58,14 @@ function mkDeps({
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], logs: [], errors: [] };
-  const realLandConfirmed = (s) => !!s && s.merged === true && s.deploy_status === 'success';
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
+  // task 1002472: this was a hand-rolled copy of landConfirmed's rule, so a change to
+  // the real gate could not fail this suite. Use the real one — the whole point of a
+  // sweep test is that it exercises the sweep's ACTUAL land decision.
+  const realLandConfirmed = githubPush.landConfirmed;
   return {
     db: {
       listConfirmedTasksForReconcile: async () => rows,
@@ -70,6 +73,12 @@ function mkDeps({
         calls.ship.push({ taskId, builderId });
         return { id: taskId, value_summary: `task ${taskId}`, security_sensitive: false };
       }),
+      // ADR 0120 part 2: the reconciler flags an unlandable confirmed task for
+      // its builder. Recording spy — returns true (newly flagged) by default.
+      flagTaskNeedsRebase: async (taskId, reason) => {
+        calls.flag.push({ taskId, reason });
+        return true;
+      },
     },
     githubPush: {
       isConfigured: () => configured,
@@ -175,6 +184,29 @@ test('a landed branch → shipTask + broadcast fire, reconciled=1, attributed to
   assert.deepEqual(deps._calls.broadcast, [1096]);
 });
 
+test('ADR 0120: an aged-out unprovable strand → flagged needs_rebase for its builder, NOT shipped', async () => {
+  // No branch, no published tip, confirmed long ago → unprovable + stale.
+  const deps = mkDeps({
+    rows: [{ task_id: 700, builder_id: 25, worktree_name: null, published_head_sha: null,
+             confirmed_at: '2020-01-01T00:00:00Z' }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a strand does not ship');
+  assert.equal(deps._calls.ship.length, 0, 'shipTask must not run for an unlandable strand');
+  assert.equal(deps._calls.flag.length, 1, 'the strand is flagged needs_rebase exactly once');
+  assert.equal(deps._calls.flag[0].taskId, 700, 'flagged the right task');
+  assert.match(deps._calls.flag[0].reason, /^strand:/, "reason records it as a strand (attribution is shipped_by = claim holder)");
+});
+
+test('ADR 0120: a recent unprovable confirmed task is NOT yet flagged (still within the land grace)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 701, builder_id: 25, worktree_name: null, published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'a fresh confirmed task is given its grace before needs_rebase');
+});
+
 test('a not-yet-landed branch (open PR / pending deploy) → no ship', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 5, builder_id: 1, worktree_name: 'wt-open' }],
@@ -195,6 +227,86 @@ test('merged but deploy NOT yet success → no ship (landConfirmed requires both
   assert.equal(r.reconciled, 0);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002472 — the sweep's give-up path must never be silent again.
+//
+// The `continue` that fired when a PR existed but had not fully landed sat BEFORE
+// the unprovable counter, the STALE WARN, and flagTaskNeedsRebase — so a merged-PR
+// task strand produced no log line, no counter, and no flag. That is why tasks
+// 1002427/1002428 sat 50h at 'confirmed' reporting needs_rebase: false.
+// ---------------------------------------------------------------------------
+test('1002472 an un-landed PR is COUNTED in unprovable, not silently skipped', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 60, builder_id: 1, worktree_name: 'wt-openpr',
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-openpr': PENDING },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'still must not ship an open PR');
+  assert.equal(deps._calls.ship.length, 0);
+  assert.equal(r.unprovable, 1, 'the miss is counted — this was the silent continue');
+});
+
+test('1002472 an AGED un-landed PR gets the STALE WARN + needs_rebase flag', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString(); // 50h, like 1002427/1002428
+  const deps = mkDeps({
+    rows: [{ task_id: 61, builder_id: 7, worktree_name: 'wt-stale-pr', confirmed_at: old }],
+    statusByBranch: { 'claude/wt-stale-pr': { ...LANDED, deploy_status: 'pending' } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a pending deploy still never ships');
+  assert.equal(r.staleStrands, 1, 'an aged merged-but-unlanded task is a strand');
+  assert.deepEqual(deps._calls.flag, [{ taskId: 61, reason: 'strand:pr_not_landed' }]);
+  assert.ok(
+    deps._calls.errors.some((e) => /STRAND task 61/.test(e)),
+    'the strand must be WARN\'d, not swallowed'
+  );
+});
+
+test('1002472 an un-landed PR does NOT ship even when the PR body references the task', async () => {
+  // The guard that matters: falling through to the observability block must not let
+  // landProvenForTask's no-published-tip fallback ship a PR that is still OPEN.
+  const deps = mkDeps({
+    rows: [{ task_id: 62, builder_id: 1, worktree_name: 'wt-open-selfref',
+             published_head_sha: null, confirmed_at: new Date().toISOString() }],
+    statusByBranch: {
+      'claude/wt-open-selfref': { ...PENDING, pr_number: 9, pr_title: 'task 62: x', pr_body: 'for task 62' },
+    },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.ship.length, 0, 'an OPEN PR referencing this task is still NOT a land');
+  assert.equal(r.unprovable, 1);
+});
+
+// ---------------------------------------------------------------------------
+// task 1002472 — an instance with no deploy-prod.yml (deploy_status 'unconfigured')
+// lands on the merge alone, but STILL only with per-task proof (task 1547).
+// ---------------------------------------------------------------------------
+const LANDED_NO_WORKFLOW = { ...LANDED, deploy_status: 'unconfigured' };
+
+test('1002472 merged + deploy unconfigured + published tip in main → ships', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 63, builder_id: 4, worktree_name: 'wt-nowf', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-nowf': LANDED_NO_WORKFLOW },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'no deploy workflow must not pin a real land at confirmed forever');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 63, builderId: 4 }]);
+  assert.deepEqual(deps._calls.broadcast, [63]);
+});
+
+test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547 proof intact)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 64, builder_id: 4, worktree_name: 'wt-nowf-reuse', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-nowf-reuse': LANDED_NO_WORKFLOW },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'relaxing the deploy gate must NOT relax the branch-reuse proof');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 test('getPublishStatus throws (transient) → swallowed, sweep continues to the next task', async () => {
   const deps = mkDeps({
     rows: [
@@ -721,6 +833,79 @@ test('1915 the heal path never runs when the module lacks refreshStaleGenerated
   assert.equal(r.refreshedStale, 0, 'a missing heal fn is a clean no-op, not a crash');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002461 — the silent-poller cure.
+//
+// runSweep's no-credential path returned {skipped:'unconfigured'} with NO log,
+// while start() unconditionally logged "started — sweeping confirmed→shipped
+// every Ns". The journal therefore showed a healthy poller that could never do
+// anything, and the stranding went unnoticed for 6+ days. Two fixes: say so
+// (once — per-tick would be spam), and name the RESOLVED owner/repo so a WRONG
+// repo bind is visible without owner access.
+// ---------------------------------------------------------------------------
+const REPO_OK = { owner: 'lars589', repo: 'cloud-bongos', branch: 'main' };
+const REPO_ERR = { error: 'no_repo_info', detail: 'git remote origin not parseable' };
+
+test('1002461 describeTarget names the resolved owner/repo and the credential state', () => {
+  const s = reconciler.describeTarget({ configured: true, repo: REPO_OK });
+  assert.match(s, /lars589\/cloud-bongos/, 'the resolved repo must be visible');
+  assert.match(s, /main/);
+  assert.match(s, /credential present/i);
+});
+
+test('1002461 describeTarget shouts when there is no credential', () => {
+  const s = reconciler.describeTarget({ configured: false, repo: REPO_OK });
+  assert.match(s, /NO PUSH CREDENTIAL/, 'the missing credential must be unmissable');
+  assert.match(s, /lars589\/cloud-bongos/, 'still names the repo — a wrong bind and a missing credential are separate faults');
+});
+
+test('1002461 describeTarget reports an unresolved repo instead of pretending', () => {
+  const s = reconciler.describeTarget({ configured: true, repo: REPO_ERR });
+  assert.match(s, /UNRESOLVED/);
+  assert.match(s, /git remote origin not parseable/, 'the detail is what makes it diagnosable');
+});
+
+// warnState is injected per test for the same reason healAttempts is: these tests
+// run concurrently, so a shared module-level latch would leak across them.
+test('1002461 an unconfigured sweep WARNs — the skip is no longer silent', async () => {
+  const deps = mkDeps({ configured: false, rows: [{ task_id: 1, builder_id: 9, worktree_name: 'wt' }] });
+  Object.assign(deps, { repoInfo: REPO_OK, warnState: { unconfigured: false } });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.skipped, 'unconfigured', 'still a no-op — this task only adds the log');
+  assert.equal(deps._calls.errors.length, 1, 'the skip must say so');
+  assert.match(deps._calls.errors[0], /NO PUSH CREDENTIAL/);
+  assert.match(deps._calls.errors[0], /lars589\/cloud-bongos/, 'names the repo it would have used');
+});
+
+test('1002461 the unconfigured WARN fires ONCE, not once per tick (no log spam)', async () => {
+  const deps = mkDeps({ configured: false, rows: [] });
+  Object.assign(deps, { repoInfo: REPO_OK, warnState: { unconfigured: false } });
+  await reconciler.runSweep(deps);
+  await reconciler.runSweep(deps);
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.errors.length, 1, '3 sweeps → 1 WARN; a 5-min poller would otherwise spam the journal');
+});
+
+test('1002461 the WARN re-arms once a credential appears and then disappears again', async () => {
+  const shared = { unconfigured: false }; // one latch across the three sweeps, as in production
+  const bad = mkDeps({ configured: false, rows: [] });
+  Object.assign(bad, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(bad);
+  assert.equal(bad._calls.errors.length, 1);
+
+  // credential arrives → a sweep proceeds; the warn must re-arm so a LATER loss
+  // is reported instead of being swallowed by the first one.
+  const good = mkDeps({ configured: true, rows: [] });
+  Object.assign(good, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(good);
+  assert.equal(shared.unconfigured, false, 'a healthy sweep re-arms the latch');
+
+  const badAgain = mkDeps({ configured: false, rows: [] });
+  Object.assign(badAgain, { repoInfo: REPO_OK, warnState: shared });
+  await reconciler.runSweep(badAgain);
+  assert.equal(badAgain._calls.errors.length, 1, 'a credential LOSS after a healthy period must warn again');
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);

package/tests/repo_info_binding.mjs

@@ -0,0 +1,248 @@
+// tests/repo_info_binding.mjs
+//
+// Unit tests for src/bongos/repo-info.js — which GitHub repo this instance binds.
+//
+// loadFromGit ran `git remote get-url origin` with cwd = path.resolve(__dirname,'..','..').
+// In the core dev checkout that is the repo root and the answer is right. On a live
+// instance under ADR 0140 the hub runs from node_modules/@bongos/core, which is NOT a git
+// repo, so git discovery walked UP the filesystem, found the INSTANCE repo, and returned
+// its origin — silently binding a repo whose every API call 404s.
+//
+// This file had NO predecessor — repo-info.js shipped with zero test coverage, which is
+// how the misbind survived. Every case injects the exec seam, so they run with no git and
+// no network; the one end-to-end canary at the bottom is explicitly guarded and skips
+// when git is unavailable (a container / git-less CI runner).
+//
+// Run:  node tests/repo_info_binding.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ri = require('../src/bongos/repo-info.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// Neutral fixture identity. Implementation code under tests/ must not hardcode any real
+// owner's identity (V3.R12, enforced by scripts/gds/audit-authorship.sh) — and the
+// assertions care only that the parsed pair round-trips, so a synthetic pair is strictly
+// better.
+const FIXTURE_OWNER = 'testowner';
+const FIXTURE_REPO = 'test-repo';
+const REMOTE = `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}.git\n`;
+
+// A scripted `git` — returns whatever the scenario says for each subcommand, and
+// records the cwd every call was made with so we can prove the probe is anchored.
+function mkExec({ toplevel, remote = REMOTE, throwOn = null }) {
+  const calls = [];
+  const exec = (cmd, opts) => {
+    calls.push({ cmd, cwd: opts && opts.cwd });
+    if (throwOn && cmd.includes(throwOn)) throw new Error('git not available');
+    if (cmd.includes('rev-parse')) {
+      if (toplevel == null) throw new Error('not a git repository');
+      return `${toplevel}\n`;
+    }
+    if (cmd.includes('remote get-url')) return remote;
+    throw new Error(`unexpected git call: ${cmd}`);
+  };
+  exec.calls = calls;
+  return exec;
+}
+
+// ---- the case that WORKS today and must not regress ------------------------
+
+test('package root IS the repo root → binds that remote (the core dev checkout)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root });
+  assert.deepEqual(ri.loadFromGit({ execSync, packageRoot: root }), {
+    owner: FIXTURE_OWNER,
+    repo: FIXTURE_REPO,
+  });
+});
+
+test('a git worktree of the core checkout still binds (toplevel == the probed root)', () => {
+  const root = path.resolve('/srv/cloud-bongos/.claude/worktrees/task-1');
+  const execSync = mkExec({ toplevel: root });
+  assert.ok(ri.loadFromGit({ execSync, packageRoot: root }), 'a worktree must keep working');
+});
+
+// ---- the bug ---------------------------------------------------------------
+
+test('B2: toplevel is an ANCESTOR of the probed root → REFUSES to bind', () => {
+  // The live shape: probing node_modules/@bongos/core, git walks up to the instance repo.
+  const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+  const execSync = mkExec({ toplevel: path.resolve('/srv/instance') });
+  assert.equal(
+    ri.loadFromGit({ execSync, packageRoot: root }),
+    null,
+    'a repo found by walking OUT of our own package is not our repo'
+  );
+  assert.ok(
+    !execSync.calls.some((c) => c.cmd.includes('remote get-url')),
+    'must not even ask for the remote once the anchor check fails'
+  );
+});
+
+test('B2: the probe is anchored at the package root, not process.cwd()', () => {
+  const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+  const execSync = mkExec({ toplevel: root });
+  ri.loadFromGit({ execSync, packageRoot: root });
+  assert.ok(execSync.calls.length > 0);
+  for (const c of execSync.calls) {
+    assert.equal(c.cwd, root, 'every git call must be pinned to the probed root');
+  }
+});
+
+// ---- path normalization ----------------------------------------------------
+
+test('git\'s forward slashes match a Windows backslash root (same directory)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  // git prints POSIX separators even on Windows.
+  const execSync = mkExec({ toplevel: root.split(path.sep).join('/') });
+  assert.ok(
+    ri.loadFromGit({ execSync, packageRoot: root }),
+    'separator style must not be read as a different directory'
+  );
+});
+
+test('a trailing newline/whitespace from git does not break the comparison', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = (cmd) => {
+    if (cmd.includes('rev-parse')) return `  ${root}  \n\n`;
+    return REMOTE;
+  };
+  assert.ok(ri.loadFromGit({ execSync, packageRoot: root }));
+});
+
+if (process.platform === 'win32') {
+  test('win32: drive-letter/case differences still match (case-insensitive FS)', () => {
+    const root = path.resolve('C:/Srv/Cloud-Bongos');
+    const execSync = mkExec({ toplevel: 'c:/srv/cloud-bongos' });
+    assert.ok(ri.loadFromGit({ execSync, packageRoot: root }), 'win32 paths are case-insensitive');
+  });
+} else {
+  test('posix: case differences are DIFFERENT directories (case-sensitive FS)', () => {
+    const root = path.resolve('/srv/cloud-bongos');
+    const execSync = mkExec({ toplevel: '/srv/Cloud-Bongos' });
+    assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+  });
+}
+
+// ---- failure modes that must stay unchanged --------------------------------
+
+test('git absent / rev-parse throws → null (unchanged, caught)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  assert.equal(ri.loadFromGit({ execSync: mkExec({ toplevel: null }), packageRoot: root }), null);
+});
+
+test('remote get-url throws after a good anchor → null (unchanged, caught)', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root, throwOn: 'remote get-url' });
+  assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+});
+
+test('an unparseable remote → null', () => {
+  const root = path.resolve('/srv/cloud-bongos');
+  const execSync = mkExec({ toplevel: root, remote: 'not-a-remote\n' });
+  assert.equal(ri.loadFromGit({ execSync, packageRoot: root }), null);
+});
+
+// ---- loadRepoInfo: precedence + the diagnosable failure --------------------
+
+test('the env pin still WINS over git (unchanged precedence)', () => {
+  ri._resetCacheForTests();
+  process.env.OTB_GITHUB_OWNER = 'envowner';
+  process.env.OTB_GITHUB_REPO = 'envrepo';
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({ execSync: mkExec({ toplevel: root }), packageRoot: root });
+    assert.equal(info.owner, 'envowner');
+    assert.equal(info.repo, 'envrepo');
+  } finally {
+    delete process.env.OTB_GITHUB_OWNER;
+    delete process.env.OTB_GITHUB_REPO;
+    ri._resetCacheForTests();
+  }
+});
+
+test('B2: a packaged instance with no env pin reports an ERROR, not a wrong repo', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }),
+      packageRoot: root,
+    });
+    assert.equal(info.error, 'no_repo_info', 'an explicit error is diagnosable; a wrong repo 404s silently');
+    assert.equal(info.owner, undefined, 'must not hand back the instance repo it walked up into');
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('a good bind still produces the blob/tree bases callers rely on', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({ execSync: mkExec({ toplevel: root }), packageRoot: root });
+    const base = `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}`;
+    assert.equal(info.blob_base, `${base}/blob/main`);
+    assert.equal(info.tree_base, `${base}/tree/main`);
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+// ---- end-to-end canary: the regression this must never cause ---------------
+//
+// The only case that touches real git. It earns its place — an anchor rule that is too
+// TIGHT would bind nothing at all, and every hermetic case above would still pass. But it
+// cannot be unconditional: a git-less CI runner or container has nothing to check, so it
+// is guarded and skips rather than failing for an unrelated reason.
+
+function gitAvailableHere() {
+  try {
+    execSync('git rev-parse --show-toplevel', {
+      cwd: path.resolve(fileURLToPath(import.meta.url), '..', '..'),
+      encoding: 'utf8',
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+if (gitAvailableHere()) {
+  test('CANARY (real git): this checkout still binds itself — the rule is not over-tight', () => {
+    ri._resetCacheForTests();
+    try {
+      const info = ri.loadRepoInfo();
+      assert.ok(!info.error, `the core checkout must still resolve, got ${JSON.stringify(info)}`);
+      assert.ok(info.owner && info.repo, 'owner/repo must be present in a normal dev checkout');
+    } finally {
+      ri._resetCacheForTests();
+    }
+  });
+} else {
+  console.log('  skip  CANARY (real git): no git available here — hermetic cases above still cover the rule');
+}
+
+console.log(`\nrepo-info binding tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/reward_gate.mjs

@@ -138,7 +138,12 @@ const migration178 = readFileSync(join(root, 'migrations/178_reward_gate_auto_as
 t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)', () => {
   const start = tasksRouteSrc.indexOf("router.post('/tasks/:id/promote'");
   assert.ok(start >= 0, 'promote route not found');
-  const body = tasksRouteSrc.slice(start, start + 1600);
+  // Slice to the START OF THE NEXT ROUTE, not a fixed byte window: /promote grew a
+  // second source state (abandoned → backlog, ADR 0152) and a fixed 1600-char slice
+  // silently cut the ready flip out of view, failing the ordering assert below for a
+  // reason that had nothing to do with the reward gate.
+  const nextRoute = tasksRouteSrc.indexOf('router.post(', start + 1);
+  const body = tasksRouteSrc.slice(start, nextRoute > start ? nextRoute : undefined);
   assert.match(body, /rewardGateAssignment/, 'promote route must consult the auto-assign decision');
   assert.match(body, /setCreditsReward/, 'promote route must persist the assigned reward');
   // it must assign BEFORE flipping to ready, and still flip to ready.
@@ -154,7 +159,11 @@ t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)'
 t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', () => {
   const start = dbSrc.indexOf('async function claimTask');
   assert.ok(start >= 0, 'claimTask not found');
-  const body = dbSrc.slice(start, start + 5000);
+  // The window is a slice heuristic, not a contract: it only has to cover the
+  // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
+  // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
+  // past the old edge. Keep it comfortably below the claimTasksBatch boundary.
+  const body = dbSrc.slice(start, start + 6000);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.