@bongos/core 1.19.1033 → 1.19.1035

package/src/build-info.js

@@ -8,13 +8,15 @@
 // deployedCommit === mergeCommit before flipping a task to shipped.
 //
 // Resolution order (resolveCommit is pure + exported for the test):
-//   1. env OTB_GIT_SHA  — set by ~/deploy.sh at restart if/when it chooses to;
+//   1. env <PREFIX>_GIT_SHA (BONGOS_GIT_SHA on a vanilla instance; the legacy
+//      OTB_GIT_SHA is still read) — set by ~/deploy.sh at restart if/when it chooses to;
 //      authoritative + cheap, and survives a checkout with no usable .git.
 //   2. `git rev-parse HEAD` in the checkout — accurate after deploy.sh's
 //      `git reset --hard origin/main`.
 //   3. null — unknown (callers must degrade gracefully, never hard-fail).
 
 const { execSync } = require('node:child_process');
+const { resolveEnv } = require('./instance-config');
 
 const SHA_RE = /^[0-9a-f]{7,40}$/i;
 
@@ -62,7 +64,7 @@ let _cache = null;
 // restarts the service), so caching is correct and keeps /version allocation-free.
 function buildInfo() {
   if (_cache) return _cache;
-  const fromEnv = resolveCommit({ envSha: process.env.OTB_GIT_SHA });
+  const fromEnv = resolveCommit({ envSha: resolveEnv('GIT_SHA') });
   const commit = fromEnv || resolveCommit({ gitSha: readGitSha() });
   _cache = {
     commit,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1033'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1035'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/adr_0089_scope.mjs

@@ -0,0 +1,70 @@
+// tests/adr_0089_scope.mjs — ADR 0089 §8 names what the grading engine does NOT own,
+// and this file keeps that list true (task 1002844).
+//
+// WHY. Four surfaces spend model tokens on the repository or guard the pipeline,
+// so a reader planning the engine can take them for graders: the BFG session
+// evaluator, gate-review, main-audit and the Architect audit. §8 records, for each,
+// exactly what it shares with the grader. A prose boundary rots the moment one of
+// them quietly starts calling grading code, so the coupling the ADR states is
+// asserted from the source: the Architect uses exactly the three plumbing helpers
+// §8 names, and the other three import no grading module at all.
+//
+// Run:  node tests/adr_0089_scope.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const read = (rel) => fs.readFileSync(new URL(`../${rel}`, import.meta.url), 'utf8');
+const adr = read('docs/adr/0089-modular-multi-model-adversarial-grader.md');
+const section = adr.slice(adr.indexOf('### 8. Scope: what the engine does NOT own'), adr.indexOf('## Consequences'));
+
+const SURFACES = [
+  'scripts/gds/session-eval.js',
+  'scripts/gds/gate-review.js',
+  'scripts/gds/main-audit.js',
+  'scripts/gds/architect-audit.js',
+];
+
+test('ADR 0089 carries the §8 scope section, before Consequences', () => {
+  assert.ok(adr.includes('### 8. Scope: what the engine does NOT own'), 'the section heading');
+  assert.ok(section.length > 200, 'the section sits between §7 and Consequences');
+});
+
+test('§8 names each of the four surfaces by path, and each path exists', () => {
+  for (const p of SURFACES) {
+    assert.ok(section.includes(p), `§8 names ${p}`);
+    assert.ok(fs.existsSync(new URL(`../${p}`, import.meta.url)), `${p} exists`);
+  }
+});
+
+test('the Architect uses exactly the three grader helpers §8 names — nothing from the grade path', () => {
+  // Code only: a comment that mentions grader.<thing> is not a call.
+  const src = read('scripts/gds/architect-audit.js').replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+  const used = [...new Set([...src.matchAll(/\bgrader\.([A-Za-z_]\w*)/g)].map((m) => m[1]))].sort();
+  assert.deepEqual(used, ['extractAssistantResult', 'extractJson', 'runSubagentCached'],
+    'a new grader.* call from the Architect means §8 is out of date');
+  for (const name of used) assert.ok(section.includes(name), `§8 names ${name}`);
+});
+
+test('session-eval, gate-review and main-audit import no grading module', () => {
+  for (const p of SURFACES.filter((s) => !s.endsWith('architect-audit.js'))) {
+    assert.doesNotMatch(read(p), /require\([^)]*modules\/grading/, `${p} must not require grading code`);
+  }
+});
+
+test('main-audit and gate-review share only the rank-permission checker §8 names', () => {
+  for (const p of ['scripts/gds/main-audit.js', 'scripts/gds/gate-review.js']) {
+    assert.match(read(p), /permission-path-check/, `${p} reads the checker`);
+  }
+  assert.ok(section.includes('src/bongos/permission-path-check.js'), '§8 names the shared checker');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/autobongos_cadence.mjs

@@ -600,3 +600,77 @@ test('the suite never reads the real heartbeat file', () => {
   // writing right now.
   assert.match(runner.heartbeatPath(), /ab-cadence-/, 'the suite must point at a throwaway path, not the real one');
 });
+
+// --- a worker that never RAN is breakage, not quiet (task 1004179) ----------
+//
+// Found by the 1003907 proof run. With the Windows argv bug in play every worker
+// exited in ~2s with "worker output was not JSON". Each run filed a blocker,
+// parked a task, and was classed `quiet` — which neither trips nor forgives the
+// failure count. consecutive_failures stayed 0, mode stayed `full`, and the
+// runner would have worked through the whole allowlisted goal one task every
+// five minutes, parking every one, while the hall showed it alive and allowed to
+// work. A human stopped it after one task.
+
+// The exact row the runner logged on the night this was found.
+const brokenWorkerRow = {
+  event: 'worked',
+  task_id: '1004047',
+  outcome: 'worker_failed',
+  reason: 'worker output was not JSON',
+  duration_s: 2,
+  cost_usd: null,
+  verified: false,
+  ledger_shape: 'still_held',
+  claim_released: true,
+  task_parked: true,
+};
+
+test('the real broken-worker row is a FAILURE, not quiet', () => {
+  const c = cadence.classifyEvent(brokenWorkerRow);
+  assert.notEqual(c.class, 'quiet', 'this is the exact misclassification the task exists to fix');
+  assert.ok(cadence.COUNTS_AS_FAILURE.has(c.class), 'and it must advance the failure count');
+  assert.match(c.detail, /never ran/);
+});
+
+test('three broken workers drop the runner out of full speed', () => {
+  let state = cadence.START;
+  for (let i = 0; i < 3; i++) {
+    state = cadence.nextCadence(state, cadence.classifyEvent(brokenWorkerRow));
+  }
+  assert.equal(state.mode, 'probing',
+    'the whole point: a runner that cannot spawn must stop chewing the queue');
+});
+
+test('a worker that RAN and hit a real obstacle is still quiet', () => {
+  // 1003564: 31 minutes, real cost, stopped at a grader refusal. The machine is
+  // fine and the next task is the right move — escalating this would "fix" a
+  // working runner into a broken one.
+  const c = cadence.classifyEvent({
+    event: 'worked', outcome: 'needs_human', reason: 'the grader refused the ship',
+    duration_s: 1888, cost_usd: 13.74, verified: false, ledger_shape: 'ungraded',
+  });
+  assert.equal(c.class, 'quiet');
+});
+
+test('a worker that burned real time and then failed is NOT "never ran"', () => {
+  // A 90-minute timeout is breakage of a different kind, and this predicate must
+  // not swallow it by calling it a failed launch.
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', duration_s: 5400, cost_usd: 9.1 }), false);
+});
+
+test('a spawn error is "never ran" whatever the numbers say', () => {
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', spawn_error: 'ENOENT' }), true);
+});
+
+test('a fast worker that still cost something is not called a failed launch', () => {
+  assert.equal(cadence.workerNeverRan({ outcome: 'worker_failed', duration_s: 4, cost_usd: 0.4 }), false,
+    'it ran; both conditions are required');
+});
+
+test('unworkable_queue is still never escalated', () => {
+  // The sibling distinction: a queue where every task halts is a HEALTHY machine
+  // with nothing to do. This fix must not blur the two.
+  const c = cadence.classifyEvent({ event: 'nothing_claimable', skipped: [{ id: '1', title: 't', reasons: ['x'] }] });
+  assert.equal(c.class, 'unworkable_queue');
+  assert.equal(cadence.COUNTS_AS_FAILURE.has('unworkable_queue'), false);
+});