@bongos/core 1.19.1034 → 1.19.1036

package/tests/routine_observability_api.mjs

@@ -0,0 +1,195 @@
+// tests/routine_observability_api.mjs — the unattended routines are diagnosable from off
+// the box (task 1002669).
+//
+// Every autonomy-gate decision already lands in `autonomy_runs` and every core upgrade in
+// `core_upgrades`, but no route read either, so "did the routine fire, what did it
+// decide, and when did the pin last move" needed an SSH session (blocker 1000106). Two
+// read-only routes answer it now:
+//   GET /api/bongos/autonomy/runs    — behind `autonomy.precheck` (Metic+), the atom the
+//                                      precheck itself uses
+//   GET /api/bongos/core-upgrades    — behind `core.pin.move` (Archon), the atom the
+//                                      upgrade banner and the deploy door use
+// No new atom, so no migration. These tests drive REAL requests through the assembled
+// routers with only the two auth gates stubbed (the core_update_banner precedent: an
+// arity-mangled handler 500s, and only a real request sees that), read the atom each
+// gate was built with off the router stack, and pin the SQL against a stubbed pool.
+//
+// DB-free, no network. Run:  node --test tests/routine_observability_api.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+// A permission stub that remembers which atom it was built with, so the test can read
+// the gate's authority off the router instead of grepping the source for it.
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+async function serve(router) {
+  const app = express();
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  return { base, close: () => server.close() };
+}
+
+function layerFor(router, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p);
+  assert.ok(layer, `${p} is registered`);
+  return layer;
+}
+
+// ── GET /autonomy/runs ──────────────────────────────────────────────────────────────
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+test('GET /autonomy/runs is gated by requireBuilder + the precheck\'s own atom', () => {
+  const layer = layerFor(autonomyRouter(), '/autonomy/runs');
+  assert.equal(layer.route.methods.get, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.precheck');
+});
+
+test('GET /autonomy/runs returns the decisions, narrowed by routine and a clamped limit', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.readAutonomyRuns;
+  const seen = [];
+  const rows = [{ id: '7', routine: 'overnight-builder', decision: 'no-go', reason: 'no claimable work', head_sha: 'abc', claimable_count: 0, enabled: true, created_at: '2026-09-25T02:00:00.000Z' }];
+  db.readAutonomyRuns = async (args) => { seen.push(args); return rows; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await fetch(`${s.base}/autonomy/runs?routine=overnight-builder&limit=500`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(await r.json(), { routine: 'overnight-builder', limit: 100, runs: rows });
+    assert.deepEqual(seen.pop(), { routine: 'overnight-builder', limit: 100 }, 'a limit above 100 is clamped, not refused');
+
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(seen.pop(), { routine: null, limit: 20 }, 'no routine = every routine; the default limit is 20');
+
+    await fetch(`${s.base}/autonomy/runs?limit=banana`);
+    assert.equal(seen.pop().limit, 20, 'a non-number falls back to the default');
+    await fetch(`${s.base}/autonomy/runs?limit=0`);
+    assert.equal(seen.pop().limit, 1);
+
+    db.readAutonomyRuns = async () => { throw new Error('relation "autonomy_runs" does not exist'); };
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 503, 'an unreadable table is a 503 that says so, never an empty list');
+    const body = await r.json();
+    assert.equal(body.error.code, 'autonomy_runs_unreadable');
+    assert.ok(!JSON.stringify(body).includes('does not exist'), 'the database error text stays in the log');
+  } finally {
+    s.close();
+    db.readAutonomyRuns = saved;
+  }
+});
+
+test('readAutonomyRuns: newest first, one routine or all, ids as strings', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 42, routine: 'bfg', decision: 'go' }] }; };
+  try {
+    const out = await db.readAutonomyRuns({ routine: 'bfg', limit: 5 });
+    assert.deepEqual(out, [{ id: '42', routine: 'bfg', decision: 'go' }]);
+    assert.match(calls[0].sql, /FROM autonomy_runs/);
+    assert.match(calls[0].sql, /\$1::text IS NULL OR routine = \$1/);
+    assert.match(calls[0].sql, /ORDER BY created_at DESC/);
+    assert.deepEqual(calls[0].params, ['bfg', 5]);
+    await db.readAutonomyRuns();
+    assert.deepEqual(calls[1].params, [null, 20]);
+    assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+// ── GET /core-upgrades ──────────────────────────────────────────────────────────────
+
+function coreUpdateRouter(deps) {
+  const auth = req(path.join(ROOT, 'src/bongos/auth.js'));
+  const saved = { b: auth.requireBuilder, p: auth.requirePermission };
+  auth.requireBuilder = passBuilder;
+  auth.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)(deps);
+  } finally {
+    auth.requireBuilder = saved.b;
+    auth.requirePermission = saved.p;
+    delete req.cache[routePath];
+  }
+}
+
+test('GET /core-upgrades is gated by requireBuilder + core.pin.move, like the banner beside it', () => {
+  const router = coreUpdateRouter();
+  const layer = layerFor(router, '/core-upgrades');
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'core.pin.move');
+  assert.equal(layerFor(router, '/core-update').route.stack[1].handle.permKey, 'core.pin.move', 'the existing route is untouched');
+});
+
+test('GET /core-upgrades answers "when did the pin last move", newest first', async () => {
+  const seen = [];
+  const ledger = [
+    { id: '12', from_version: '1.19.1022', to_version: '1.19.1023', source_commit: 'b50d32f1', note: null, applied_at: '2026-09-24T10:00:00.000Z', source: 'door', requested_by_builder_id: '3' },
+    { id: '11', from_version: '1.19.1010', to_version: '1.19.1022', source_commit: null, note: 'auto-subscription (patch)', applied_at: '2026-09-23T10:00:00.000Z', source: 'cli', requested_by_builder_id: null },
+  ];
+  const s = await serve(coreUpdateRouter({ upgrades: async (args) => { seen.push(args); return ledger; } }));
+  try {
+    const r = await fetch(`${s.base}/core-upgrades?limit=2`);
+    assert.equal(r.status, 200, 'the handler runs — a 500 here is the asyncHandler arity bug');
+    const body = await r.json();
+    assert.equal(body.ok, true);
+    assert.equal(body.limit, 2);
+    assert.deepEqual(body.upgrades, ledger);
+    assert.equal(body.upgrades[0].applied_at, '2026-09-24T10:00:00.000Z', 'the first row is the last pin move');
+    assert.ok('running' in body, 'the running core version rides along, so behind-or-not is one read');
+    assert.deepEqual(seen, [{ limit: 2 }]);
+  } finally {
+    s.close();
+  }
+});
+
+test('readCoreUpgrades: the ledger, newest first, read-only, ids as strings', async () => {
+  const { readCoreUpgrades } = req(path.join(ROOT, 'src/bongos/core-update.js'));
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 5, to_version: '1.19.1023', requested_by_builder_id: 3 }, { id: 4, to_version: '1.19.1022', requested_by_builder_id: null }] }; } };
+  const out = await readCoreUpgrades({ limit: 7, pool });
+  assert.deepEqual(out, [
+    { id: '5', to_version: '1.19.1023', requested_by_builder_id: '3' },
+    { id: '4', to_version: '1.19.1022', requested_by_builder_id: null },
+  ]);
+  assert.match(calls[0].sql, /FROM core_upgrades/);
+  assert.match(calls[0].sql, /ORDER BY applied_at DESC/);
+  assert.deepEqual(calls[0].params, [7]);
+  assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+});

package/tests/scouting_page_gate.mjs

@@ -174,11 +174,19 @@ await t('the OTHER page gates are untouched — their seam is never consulted at
   assert.ok(vote, 'board.vote.cast floors at xenos on purpose (ADR 0266) — admitted without the seam');
 });
 
-await t('only ONE gate declares a second door (a widening must be opted into, one gate at a time)', () => {
+await t('only the gates WITH A PROOF declare a second door (a widening must be opted into, one gate at a time)', () => {
   const src = require('node:fs').readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
-  const declarations = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].map((m) => m[1]);
-  assert.deepEqual(declarations, ['isProjectOwner'],
+  // Keyed by GATE, not just the door's name, so a third gate borrowing 'isProjectOwner'
+  // fails here instead of hiding behind an unchanged list of names. Each entry names the
+  // file that proves its widening:
+  //   requireProjectCuratePage — this file (ADR 0210 D3);
+  //   requireCorePinPage       — tests/core_upgrade_owner_door.mjs (ADR 0339, task 1004174).
+  const declarations = [...src.matchAll(/(require\w+Page):\s*Object\.freeze\(\{[^}]*alsoAdmits:\s*'([^']+)'/g)]
+    .map((m) => `${m[1]}:${m[2]}`);
+  assert.deepEqual(declarations, ['requireProjectCuratePage:isProjectOwner', 'requireCorePinPage:isProjectOwner'],
     'a second alsoAdmits appearing without its own proof is how a page gate quietly widens');
+  const plain = [...src.matchAll(/alsoAdmits:\s*'([^']+)'/g)].length;
+  assert.equal(plain, declarations.length, 'every alsoAdmits sits on a named page gate this test can see');
 });
 
 seams._reset();

package/tests/ship_assurance.mjs

@@ -194,14 +194,15 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
 const { deriveShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
 const TIP = 'a'.repeat(40);
 console.log('\nthe tip proof does not depend on the branch/PR probe');
-await t('tip in main + getPublishStatus throwing (no branch on the claim) → proof', async () => {
+await t('tip in main + getPublishStatus throwing → proof (the status probe is only a witness)', async () => {
   const seen = [];
   const r = await deriveShipAssurance({
     taskId: 1003285,
     body: {},
     db: { getClaimPublishedSha: async () => TIP },
     githubPush: {
-      getPublishStatus: async () => { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; },
+      findTaskPullRequest: async () => ({ branch: 'task-1003285', pr_number: 7, merged: true }),
+      getPublishStatus: async () => { const e = new Error('STATUS_FETCH_FAILED'); e.code = 'STATUS_FETCH_FAILED'; throw e; },
       landProvenForTask: async ({ publishedSha, status }) => {
         seen.push({ publishedSha, status });
         return publishedSha === TIP ? { proven: true, reason: 'published tip in main' } : { proven: false };
@@ -210,9 +211,28 @@ await t('tip in main + getPublishStatus throwing (no branch on the claim) → pr
     onProbeError: (e) => seen.push({ probeError: e.code }),
   });
   assert.equal(seen.some((s) => s.publishedSha === TIP && s.status === null), true, 'the proof ran with status=null');
-  assert.equal(seen.some((s) => s.probeError === 'BAD_BRANCH'), true, 'the probe failure was still reported');
+  assert.equal(seen.some((s) => s.probeError === 'STATUS_FETCH_FAILED'), true, 'the probe failure was still reported');
   assert.equal(r.assurance && r.assurance.kind, 'proof');
 });
+await t('tip in main + the PR search throwing → proof, and the status probe is never asked', async () => {
+  let statusCalls = 0;
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1003286,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      findTaskPullRequest: async () => { const e = new Error('PUSH_UNCONFIGURED'); e.code = 'PUSH_UNCONFIGURED'; throw e; },
+      getPublishStatus: async () => { statusCalls++; return null; },
+      landProvenForTask: async ({ publishedSha, status }) => (publishedSha === TIP && status === null
+        ? { proven: true, reason: 'published tip in main' } : { proven: false }),
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.deepEqual(errs, ['PUSH_UNCONFIGURED'], 'the search failure is reported on its own');
+  assert.equal(statusCalls, 0, 'no branch was found, so there is nothing to ask the status probe about');
+});
 await t('no tip + getPublishStatus throwing → still the 409 refusal (nothing to prove)', async () => {
   const r = await deriveShipAssurance({
     taskId: 1003253,
@@ -238,5 +258,68 @@ await t('a proof failure (compare API down) still falls through to the refusal,
   assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
 });
 
+// task 1004275 — the status probe was called with { taskId, publishedSha }, which
+// getPublishStatus does not read: it wants { branch }, so it threw BAD_BRANCH on EVERY
+// manual ship and both PR-witness proofs could never fire here. A squash-landed or
+// no-tip task was refused ship_land_not_proven while the reconciler (which resolves a
+// branch) shipped it minutes later. The branch now comes from the task's own PR, found
+// by title — the lookup GET /publish-status has used since task 1003764.
+console.log('\nthe PR witnesses reach the proof (task 1004275)');
+const realPush = require(path.join(ROOT, 'modules/lifecycle/github-push.js'));
+// The REAL getPublishStatus contract, minus the network: anything but a safe branch is
+// refused exactly as the real one refuses it, so the pre-fix call shape goes red here.
+const statusFor = (merged) => async (args) => {
+  if (!args || !realPush.isSafeBranch(args.branch)) { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; }
+  return { branch: args.branch, pr_state: merged ? 'closed' : 'open', merged, pr_number: 1214,
+    pr_title: 'task 1004275: fix the land proof', pr_body: '', merge_sha: null };
+};
+await t('no tip + a merged PR titled for the task → proof (the no-tip fallback now fires)', async () => {
+  const asked = [];
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async (a) => { asked.push(a); return { branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: true }; },
+      getPublishStatus: statusFor(true),
+      landProvenForTask: realPush.landProvenForTask, // no tip + merged PR → decided with no network call
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.deepEqual(errs, [], 'no probe failed');
+  assert.deepEqual(asked, [{ taskId: 1004275 }], 'the PR is found by the task id');
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.match(r.assurance.reason, /matched PR references task 1004275/);
+});
+await t('no tip + the task\'s PR still OPEN → the 409 refusal (a PR is a witness, not a land)', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => ({ branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: false }),
+      getPublishStatus: statusFor(false),
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+await t('no tip + no PR for the task → the 409 refusal, and getPublishStatus is not called with nothing', async () => {
+  let statusCalls = 0;
+  const r = await deriveShipAssurance({
+    taskId: 1004276,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => null,
+      getPublishStatus: async () => { statusCalls++; throw new Error('BAD_BRANCH'); },
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+  assert.equal(statusCalls, 0);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);