@bongos/core 1.19.1037 → 1.19.1039

package/tests/grade_model_provider.mjs

@@ -0,0 +1,217 @@
+// tests/grade_model_provider.mjs — the ModelProvider port + the openai-compatible
+// adapter (task 1002840, ADR 0089 §3).
+//
+// Pins: (1) every model id in use today still runs on the Claude spawn, with the
+// identical argv; (2) the openai-compatible adapter against a LOCAL STUB server —
+// request shape, envelope, cost, and every failure mapped to the error codes the
+// worker runner already understands — with no real key and no network; (3) a key
+// that is missing sends nothing, and a key never leaks into an error; (4) the
+// config loader fails to vanilla; (5) the judge table reproduces the old if/else
+// and refuses a same-family or non-Claude judge (ADR 0024 / the Claude floor).
+//
+// Run:  node --test tests/grade_model_provider.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const subagent = require('../modules/grading/grader-subagent.js');
+const mp = require('../modules/grading/model-provider.js');
+const model = require('../modules/grading/grader-model.js');
+const workers = require('../modules/grading/grader-workers');
+
+// A local OpenAI-shaped server. `reply(req, body)` returns { status, json|text, delayMs }.
+async function stubServer(reply) {
+  const seen = [];
+  const server = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', (d) => { raw += d; });
+    req.on('end', async () => {
+      const body = raw ? JSON.parse(raw) : null;
+      seen.push({ method: req.method, url: req.url, headers: req.headers, body });
+      const r = reply(req, body) || {};
+      if (r.delayMs) await new Promise((ok) => setTimeout(ok, r.delayMs));
+      res.writeHead(r.status || 200, { 'content-type': 'application/json' });
+      res.end(r.text != null ? r.text : JSON.stringify(r.json));
+    });
+  });
+  await new Promise((ok) => server.listen(0, '127.0.0.1', ok));
+  const { port } = server.address();
+  return { seen, base: `http://127.0.0.1:${port}/v1`, close: () => new Promise((ok) => server.close(ok)) };
+}
+
+const KEY = 'test-key-not-a-real-secret-0123456789';
+function provider(base, extra = {}, env = { STUB_LLM_KEY: KEY }) {
+  const v = mp.validateProviderDef('stub', { kind: 'openai-compatible', base_url: base, api_key_env: 'STUB_LLM_KEY', ...extra });
+  assert.ok(v.def, v.error);
+  return mp.createOpenAICompatibleProvider(v.def, { env });
+}
+const completion = (content, usage = { prompt_tokens: 1000, completion_tokens: 200 }) => ({ json: { choices: [{ message: { role: 'assistant', content } }], usage } });
+
+test('parseModelRef: every id in use today is a Claude model; only a REGISTERED prefix routes elsewhere', () => {
+  for (const id of ['claude-sonnet-5', 'claude-opus-5', 'claude-fable-5', '', 'x:y']) {
+    assert.deepEqual(mp.parseModelRef(id), { provider: 'anthropic-cli', model: id });
+  }
+  mp.registerModelProvider({ name: 'test-ollama', kind: 'openai-compatible', run: async () => ({}) });
+  assert.deepEqual(mp.parseModelRef('test-ollama:qwen2.5-coder:32b'), { provider: 'test-ollama', model: 'qwen2.5-coder:32b' },
+    'split at the FIRST colon only — a colon inside the model id survives');
+  assert.deepEqual(mp.parseModelRef('anthropic-cli:claude-sonnet-5'), { provider: 'anthropic-cli', model: 'anthropic-cli:claude-sonnet-5' },
+    'the default is never a prefix');
+  assert.ok(mp.listModelProviders().includes('anthropic-cli'));
+});
+
+test('the Claude spawn is the default provider, with the identical argv', { skip: process.platform === 'win32' && 'the fake CLI is a shebang script' }, async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-'));
+  const bin = path.join(dir, 'claude');
+  fs.writeFileSync(bin, '#!/usr/bin/env node\nprocess.stdin.resume(); process.stdin.on("end", () => process.stdout.write(JSON.stringify({ type: "result", result: JSON.stringify(process.argv.slice(2)), total_cost_usd: 0.5 })));\n');
+  fs.chmodSync(bin, 0o755);
+  try {
+    const r = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, model: 'claude-sonnet-5', cwd: dir } });
+    const argv = JSON.parse(subagent.extractAssistantResult(r.stdout));
+    const perm = typeof process.getuid === 'function' && process.getuid() === 0 ? 'acceptEdits' : 'bypassPermissions';
+    assert.deepEqual(argv, ['-p', '--print', '--model', 'claude-sonnet-5', '--output-format', 'json', '--tools', 'Read', '--disable-slash-commands', '--permission-mode', perm]);
+    assert.equal(r.cost_usd, 0.5);
+    const d = await subagent.runSubagent({ prompt: 'hi', opts: { claudeBin: bin, cwd: dir } });
+    assert.equal(JSON.parse(subagent.extractAssistantResult(d.stdout))[3], 'claude-sonnet-5', 'no model → the default grader model, as before');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('openai-compatible: request shape, envelope and cost — against a local stub', async () => {
+  const s = await stubServer(() => completion('{"code_quality": 8}'));
+  try {
+    const p = provider(s.base, { price_per_mtok: { 'deepseek-x': { input: 0.25, output: 1 } } });
+    const r = await p.run({ prompt: 'PROMPT TEXT', opts: { model: 'deepseek-x', timeoutMs: 5000 } });
+    assert.equal(s.seen.length, 1);
+    assert.equal(s.seen[0].method, 'POST');
+    assert.equal(s.seen[0].url, '/v1/chat/completions');
+    assert.equal(s.seen[0].headers.authorization, `Bearer ${KEY}`);
+    assert.deepEqual(s.seen[0].body, { model: 'deepseek-x', messages: [{ role: 'user', content: 'PROMPT TEXT' }] });
+    // The same envelope contract the Claude spawn honours, so nothing downstream changes.
+    assert.equal(subagent.extractAssistantResult(r.stdout), '{"code_quality": 8}');
+    const cost = (1000 * 0.25 + 200 * 1) / 1e6;
+    assert.equal(subagent.extractCostUsd(r.stdout), cost);
+    assert.equal(r.cost_usd, cost);
+    assert.equal(r.exit_code, 0);
+    const unpriced = await p.run({ prompt: 'x', opts: { model: 'other-model' } });
+    assert.equal(unpriced.cost_usd, null, 'no declared price → no cost number, never a guess');
+    assert.equal(subagent.extractCostUsd(unpriced.stdout), null);
+  } finally { await s.close(); }
+});
+
+test('openai-compatible: failures map to the codes the worker runner already retries or reports', async () => {
+  const s = await stubServer((req, body) => {
+    if (body.model === 'http-500') return { status: 500, text: `upstream says ${KEY} is invalid` };
+    if (body.model === 'slow') return { delayMs: 300, ...completion('late') };
+    if (body.model === 'garbage') return { text: 'not json at all' };
+    return completion('ok');
+  });
+  try {
+    const p = provider(s.base);
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'http-500' } }), (e) => {
+      assert.equal(e.code, 'SUBAGENT_NONZERO_EXIT');
+      assert.equal(e.exit_code, 500);
+      assert.ok(!e.stderr.includes(KEY) && e.stderr.includes('[redacted]'), 'the key is scrubbed from what a grade row stores');
+      return true;
+    });
+    await assert.rejects(p.run({ prompt: 'x', opts: { model: 'slow', timeoutMs: 50 } }), (e) => e.code === 'SUBAGENT_TIMEOUT');
+    const g = await p.run({ prompt: 'x', opts: { model: 'garbage' } });
+    assert.equal(subagent.extractAssistantResult(g.stdout), '', 'an unparseable 200 is an empty result → the worker parse_error path, retried once');
+  } finally { await s.close(); }
+  const dead = provider(s.base);
+  await assert.rejects(dead.run({ prompt: 'x', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED', 'a closed port is a spawn failure');
+});
+
+test('a missing key sends NOTHING anywhere', async () => {
+  const s = await stubServer(() => completion('ok'));
+  try {
+    const p = provider(s.base, {}, {});
+    await assert.rejects(p.run({ prompt: 'the diff', opts: { model: 'm' } }), (e) => e.code === 'SUBAGENT_SPAWN_FAILED' && /set STUB_LLM_KEY/.test(e.message));
+    assert.equal(s.seen.length, 0);
+  } finally { await s.close(); }
+});
+
+test('an open-model judge runs through the SAME worker runner and verdict code', async () => {
+  const s = await stubServer(() => completion(JSON.stringify({ code_quality: 8, economy: 8, confidence: 0.8, issues: [], notes_md: 'fine' })));
+  try {
+    mp.registerModelProvider({ ...provider(s.base, { price_per_mtok: { 'q-coder': { input: 1, output: 1 } } }), name: 'test-stub' });
+    const r = await workers.runWorker(workers.quality, {
+      task: { id: 1, title: 't', description: 'd' }, valueSummary: 'v', diff: 'diff', changedFiles: [], diffStats: null,
+      model: 'test-stub:q-coder', runOpts: {}, runSubagentFn: subagent.runSubagent, extractAssistantResultFn: subagent.extractAssistantResult,
+    });
+    assert.equal(r.verdict, 'pass');
+    assert.equal(r.scores.code_quality, 8);
+    assert.equal(r.model, 'test-stub:q-coder', 'the record names the provider');
+    assert.equal(r.cost_usd, 1200 / 1e6);
+    assert.equal(s.seen[0].body.model, 'q-coder', 'the provider receives its own model id');
+  } finally { await s.close(); }
+});
+
+test('provider config: validated, and a bad instance file fails to vanilla', () => {
+  const bad = (name, def) => mp.validateProviderDef(name, def).error;
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'K_KEY' }), /https/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1', api_key_env: 'sk-live-abc' }), /env var NAME/);
+  assert.match(bad('deepinfra', { kind: 'openai-compatible', base_url: 'https://api.example.com/v1' }), /needs api_key_env/);
+  assert.match(bad('anthropic-cli', { kind: 'openai-compatible', base_url: 'https://x.example/v1', api_key_env: 'K' }), /must match|not be/);
+  assert.match(bad('x-prov', { kind: 'grpc', base_url: 'https://x.example/v1', api_key_env: 'KK' }), /kind/);
+  assert.equal(bad('local-ollama', { kind: 'openai-compatible', base_url: 'http://localhost:11434/v1' }), undefined, 'keyless http is allowed to this machine only');
+
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-provider-cfg-'));
+  try {
+    const neutral = path.join(gradingDir(), 'grader-providers.neutral.json');
+    assert.deepEqual(mp.loadProviderConfig({ instancePath: path.join(dir, 'absent.json'), neutralPath: neutral }).defs, [],
+      'the shipped neutral starter declares no provider — a vanilla instance is Claude-only');
+    const broken = path.join(dir, 'broken.json');
+    fs.writeFileSync(broken, '{ not json');
+    assert.equal(mp.loadProviderConfig({ instancePath: broken, neutralPath: neutral }).source, neutral);
+    const mixed = path.join(dir, 'mixed.json');
+    fs.writeFileSync(mixed, JSON.stringify({ providers: {
+      deepinfra: { kind: 'openai-compatible', base_url: 'https://api.deepinfra.com/v1/openai', api_key_env: 'DEEPINFRA_API_KEY' },
+      leaky: { kind: 'openai-compatible', base_url: 'http://api.example.com/v1', api_key_env: 'LEAKY_KEY' },
+    } }));
+    const cfg = mp.loadProviderConfig({ instancePath: mixed, neutralPath: neutral });
+    assert.deepEqual(cfg.defs.map((d) => d.name), ['deepinfra']);
+    assert.equal(cfg.refused.length, 1, 'one bad entry is refused by name; the rest load');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+function gradingDir() {
+  return path.dirname(require.resolve('../modules/grading/model-provider.js'));
+}
+
+test('the judge table reproduces the old if/else, and refuses a same-family or non-Claude judge', () => {
+  const oldIfElse = (bm) => {
+    const s = bm.toLowerCase();
+    if (s.includes('fable') || s.includes('mythos')) return 'claude-sonnet-5';
+    if (s.includes('opus')) return 'claude-sonnet-5';
+    if (s.includes('sonnet')) return 'claude-opus-5';
+    if (s.includes('haiku')) return 'claude-opus-5';
+    return null;
+  };
+  const tokens = ['fable', 'mythos', 'opus', 'sonnet', 'haiku'];
+  const ids = ['claude-fable-5', 'claude-opus-5-5', 'claude-sonnet-5', 'claude-haiku-4-5', 'Claude-OPUS-4-8'];
+  for (const a of tokens) for (const b of tokens) ids.push(`claude-${a}-${b}`);
+  for (const id of ids) assert.equal(model.selectGraderModel({ builderModel: id }), oldIfElse(id), id);
+  assert.deepEqual(model.JUDGE_TABLE, model.BUILTIN_JUDGE_TABLE, 'the rubric table is exactly the built-in fallback');
+
+  const logged = [];
+  const orig = console.error;
+  console.error = (...a) => { logged.push(a.join(' ')); };
+  try {
+    assert.equal(model.selectGraderModel({ builderModel: 'gpt-9' }), 'claude-sonnet-5', 'an unknown builder warns and grades on the default — never throws (task 1002659)');
+  } finally { console.error = orig; }
+  assert.match(logged.join('\n'), /unrecognized builder model/);
+
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'claude-opus-5' }]).join(), /family it would grade/);
+  assert.match(model.judgeTableProblems([{ builder_families: ['opus'], judge_model: 'deepinfra:deepseek-v3' }]).join(), /plain Claude model id/);
+  assert.match(model.judgeTableProblems([]).join(), /non-empty/);
+  assert.deepEqual(model.judgeTableProblems(model.BUILTIN_JUDGE_TABLE), []);
+});

package/tests/publish_integration_gate.mjs

@@ -0,0 +1,198 @@
+// tests/publish_integration_gate.mjs — npm publishing waits for the integration lane's
+// verdict on the commit it releases (task 1004290).
+//
+// WHY. publish.yml fires on `unit`, which is DB-free by design. The proof that the
+// PACKAGED core can migrate an empty database (tests/consumer_layout_boot.mjs, task
+// 1002863) runs in integration.yml, and until this gate its verdict arrived after the
+// publish and gated nothing. What is pinned here:
+//   1. the verdicts, from the real list-workflow-runs payload shape
+//   2. the wait: polls while running, stops at once on an unreadable API, times out loudly
+//   3. the lane is WIRED: actions:read, the step sits before any install/pack/publish, and
+//      every later armed step carries the integration go — so a new step cannot slip past
+//
+// Network-free: fetch, sleep and the clock are injected.
+//
+// Run:  node tests/publish_integration_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const gate = require('../scripts/gds/publish-integration-gate.js');
+const { decideIntegrationGate, waitForIntegration, reportLines, main, runsUrl } = gate;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const SHA = '078e8b7b'.padEnd(40, '0');
+// The fields GitHub's list-workflow-runs answers with that the gate reads (from a real
+// integration run on main, 2026-09-26: run 36210...; trimmed to what matters).
+const ghRun = (run_number, status, conclusion) => ({
+  id: 36210000000 + run_number, run_number, event: 'push', head_sha: SHA, status, conclusion,
+  created_at: `2026-09-26T03:${String(run_number % 60).padStart(2, '0')}:00Z`,
+  html_url: `https://github.com/example-org/example-repo/actions/runs/${36210000000 + run_number}`,
+});
+const okJson = (body) => ({ ok: true, status: 200, json: async () => body });
+
+// ---- 1. the verdicts ----
+
+await test('decideIntegrationGate: success → go, running or absent → wait, cancelled → superseded, anything else → red', async () => {
+  assert.equal(decideIntegrationGate([ghRun(1, 'completed', 'success')]).verdict, 'go');
+  assert.equal(decideIntegrationGate([]).verdict, 'wait', 'the run has not been created yet');
+  assert.equal(decideIntegrationGate(undefined).verdict, 'wait');
+  for (const status of ['queued', 'in_progress', 'waiting', 'pending']) {
+    assert.equal(decideIntegrationGate([ghRun(1, status, null)]).verdict, 'wait', status);
+  }
+  assert.equal(decideIntegrationGate([ghRun(1, 'completed', 'cancelled')]).verdict, 'superseded');
+  for (const c of ['failure', 'timed_out', 'startup_failure', 'action_required', 'skipped', 'neutral', 'stale', null]) {
+    assert.equal(decideIntegrationGate([ghRun(1, 'completed', c)]).verdict, 'red', `fail-closed on ${c}`);
+  }
+});
+
+await test('decideIntegrationGate: the NEWEST run on the sha decides, whatever order the API lists them in', async () => {
+  assert.equal(decideIntegrationGate([ghRun(5, 'completed', 'failure'), ghRun(7, 'completed', 'success')]).verdict, 'go');
+  assert.equal(decideIntegrationGate([ghRun(7, 'completed', 'failure'), ghRun(5, 'completed', 'success')]).verdict, 'red');
+  assert.equal(decideIntegrationGate([ghRun(8, 'in_progress', null), ghRun(7, 'completed', 'success')]).verdict, 'wait');
+});
+
+await test('only PUSH runs are asked for: the weekly scheduled run carries HEAD\'s sha but tests only the parked set', async () => {
+  const u = runsUrl('example-org/example-repo', SHA);
+  assert.match(u, /\/actions\/workflows\/integration\.yml\/runs\?/);
+  assert.match(u, new RegExp(`head_sha=${SHA}`));
+  assert.match(u, /event=push/);
+  assert.ok(fs.existsSync(new URL('../.github/workflows/integration.yml', import.meta.url)), 'the workflow the gate names exists');
+});
+
+// ---- 2. the wait ----
+
+function clock() {
+  let t = 0;
+  return { now: () => t, sleep: async (ms) => { t += ms; } };
+}
+
+await test('waitForIntegration: polls while integration runs, then publishes on green', async () => {
+  const c = clock();
+  const replies = [okJson({ workflow_runs: [] }), okJson({ workflow_runs: [ghRun(3, 'in_progress', null)] }),
+    okJson({ workflow_runs: [ghRun(3, 'completed', 'success')] })];
+  const asked = [];
+  const r = await waitForIntegration({
+    sha: SHA, repo: 'example-org/example-repo', token: 't', timeoutMs: 600000, intervalMs: 20000,
+    fetchImpl: async (url, init) => { asked.push({ url, auth: init.headers.Authorization }); return replies.shift(); },
+    ...c,
+  });
+  assert.equal(r.verdict, 'go');
+  assert.equal(asked.length, 3);
+  assert.equal(asked[0].auth, 'Bearer t');
+  assert.equal(c.now(), 40000, 'slept between reads, not after the verdict');
+});
+
+await test('waitForIntegration: a 403/404 ends the wait at once (waiting cannot grant a permission)', async () => {
+  for (const status of [401, 403, 404]) {
+    const c = clock();
+    let calls = 0;
+    const r = await waitForIntegration({
+      sha: SHA, repo: 'o/r', token: 't', timeoutMs: 600000, intervalMs: 20000,
+      fetchImpl: async () => { calls++; return { ok: false, status, json: async () => ({}) }; }, ...c,
+    });
+    assert.equal(r.verdict, 'unreadable', String(status));
+    assert.equal(calls, 1);
+  }
+});
+
+await test('waitForIntegration: flaky reads are retried, and a lane with no verdict times out rather than publishing', async () => {
+  const c = clock();
+  let calls = 0;
+  const r = await waitForIntegration({
+    sha: SHA, repo: 'o/r', token: 't', timeoutMs: 60000, intervalMs: 20000,
+    fetchImpl: async () => {
+      calls++;
+      if (calls === 1) throw new Error('ECONNRESET');
+      if (calls === 2) return { ok: false, status: 502, json: async () => ({}) };
+      return okJson({ workflow_runs: [ghRun(3, 'in_progress', null)] });
+    },
+    ...c,
+  });
+  assert.equal(r.verdict, 'timeout');
+  assert.ok(calls >= 3, 'kept reading through the transient failures');
+});
+
+await test('reportLines: only a green lane says go; red, unreadable and timeout exit non-zero', async () => {
+  const base = { sha: SHA, run: ghRun(3, 'completed', 'failure'), why: 'HTTP 403', timeoutMin: 12 };
+  assert.deepEqual([reportLines('go', base).go, reportLines('go', base).code], [true, 0]);
+  assert.deepEqual([reportLines('superseded', base).go, reportLines('superseded', base).code], [false, 0]);
+  for (const v of ['red', 'unreadable', 'timeout']) {
+    const o = reportLines(v, base);
+    assert.equal(o.go, false, v);
+    assert.equal(o.code, 1, v);
+    assert.match(o.line, /^::error title=not published/, v);
+    assert.doesNotMatch(o.line.split('::')[1], /,/, `${v}: a comma in the title would split the annotation's properties`);
+  }
+  assert.match(reportLines('red', base).line, /task 1002863/, 'says what the red lane was proving');
+  assert.match(reportLines('unreadable', base).line, /actions: read/);
+});
+
+await test('main: writes go=… to GITHUB_OUTPUT and refuses bad arguments with exit 2', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'integ-gate-'));
+  try {
+    const out = path.join(dir, 'out');
+    const log = console.log;
+    const err = console.error;
+    console.log = () => {};
+    console.error = () => {};
+    try {
+      assert.equal(await main(['--sha', 'nope', '--repo', 'o/r'], { GH_TOKEN: 't', GITHUB_OUTPUT: out }), 2);
+      assert.equal(await main(['--sha', SHA, '--repo', 'o/r'], { GITHUB_OUTPUT: out }), 2, 'no token');
+      const realFetch = globalThis.fetch;
+      globalThis.fetch = async () => okJson({ workflow_runs: [ghRun(3, 'completed', 'success')] });
+      try {
+        assert.equal(await main(['--sha', SHA, '--repo', 'o/r'], { GH_TOKEN: 't', GITHUB_OUTPUT: out }), 0);
+      } finally { globalThis.fetch = realFetch; }
+    } finally { console.log = log; console.error = err; }
+    assert.equal(fs.readFileSync(out, 'utf8'), 'go=true\n');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+// ---- 3. the wiring ----
+
+const YML = fs.readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+// Split the job into steps at each `      - ` list item (the job's step indentation).
+const steps = YML.split(/\n(?=      - (?:name|uses):)/).slice(1);
+const stepIndex = (re) => steps.findIndex((s) => re.test(s));
+
+await test('publish.yml can read the integration runs, and asks about the commit it packages', async () => {
+  assert.match(YML, /^permissions:[\s\S]*?^\s+actions: read$/m, 'the job token needs actions:read to list runs');
+  assert.doesNotMatch(YML, /actions: write/, 'read only');
+  const g = steps[stepIndex(/id: integ\n/)];
+  assert.ok(g, 'the integration gate step exists');
+  assert.match(g, /node scripts\/gds\/publish-integration-gate\.js --sha "\$\(git rev-parse HEAD\)"/, 'HEAD — the checkout is ref: main, not the trigger sha');
+  assert.match(g, /GH_TOKEN: \$\{\{ github\.token \}\}/);
+});
+
+await test('publish.yml: the gate runs before anything is installed, bumped, packed, published, recorded or tagged', async () => {
+  const at = stepIndex(/id: integ\n/);
+  assert.ok(at > stepIndex(/id: relhead\n/), 'after the cascade terminator (a carrier HEAD needs no gate)');
+  for (const re of [/actions\/setup-node@/, /run: npm ci\b/, /id: ver\n/, /id: bump\n/, /id: pack\n/, /id: pub\n/, /git push origin HEAD:main/, /git tag "core-v/]) {
+    const i = stepIndex(re);
+    assert.ok(i > at, `${re} must come after the integration gate (at ${i}, gate at ${at})`);
+  }
+});
+
+await test('publish.yml: every armed step after the gate also requires its go — no step can slip past it', async () => {
+  const at = stepIndex(/id: integ\n/);
+  const later = steps.slice(at + 1).filter((s) => /steps\.armed\.outputs\.armed == 'true'/.test(s));
+  assert.ok(later.length >= 9, `expected the install..tag chain after the gate, found ${later.length}`);
+  for (const s of later) {
+    const name = (/- (?:name: (.*)|uses: (.*))/.exec(s) || [])[1] || s.slice(0, 60);
+    assert.match(s, /steps\.integ\.outputs\.go == 'true'/, `"${name}" runs without the integration gate`);
+  }
+});
+
+console.log(`\npublish integration gate (task 1004290) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;

package/tests/ship_land_ci_not_started.mjs

@@ -0,0 +1,168 @@
+// tests/ship_land_ci_not_started.mjs — a land wait that says "CI never ran" when it did
+// not, instead of "fix your code" (task 1004289).
+//
+// WHY. During the 2026-09-25 GitHub Actions budget outage (blocker 1000173) every job on
+// every PR "failed" in about two seconds without running: conclusion FAILURE, no steps, no
+// runner, and one annotation — "The job was not started because an Actions budget is
+// preventing further use." Task 1003764's red-check reader saw an ordinary red `unit`
+// check and told the builder on PR 1211 to fix it, commit and re-run, plus the "CI tests
+// your branch MERGED with main" trap. None of that can help: nothing was tested, and the
+// fix is the owner's, on the GitHub account. These drive the laptop poll with a fake gh
+// carrying the REAL payloads from PR 1211 (run 36210373664, attempt 1).
+//
+// Run:  node tests/ship_land_ci_not_started.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import {
+  jobNeverStarted, landPendingLines, localMergeDriver, notStartedLines, pollCiDeploy, redBlocksMerge, redPrLine, redPrLines,
+} from '../scripts/gds/ship-land.js';
+
+const require = createRequire(import.meta.url);
+const { CARDS, cardFor } = require('../scripts/gds/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+async function capture(fn) {
+  const lines = [];
+  const orig = console.log;
+  console.log = (...a) => { lines.push(a.join(' ')); };
+  try { return { result: await fn(), out: lines.join('\n') }; }
+  finally { console.log = orig; }
+}
+
+const SHA = 'b9b03b03687ce823c016a29b0141736a3595c547';
+const RUN = '36210373664';
+const JOB_UNIT = '108315429264';
+const JOB_REPORT = '108315436139';
+const jobUrl = (job) => `https://github.com/example-org/example-repo/actions/runs/${RUN}/job/${job}`;
+const checkRun = (name, job, conclusion = 'FAILURE') => ({
+  __typename: 'CheckRun', name, conclusion, status: 'COMPLETED', workflowName: 'unit', detailsUrl: jobUrl(job),
+  startedAt: '2026-09-26T02:01:46Z', completedAt: '2026-09-26T02:01:48Z',
+});
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, targetUrl: '' });
+const openPr = (rollup) => ({ state: 'OPEN', mergeCommit: null, mergeStateStatus: 'BLOCKED', headRefOid: SHA, statusCheckRollup: rollup });
+// PR 1211's rollup during the outage: both unit-workflow jobs "failed", the trust status green.
+const OUTAGE_ROLLUP = [checkRun('unit', JOB_UNIT), checkRun('report', JOB_REPORT), ctx('gate-author-trust', 'SUCCESS')];
+
+// The two annotations GitHub returned for job 108315429264, verbatim (paths trimmed).
+const BUDGET_NOTES = [
+  { path: '.github', annotation_level: 'failure', title: '', message: 'The job was not started because an Actions budget is preventing further use.' },
+  { path: '.github', annotation_level: 'notice', title: '', message: '"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026."' },
+];
+const NOTICE_ONLY = [BUDGET_NOTES[1]];
+const annotationsPath = (job) => `repos/{owner}/{repo}/check-runs/${job}/annotations`;
+
+// ---- the detector ----
+
+await test('jobNeverStarted: the budget annotation on the job reads as never started', async () => {
+  const asked = [];
+  const gh = (args) => { asked.push(args); return BUDGET_NOTES; };
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), gh), true);
+  assert.deepEqual(asked, [['api', annotationsPath(JOB_UNIT)]], 'reads the check run named by the job id in its detailsUrl');
+});
+
+await test('jobNeverStarted: the payment-failed wording is the same shape and is caught too', async () => {
+  const gh = () => [{ annotation_level: 'failure', message: 'The job was not started because recent account payments have failed or your spending limit needs to be increased.' }];
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), gh), true);
+});
+
+await test('jobNeverStarted is FAIL-OPEN: a real failure, an unreadable read, or no job id is "no"', async () => {
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => NOTICE_ONLY), false, 'a job that ran and failed');
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => null), false, 'gh could not read the annotations');
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => ({ message: 'Not Found' })), false, 'an error object, not a list');
+  let calls = 0;
+  const gh = () => { calls++; return BUDGET_NOTES; };
+  assert.equal(jobNeverStarted({ __typename: 'CheckRun', name: 'x', detailsUrl: 'https://example.com/checks' }, gh), false);
+  assert.equal(jobNeverStarted(ctx('unit-report', 'FAILURE'), gh), false, 'a commit status is not a job');
+  assert.equal(calls, 0, 'nothing to look up, so nothing is asked');
+});
+
+// ---- the merge-driver answer and the lines it prints ----
+
+await test('localMergeDriver: every red check never started → ci_not_started, not a failing check', async () => {
+  const md = localMergeDriver(openPr(OUTAGE_ROLLUP), () => 'must not be asked', () => true);
+  assert.deepEqual(md, { reason: 'ci_not_started:unit', not_started: true, failing_tests: null, run_id: RUN });
+});
+
+await test('localMergeDriver: one real failure beside a never-started job is still a failing check', async () => {
+  const rollup = [checkRun('unit', JOB_UNIT), checkRun('lint', '999', 'FAILURE')];
+  const md = localMergeDriver(openPr(rollup), () => null, (c) => c.name === 'unit');
+  assert.equal(md.reason, 'failing_check:unit');
+  assert.equal(md.not_started, undefined);
+});
+
+await test('localMergeDriver: without a never-started answer (the default) nothing changes', async () => {
+  assert.deepEqual(localMergeDriver(openPr(OUTAGE_ROLLUP), () => null), { reason: 'failing_check:unit', failing_tests: null });
+});
+
+await test('the red line says CI never ran and the work needs nothing; no fix-your-code, no merge trap', async () => {
+  const md = { reason: 'ci_not_started:unit', not_started: true, failing_tests: null, run_id: RUN };
+  const out = redPrLines(md, { taskId: 42, via: 'local' }).join('\n');
+  assert.match(redPrLine(md), /CI NEVER RAN/);
+  assert.match(out, /the `unit` job/);
+  assert.match(out, /nothing in it to fix/);
+  assert.match(out, /repo OWNER's to fix/);
+  assert.match(out, new RegExp(`gh run rerun ${RUN} --failed`), 'names the re-run for the exact run');
+  assert.match(out, /do not re-push or edit the work/);
+  assert.doesNotMatch(out, /fix it, commit/, 'the advice that cannot help is gone');
+  assert.doesNotMatch(out, /MERGED with the current main/, 'and so is the merge trap');
+  assert.ok(out.includes(CARDS.ci_not_started.happened), 'the plain card rides along');
+  assert.ok(!out.includes(CARDS.failing_check.happened), 'not the "a test failed" card');
+  assert.equal(cardFor('ci_not_started:unit'), CARDS.ci_not_started, 'the named reason resolves to its card');
+  assert.equal(redBlocksMerge(md), false, 'it is not the failing-check kind of red');
+});
+
+await test('notStartedLines without a run id points at the PR button instead of inventing a command', async () => {
+  const out = notStartedLines({ reason: 'ci_not_started:unit', not_started: true, run_id: null }).join('\n');
+  assert.match(out, /"Re-run failed jobs" on the PR/);
+  assert.doesNotMatch(out, /gh run rerun/);
+});
+
+await test('the closing banner for a never-started CI is neither "NOT a failure" nor "fix the check"', async () => {
+  const out = landPendingLines(42, { notStarted: true }).join('\n');
+  assert.match(out, /CI never started/);
+  assert.match(out, /Nothing in the work needs to change/);
+  assert.match(out, /node scripts\/gds\/ship\.js 42/);
+  assert.doesNotMatch(out, /NOT a failure/);
+  assert.doesNotMatch(out, /Do what the lines above say/);
+});
+
+// ---- the laptop poll, end to end ----
+
+await test('pollCiDeploy (laptop): an Actions-budget outage is named as CI never running, once, with no code advice', async () => {
+  const seen = { prView: 0, annotations: 0, status: 0 };
+  const gh = (args) => {
+    if (args[0] === 'pr' && args[1] === 'view') { seen.prView++; return openPr(OUTAGE_ROLLUP); }
+    if (args[0] === 'api' && /check-runs\/\d+\/annotations$/.test(args[1])) { seen.annotations++; return BUDGET_NOTES; }
+    if (args[0] === 'api') { seen.status++; return { statuses: [] }; }
+    throw new Error(`unexpected gh call: ${args.join(' ')}`);
+  };
+  const { result, out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.equal(result.pending, true, 'the land is still pending — the checks can yet run');
+  assert.equal(seen.prView, 30, 'polled the whole window');
+  assert.equal(seen.annotations, 2, 'each job\'s annotations are read once, not once per poll');
+  assert.equal(out.split('CI NEVER RAN on this PR').length - 1, 1, 'named once');
+  assert.match(out, /CI never started on the PR/, 'the closing banner says the same');
+  assert.doesNotMatch(out, /fix it, commit/);
+  assert.doesNotMatch(out, /MERGED with the current main/);
+  assert.doesNotMatch(out, /This is NOT a failure/);
+  assert.ok(!out.includes(CARDS.land_pending.happened), 'nor the "nothing to do" card');
+});
+
+await test('pollCiDeploy: when the annotations cannot be read, it falls back to the ordinary red wording', async () => {
+  const gh = (args) => {
+    if (args[0] === 'pr' && args[1] === 'view') return openPr(OUTAGE_ROLLUP);
+    return null; // no Checks read on this gh, or the API is down
+  };
+  const { out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.match(out, /the PR is RED — the `unit` check failed/);
+  assert.doesNotMatch(out, /CI NEVER RAN/);
+});
+
+console.log(`\nship-land CI never started (task 1004289) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;