@bongos/core 1.19.11 → 1.19.13

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.11",
-  "core_contract": "1.19.11",
-  "source_commit": "fbce8088d2da2e7fa918dbde45c56e99b515e758",
+  "core_version": "1.19.13",
+  "core_contract": "1.19.13",
+  "source_commit": "9871ae1c84d380c804f27a2a8f2c8b31a1c0eae2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-08T20:47:47.820Z",
+  "built_at": "2026-08-08T20:54:03.577Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 284,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1508,
-  "tree_sha256": "f625f5bb236d38733faaf7e6c684f729794116ad9eaa1668ab5574c7b8f643f1",
+  "tree_sha256": "ee0b74c675d9eae8a9eacfe1e32c2c3b89f6b30cde100b786e5c4dd04f859ede",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3997,12 +3997,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4f297848afb8580eeefc32077b5a46385dd1e5746c4142498286762845ee6ec8"
+      "sha256": "e651e8a285a3591a06a4562fef0fe2b92a412da95e879f12a891d743358f4dd9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c4d0f571c09c5a7cdd3484e326cfa763fbeb6b5b27f369a1d83bd766ffd7fe78"
+      "sha256": "4649829e05fa95e32332b71cdc37037d194f4f15b7c47af6618eb1f00dd2f785"
     },
     {
       "path": "public-docs/index.html",
@@ -5192,7 +5192,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "fc83c3ee63ce06c603eff9a4423f21d3b915ea7eae27e68ba953a45c8f14eda6"
+      "sha256": "bea8a5d8698abf30064c005076c069d470203c86a37a1ff7a3aebc4a5ded19a6"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5622,7 +5622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6039c907e9885991e682e1d0db84c308229153599e2331a4bea08a97d81839ba"
+      "sha256": "138d3c390e59579f2f8b68f2bed364df776af9e1374c62ce6d12dc9a0fe8a43d"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7367,7 +7367,7 @@
     {
       "path": "tests/ship_ci_deploy.mjs",
       "mode": "0000644",
-      "sha256": "02346e000b0b4212a27dce1d2638a52b2e80509eea335110a148886f18ee5b81"
+      "sha256": "de59e8ed0d1a0e30b52994fe1bf3e1864706613a1329d967f74eeae277c1948e"
     },
     {
       "path": "tests/ship_preflight.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.11",
+  "version": "1.19.13",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.11",
+      "version": "1.19.13",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.11",
+  "version": "1.19.13",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -831,27 +831,58 @@ function parseDeployMode(envVal, configRaw) {
   return 'laptop';
 }
 
-// effectiveDeployMode — credential-aware adjustment of the parsed mode (pure;
-// exported for the regression test). The 'laptop' land path pushes main + SSHes
-// the droplet FROM THIS MACHINE, so it requires a local GitHub push credential.
-// A machine without one — a dev box, or a fresh/stale local clone that can't even
-// `git pull` (token-less origin, ADR 0053) — physically cannot run it; it must
-// ship via the 'ci' server-mediated publish path instead (pushVia()==='server',
-// ADR 0055), which lets the GDS server push with its own credential. So when the
-// parsed mode is 'laptop' but the machine can't push locally AND the mode was NOT
-// pinned by an explicit OTB_DEPLOY_MODE, fall back to 'ci' rather than strand
-// every ship at merge. This is the scootermack 2026-06-22 case: a checkout left
-// at the pre-cutover 'laptop' default that can't pull forward to 'ci', so it kept
-// attempting a push it had no credential for. An explicit env override always
-// wins (tests/staging may force 'laptop'); a machine WITH local push creds (a
-// real authed laptop) is byte-for-byte unchanged. Mirrors pushVia()'s existing
-// credential-awareness — the asymmetry (pushVia smart, resolveDeployMode blind)
-// WAS the bug. (task 1449)
-function effectiveDeployMode(mode, { canPushLocally, envForced } = {}) {
+// effectiveDeployMode — credential- and protection-aware adjustment of the parsed
+// mode (pure; exported for the regression test). The 'laptop' land path pushes
+// main + SSHes the droplet FROM THIS MACHINE, so it requires a local GitHub push
+// credential. A machine without one — a dev box, or a fresh/stale local clone that
+// can't even `git pull` (token-less origin, ADR 0053) — physically cannot run it;
+// it must ship via the 'ci' server-mediated publish path instead
+// (pushVia()==='server', ADR 0055), which lets the GDS server push with its own
+// credential. So when the parsed mode is 'laptop' but the machine can't push
+// locally AND the mode was NOT pinned by an explicit OTB_DEPLOY_MODE, fall back to
+// 'ci' rather than strand every ship at merge. This is the scootermack 2026-06-22
+// case: a checkout left at the pre-cutover 'laptop' default that can't pull
+// forward to 'ci', so it kept attempting a push it had no credential for. An
+// explicit env override always wins (tests/staging may force 'laptop'). Mirrors
+// pushVia()'s existing credential-awareness — the asymmetry (pushVia smart,
+// resolveDeployMode blind) WAS the bug. (task 1449)
+//
+// Second input, same shape (task 1002629): a machine WITH push credentials but a
+// branch-PROTECTED main also cannot run the laptop land — GitHub refuses the
+// direct `git push origin main` no matter whose credential it is. When task
+// 1002619 armed protection (required `unit` check), every ship resolved 'laptop'
+// and pushed into the wall, stranding graded-PASS tasks at confirmed (tasks
+// 1002608/1002609; learning 1000177). mainProtected must be STRICTLY true to
+// trigger — null/undefined means the probe couldn't answer (no gh, offline, no
+// permission) and keeps today's behavior rather than rerouting on a guess.
+function effectiveDeployMode(mode, { canPushLocally, envForced, mainProtected } = {}) {
   if (mode === 'laptop' && !envForced && !canPushLocally) return 'ci';
+  if (mode === 'laptop' && !envForced && mainProtected === true) return 'ci';
   return mode;
 }
 
+// mainIsProtected — true/false when GitHub answers, null when it can't. The
+// `gh api` resolves {owner}/{repo} from the checkout's origin; any failure
+// (gh missing, offline, non-200) is null = unknown, which effectiveDeployMode
+// treats as "no change". Same spawn discipline as ghAvailableAndAuthed().
+function mainIsProtected() {
+  try {
+    const r = spawnSync('gh', ['api', 'repos/{owner}/{repo}/branches/main', '--jq', '.protected'], {
+      encoding: 'utf8',
+      shell: process.platform === 'win32',
+      windowsHide: true,
+      timeout: 15000,
+    });
+    if (!r || r.error || r.status !== 0) return null;
+    const out = String(r.stdout || '').trim();
+    if (out === 'true') return true;
+    if (out === 'false') return false;
+    return null;
+  } catch (_) {
+    return null;
+  }
+}
+
 function resolveDeployMode() {
   const configRaw = readDeployConfigRaw();
   const mode = parseDeployMode(process.env.OTB_DEPLOY_MODE, configRaw);
@@ -860,9 +891,17 @@ function resolveDeployMode() {
   );
   // Probe `gh` ONLY when it can change the answer (resolved 'laptop', no env
   // override) — the happy 'ci' path and an env-pinned mode spawn no extra gh,
-  // keeping the documented spawn discipline (the line-1019 note).
+  // keeping the documented spawn discipline (the line-1019 note). The protection
+  // probe runs only when the credential check kept us on 'laptop' (a
+  // credential-less machine already falls back without it).
   if (mode === 'laptop' && !envForced) {
-    return effectiveDeployMode(mode, { canPushLocally: ghAvailableAndAuthed(), envForced });
+    const canPushLocally = ghAvailableAndAuthed();
+    const mainProtected = canPushLocally ? mainIsProtected() : null;
+    const effective = effectiveDeployMode(mode, { canPushLocally, envForced, mainProtected });
+    if (effective === 'ci' && mainProtected === true) {
+      console.log('  deploy mode: main is branch-protected (direct pushes refused) — landing via the ci PR path');
+    }
+    return effective;
   }
   return mode;
 }
@@ -2486,6 +2525,13 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     // cross-platform reason as the other node spawns here (#660).
     if (!shellOk(`"${process.execPath}" ${JSON.stringify(path.join(__dirname, 'push-main.js'))}`, { cwd: REPO_ROOT })) {
       console.log('  auto-merge: push failed; task stays at confirmed');
+      // task 1002629: a branch-protected main refuses EVERY direct push, so
+      // retrying here can never work — resolveDeployMode normally reroutes to
+      // the ci PR path before this point; reaching this with protection on
+      // means an env-forced 'laptop' or a failed protection probe.
+      if (mainIsProtected() === true) {
+        return landBailed('main is branch-protected — the direct push can never land; unset OTB_DEPLOY_MODE (the ci PR path lands it)', `node scripts/gds/ship.js ${taskId}`);
+      }
       return landBailed('could not push the merged main to origin', '/merge-mode');
     }
 

package/src/module-api.js

@@ -449,8 +449,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.9 with no explicit bump. run 31277644352. (task 1002620)
 //   1.19.11 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.10 with no explicit bump. run 31277735279. (task 1002620)
+//   1.19.12 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.11 with no explicit bump. run 31277905072. (task 1002620)
+//   1.19.13 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.12 with no explicit bump. run 31277989346. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.11'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.13'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_ci_deploy.mjs

@@ -544,6 +544,42 @@ test('effectiveDeployMode: tolerates a missing options object (defaults to no fa
   assert.equal(effectiveDeployMode('laptop'), 'ci'); // canPushLocally undefined ⇒ falsy ⇒ fall back
 });
 
+// ---- 10b. effectiveDeployMode: a PROTECTED main never strands a push-capable laptop (task 1002629) ----
+//
+// The wave-4 strand: task 1002619 armed branch protection on main (required
+// `unit` check), so the laptop land's direct `git push origin main` is refused
+// by GitHub for EVERY ship. A machine WITH push credentials resolved 'laptop'
+// and pushed straight into the wall — tasks 1002608/1002609 graded PASS, then
+// stranded at confirmed (learning 1000177). Credential-awareness (task 1449,
+// section 10) cannot see this: the credential is fine, the REF is protected.
+// Same fix shape, second input. mainProtected must be STRICTLY true to trigger
+// — unknown (null/undefined: no gh, offline, no permission) keeps today's
+// behavior rather than silently rerouting on a failed probe.
+
+test('effectiveDeployMode: laptop + CAN push + main PROTECTED + not env-forced → ci (the fix)', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: false, mainProtected: true }), 'ci');
+});
+
+test('effectiveDeployMode: laptop + main protected but ENV-FORCED → laptop (explicit override wins)', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: true, mainProtected: true }), 'laptop');
+});
+
+test('effectiveDeployMode: laptop + protection UNKNOWN → laptop (a failed probe must not reroute)', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: false, mainProtected: null }), 'laptop');
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: false, mainProtected: undefined }), 'laptop');
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: true, envForced: false }), 'laptop');
+});
+
+test('effectiveDeployMode: ci stays ci for every protection value', () => {
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: true, envForced: false, mainProtected: true }), 'ci');
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: true, envForced: true, mainProtected: false }), 'ci');
+  assert.equal(effectiveDeployMode('ci', { canPushLocally: false, envForced: false, mainProtected: null }), 'ci');
+});
+
+test('effectiveDeployMode: both fallbacks compose — credential rule fires even when protection is unknown', () => {
+  assert.equal(effectiveDeployMode('laptop', { canPushLocally: false, envForced: false, mainProtected: null }), 'ci');
+});
+
 // ---- task 1002606: the success-pending banner carries the strand-detection story ----
 // Finding P-3: the banner ended at "This is NOT a failure", so when a land DID die
 // (hand-written conflict, dead PR, red check) the builder's last signal said all was