@bongos/core 1.19.130 → 1.19.132

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.130",
-  "core_contract": "1.19.130",
-  "source_commit": "9cfc165fbc5b116976ad07e249f0ed45287f3bcf",
+  "core_version": "1.19.132",
+  "core_contract": "1.19.132",
+  "source_commit": "450f890ee24a473026548ea2cf82cf69ac1d6d9c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T03:15:08.211Z",
+  "built_at": "2026-08-15T03:38:15.933Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1246,
+    "functional_verbatim": 1248,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1570,
-  "tree_sha256": "9c3f424caabdd8755729a2c59370b4ea6c2c0e14f591297b3769f3f18ae3da41",
+  "file_count": 1572,
+  "tree_sha256": "d0e21da3aa85bb9e774ef6c921a2cc4be514b8dab592b7a1b3fa8bb07e8be485",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4172,12 +4172,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d530560bb0e2b69c73bba650529a2d45f3bb4c09728c54e012987f4340681c93"
+      "sha256": "26a0143ba944f1edf0c163992ecd6f447fa911d16d7b8161578c7b1bc6725a48"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c4c6038789240a0e60015e8501ad5aa572b1c630d0754ee65147acb5a10bb5b"
+      "sha256": "763b31a597012a53b4f7b6c0c0ce9a30e10ba13206468820d16dcc5d04d972ec"
     },
     {
       "path": "public-docs/index.html",
@@ -4767,7 +4767,7 @@
     {
       "path": "scripts/gds/docs-entropy.js",
       "mode": "0000644",
-      "sha256": "afeea5e6c75a8cb7ac9bb8ee3eefc828102866dc3ae6836b0dc28946c56cb330"
+      "sha256": "1a7cbe47158e4de63c1b788d6bb4f682584723a45c1824ab2ae3fbf92a54fbce"
     },
     {
       "path": "scripts/gds/doctor.js",
@@ -5157,7 +5157,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "5ff111416adc80a4513bc91488185f5f47800f16c1fe8b746e0982ee9b4ffeb9"
+      "sha256": "4c3bef6907b4807d93426e754ff20c75e56b498e4302c1cd47e4b3953bd8b4d0"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5322,7 +5322,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "7ae14021dbae94ffc5a70cf05081e645ca2dcf9685ccf135658538cb44e79dde"
+      "sha256": "681de343f8491a2f22165246f21ac371a8f76411b395991c784635e8e9646ed7"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5762,7 +5762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d7733ec4964e2aff924d904ee73784843f81ea72c3e2eeb6f3c7ea816c62ceb6"
+      "sha256": "9754ad61248f7a9ccf1b4361bf7de1895318872a4994f74f53668151c60f8aeb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6242,7 +6242,7 @@
     {
       "path": "tests/cloud_bongos_pack.mjs",
       "mode": "0000644",
-      "sha256": "715fecde91ee9dff56dfca9b9da46a47b49322b0dd50aad1bd606491f551fe06"
+      "sha256": "087d0379a559ebb858e8e42458754cfb93720a5222e5f85fb81995851ce811be"
     },
     {
       "path": "tests/conductor.mjs",
@@ -6484,6 +6484,11 @@
       "mode": "0000644",
       "sha256": "d9fd04cc3f2fcb3b4a9945c1e743c44445a216a10648fa619f74716b381468f3"
     },
+    {
+      "path": "tests/docs_entropy.mjs",
+      "mode": "0000644",
+      "sha256": "4d64164d45d6b81d706074b8394da4f3d0f7f8c5263a37a287a163d6a746a96b"
+    },
     {
       "path": "tests/docs_openapi_route.mjs",
       "mode": "0000644",
@@ -7654,6 +7659,11 @@
       "mode": "0000644",
       "sha256": "23731936e26feb6406333f484c86210be2f2eaee1b4060ba34c9e03f8fd09685"
     },
+    {
+      "path": "tests/ship_publish_error.mjs",
+      "mode": "0000644",
+      "sha256": "eb8c52362355479a50c83ba84968d605b93f98e93513cf8436dd096e6514f6e8"
+    },
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
@@ -7767,7 +7777,7 @@
     {
       "path": "tests/subdomain_auth.mjs",
       "mode": "0000644",
-      "sha256": "e28409f9063a36482482bcb295de5c629430dd28c53a03e1b3c979d5566306dd"
+      "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
     },
     {
       "path": "tests/task_classifier_vocab.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.130",
+  "version": "1.19.132",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.130",
+      "version": "1.19.132",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.130",
+  "version": "1.19.132",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/docs-entropy.js

@@ -16,37 +16,50 @@
 //
 // Exit codes:
 //   0  scan complete
-//   1  fatal error
+//   1  fatal error (including a scan defect: zero markdown files enumerated)
 
 'use strict';
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { execSync } = require('node:child_process');
-const { hasFlag, cliClient, requireSession } = require('./cli-lib');
+const { execFileSync } = require('node:child_process');
+const { hasFlag, cliClient, requireSession, cliExit } = require('./cli-lib');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const MIN_DUPE_CHARS = 120;    // minimum paragraph length to flag as duplicate
 const MAX_DUPES_REPORTED = 20; // cap to avoid flooding the report
 
-// Shell helper — returns stdout or null on failure.
-function sh(cmd) {
+// ---------- file collection ----------
+
+// argv array, never a shell string: `git ls-files '*.md'` as a string runs
+// through cmd.exe on Windows, where the quotes are literal, so git matched
+// nothing and the whole scan reported on zero files (task 1002526).
+function gitLsFiles(args) {
   try {
-    return execSync(cmd, {
+    return execFileSync('git', args, {
       cwd: REPO_ROOT,
       encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-  } catch (_) {
-    return null;
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (err) {
+    const detail = String(err.stderr || err.message || '').trim();
+    throw new Error(`docs-entropy: \`git ${args.join(' ')}\` failed in ${REPO_ROOT}: ${detail}`);
   }
 }
 
-// ---------- file collection ----------
-
-function collectMarkdownFiles() {
-  const out = sh("git ls-files '*.md'");
-  return out ? out.split('\n').map(f => f.trim()).filter(Boolean) : [];
+// Throws rather than returning [] — an empty enumeration in a repo that tracks
+// hundreds of .md files is a broken scan, and a lint that silently reports on
+// nothing is worse than one that fails.
+function collectMarkdownFiles({ run = gitLsFiles } = {}) {
+  const out = run(['ls-files', '*.md']);
+  const files = String(out || '').split('\n').map(f => f.trim()).filter(Boolean);
+  if (!files.length) {
+    throw new Error(
+      `docs-entropy: scan defect — enumerated 0 tracked markdown files under ${REPO_ROOT}. ` +
+      'This repo tracks hundreds, so this is a broken scan (bad git invocation or wrong cwd), not a clean result.'
+    );
+  }
+  return files;
 }
 
 // ---------- parsing ----------
@@ -326,10 +339,12 @@ async function docsEntropyMain() {
   const fileIdeas = hasFlag('--file-ideas', args);
   const verbose   = hasFlag('--verbose', args);
 
-  const relFiles = collectMarkdownFiles();
-  if (!relFiles.length) {
-    console.error('docs-entropy: no tracked markdown files found');
-    process.exit(1);
+  let relFiles;
+  try {
+    relFiles = collectMarkdownFiles();
+  } catch (err) {
+    console.error(err.message);
+    return cliExit(1);
   }
 
   const linkFindings  = scanStaleLinks(relFiles);
@@ -350,9 +365,12 @@ async function docsEntropyMain() {
   };
 
   if (asJson) {
+    // cliExit, not process.exit: the JSON here can run well past the 64KB pipe
+    // buffer, and process.exit() drops unflushed stdout — CI saw the payload
+    // truncated mid-string (PR 148's flaky unit run). Natural exit flushes.
     console.log(JSON.stringify(result, null, 2));
     if (fileIdeas) await fileToInbox(staleLinks, brokenAnchors, dupes);
-    process.exit(0);
+    return cliExit(0);
   }
 
   console.log('Docs entropy scan');
@@ -390,13 +408,13 @@ async function docsEntropyMain() {
     await fileToInbox(staleLinks, brokenAnchors, dupes);
   }
 
-  process.exit(0);
+  cliExit(0);
 }
 
 if (require.main === module) {
   docsEntropyMain().catch((err) => {
     console.error('fatal:', err);
-    process.exit(1);
+    cliExit(1);
   });
 }
 

package/scripts/gds/run-unit-tests.js

@@ -77,7 +77,7 @@ const INTEGRATION = new Set([
   'governance_fold_bench', 'governance_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'reward_mode_cost_plus_only',
   'session_records', 'setup_smoke',
-  'status-probe', 'subdomain_auth',
+  'status-probe',
 ]);
 
 // Excluded so this gate is trustworthy in a CLEAN checkout (the CI condition):

package/scripts/gds/ship.js

@@ -1213,6 +1213,34 @@ async function ciLand(taskId, branch, valueSummary) {
   return await ciLandLocal(taskId, branch, valueSummary);
 }
 
+// task 1001916: render a FAILED POST /tasks/:id/publish-branch for the builder.
+// The server has carried { step, reason } — which git step failed + the
+// credential-scrubbed stderr — since task 1547, but the bail site printed only
+// `data.message || data.error`: "[object Object]" on the ADR 0116 envelope, a
+// bare `publish_failed` on the legacy flat shape. That hid a non-fast-forward
+// rejection (the server had already freshened the branch itself) across several
+// blind retry laps, so that case also gets its specific remedy. Pure + exported
+// for tests/ship_publish_error.mjs (no git, no network).
+const NON_FAST_FORWARD_RE = /fetch first|non-fast-forward/i;
+
+function formatPublishFailure(data, status, branch) {
+  const { code, message } = normalizeApiError(data);
+  const envelopeDetails = (data && data.error && typeof data.error === 'object' && data.error.details) || null;
+  const details = envelopeDetails || data || {};
+  const label = message || code || (data && data.message) || `HTTP ${status}`;
+  // git stderr is multi-line; this is embedded mid-sentence in one log line.
+  const reason = details.reason ? String(details.reason).replace(/\s+/g, ' ').trim() : '';
+  const parts = [];
+  if (details.step) parts.push(`step: ${details.step}`);
+  if (reason) parts.push(`reason: ${reason}`);
+  let out = parts.length ? `${label} (${parts.join('; ')})` : label;
+  if (NON_FAST_FORWARD_RE.test(reason)) {
+    out += ` — the server already moved ${branch}: fetch origin, reset onto origin/${branch}, `
+      + 're-run the generators, and re-ship so the push fast-forwards.';
+  }
+  return out;
+}
+
 // ciLandServer — the dev-box path: no GitHub push credential on this machine, so
 // hand the branch to the GDS, which pushes it + opens the PR + auto-merges with
 // the server-side credential. Requires a RE-AUTHED (non-box) cli session — a
@@ -1249,7 +1277,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));
     }
     if (!r.ok) {
-      const e = (r.data && (r.data.message || r.data.error)) || `HTTP ${r.status}`;
+      const e = formatPublishFailure(r.data, r.status, branch);
       console.log(`  ci-land: server publish failed — ${e}. Task stays at confirmed. ${strandNextStep(taskId, 'server')}`);
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
@@ -4472,6 +4500,10 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1001916: the publish-branch failure formatter — exported pure so both
+  // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
+  // non-fast-forward remedy hint are pinned without a server.
+  formatPublishFailure,
   // task 1719: pure post-land status reconciler — a task that reached 'shipped'
   // in-session shows the SHIPPED banner + writes no breadcrumb; otherwise keep the
   // pre-merge status (confirmed → next-turn breadcrumb fallback). Exported for tests.

package/src/module-api.js

@@ -687,8 +687,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.128 with no explicit bump. run 31858158416. (task 1002620)
 //   1.19.130 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.129 with no explicit bump. run 31861289412. (task 1002620)
+//   1.19.131 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.130 with no explicit bump. run 31861682626. (task 1002620)
+//   1.19.132 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.131 with no explicit bump. run 31862317758. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.130'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.132'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cloud_bongos_pack.mjs

@@ -71,14 +71,16 @@ test('R74: themeMarkup paints the backdrop only when the pack supplies one', ()
   assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:.+\}/);
 });
 
-test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (task 1374)', () => {
+test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (task 1374)', (t) => {
   // The live dogfood instance runs from the SAME checkout as OTB; the env knob
   // points this process at its own pack (deltas over neutral) instead of OTB's
   // config/branding.json. Proves the brand-switch + the cloudbongos pack content.
   // Both packs are INSTANCE content — the neutral core ships neither, so this
   // asserts one deployment's config (task 1002470). The selector MECHANISM is
   // proven unconditionally by the fixture test below.
-  if (!existsSync(join(ROOT, 'config/branding.cloudbongos.json'))) return;
+  // Report the absence as a SKIP, not a silent pass — a case that asserts nothing
+  // must not read as green coverage (task 1002526).
+  if (!existsSync(join(ROOT, 'config/branding.cloudbongos.json'))) return t.skip('no config/branding.cloudbongos.json on this checkout');
   const b = loadBranding({ env: { GDS_BRANDING_FILE: 'config/branding.cloudbongos.json' } });
   assert.equal(b.identity.productName, 'Cloud Bongos'); // from neutral
   assert.equal(b.currency.label, 'credits');            // from neutral, not "drachmae"
@@ -91,11 +93,11 @@ test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (t
   assert.equal(b.firstAdmin, 'lars589');
 });
 
-test('customer-0: no GDS_BRANDING_FILE still resolves the instance pack (default unchanged)', () => {
+test('customer-0: no GDS_BRANDING_FILE still resolves the instance pack (default unchanged)', (t) => {
   // The OTB process (server.js) sets no GDS_BRANDING_FILE → config/branding.json.
   // Same instance-content caveat as above: with no instance pack the correct default
   // IS the neutral starter, which is what the vanilla tests in this file already pin.
-  if (!existsSync(INSTANCE_PATH)) return;
+  if (!existsSync(INSTANCE_PATH)) return t.skip('no config/branding.json (instance pack) on this checkout');
   const b = loadBranding({ env: {} });
   assert.notDeepEqual(b.identity, vanilla().identity, 'the instance pack must win over neutral by default');
 });

package/tests/docs_entropy.mjs

@@ -0,0 +1,55 @@
+// tests/docs_entropy.mjs — the markdown entropy lint actually scans (task 1002526).
+//
+// The bug this pins: collectMarkdownFiles() shelled out to the STRING
+// `git ls-files '*.md'`. On Windows that runs through cmd.exe, where the single
+// quotes are literal, so git matched nothing — docs-entropy reported on zero
+// files on every Windows checkout, a lint that proved nothing. Two guarantees:
+//   1. enumeration goes through an argv ARRAY (no shell quoting to get wrong),
+//   2. zero tracked markdown files is treated as a SCAN DEFECT and errors
+//      loudly — this repo tracks hundreds, so an empty result is never real.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCANNER = path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js');
+const { collectMarkdownFiles } = require(SCANNER); // require.main-guarded → no scan on import
+
+test('collectMarkdownFiles passes the glob as an argv array, never a shell string', () => {
+  let seen = null;
+  const files = collectMarkdownFiles({ run: (args) => { seen = args; return 'a.md\nb.md\n'; } });
+  assert.ok(Array.isArray(seen), 'git args must be an array — a shell string is what broke Windows');
+  assert.deepEqual(seen, ['ls-files', '*.md'], 'the glob reaches git unquoted');
+  assert.deepEqual(files, ['a.md', 'b.md']);
+});
+
+test('zero tracked markdown files is a loud scan defect, not a clean empty result', () => {
+  assert.throws(
+    () => collectMarkdownFiles({ run: () => '' }),
+    /scan defect/i,
+    'an empty enumeration must name itself a defect so the lint cannot silently prove nothing',
+  );
+});
+
+test('a failing git invocation propagates instead of collapsing to zero files', () => {
+  // The old sh() helper caught every failure and returned null → [] → a scan of
+  // nothing. The enumeration must never swallow its own failure.
+  assert.throws(
+    () => collectMarkdownFiles({ run: () => { throw new Error('not a git repository'); } }),
+    /not a git repository/,
+  );
+});
+
+test('the real scan enumerates the repo (the regression: it reported on 0 files)', () => {
+  const stdout = execFileSync(process.execPath, [SCANNER, '--json'], {
+    cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+  });
+  const result = JSON.parse(stdout);
+  assert.ok(result.scanned_files > 50, `expected hundreds of markdown files, scanned ${result.scanned_files}`);
+  assert.ok(Number.isFinite(result.stale_links));
+  assert.ok(Number.isFinite(result.broken_anchors));
+});

package/tests/ship_publish_error.mjs

@@ -0,0 +1,119 @@
+// tests/ship_publish_error.mjs
+//
+// Unit tests for formatPublishFailure (scripts/gds/ship.js, task 1001916) — the
+// display string ciLandServer prints when POST /tasks/:id/publish-branch fails.
+//
+// Why this exists: the server has carried { step, reason } (the credential-
+// scrubbed git stderr) since task 1547, but ciLandServer printed only
+// `r.data.message || r.data.error`. On the ADR 0116 envelope that renders
+// "[object Object]", and on the legacy flat shape a bare "publish_failed" — so a
+// non-fast-forward rejection (the server had already freshened the branch) was
+// invisible and the builder retried blind for several laps. What we prove here:
+//   1. Both wire shapes resolve to the CODE, never "[object Object]".
+//   2. step + reason appear when the server sent them.
+//   3. A non-fast-forward reason carries the specific remedy hint (reset onto
+//      origin/<branch>, re-run the generators, re-ship) — and only then.
+// Pure: no network, no git, no fs.
+//
+// Run:  node tests/ship_publish_error.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const BRANCH = 'claude/task-1001916';
+const fmt = (data, status = 500, branch = BRANCH) => ship.formatPublishFailure(data, status, branch);
+
+// ---------- 1. bare error, no step/reason ----------
+
+test('legacy flat { error: code } with no details reads as the bare code', () => {
+  const out = fmt({ error: 'publish_failed' });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/step:/.test(out), 'no step was sent, so none is invented');
+  assert.ok(!/reason:/.test(out), 'no reason was sent, so none is invented');
+});
+
+test('ADR 0116 envelope with no details resolves to the code, never [object Object]', () => {
+  const out = fmt({ error: { code: 'publish_failed', message: 'publish_failed' } });
+  assert.match(out, /publish_failed/);
+  assert.ok(!/\[object Object\]/.test(out), 'the envelope object must never be stringified raw');
+});
+
+test('no body at all falls back to the HTTP status', () => {
+  assert.match(fmt(null, 502), /HTTP 502/);
+});
+
+// ---------- 2. error + step + reason ----------
+
+test('envelope details carry step + reason into the message', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'remote: Permission to org/repo.git denied' },
+    },
+  });
+  assert.match(out, /publish_failed/);
+  assert.match(out, /step: push/);
+  assert.match(out, /Permission to org\/repo\.git denied/);
+});
+
+test('legacy flat top-level step + reason are surfaced the same way', () => {
+  const out = fmt({ error: 'publish_failed', step: 'fetch', reason: 'could not read Username' });
+  assert.match(out, /step: fetch/);
+  assert.match(out, /could not read Username/);
+});
+
+test('a non-git failure reason gets NO fast-forward remedy hint', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'Permission denied (publickey)' });
+  assert.ok(!/fast-forward/i.test(out), 'the remedy hint is for a stale-branch push only');
+  assert.ok(!/reset/i.test(out), 'nor the reset instruction');
+});
+
+// ---------- 3. the non-fast-forward remedy hint ----------
+
+const NON_FF_STDERR =
+  '! [rejected] claude/task-1001916 -> claude/task-1001916 (fetch first)\n' +
+  "error: failed to push some refs to 'github.com/org/repo.git'";
+
+test('a "fetch first" rejection names the branch and the reset-onto-origin remedy', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: NON_FF_STDERR });
+  assert.match(out, /step: push/);
+  assert.match(out, new RegExp(`origin/${BRANCH}`), 'points at the ref the server already moved');
+  assert.match(out, /reset/i, 'names the reset');
+  assert.match(out, /generator/i, 'and the regenerate step before re-shipping');
+  assert.match(out, /re-ship|fast-forward/i, 'and why: so the push fast-forwards');
+  assert.ok(!/\n/.test(out), 'multi-line git stderr is collapsed — this goes mid-sentence into one log line');
+});
+
+test('the "non-fast-forward" wording triggers the same hint through the envelope', () => {
+  const out = fmt({
+    error: {
+      code: 'publish_failed',
+      message: 'publish_failed',
+      details: { step: 'push', reason: 'Updates were rejected: non-fast-forward' },
+    },
+  });
+  assert.match(out, new RegExp(`origin/${BRANCH}`));
+  assert.match(out, /reset/i);
+});
+
+console.log('');
+console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/subdomain_auth.mjs

@@ -1,14 +1,46 @@
 // tests/subdomain_auth.mjs — the builders-subdomain auth helpers (#726).
 //
 // Locks down the two security-sensitive pure helpers added for the dedicated
-// builders.amazonprimea.com subdomain:
+// builders.<apex> subdomain:
 //   - safeReturnTo: the open-redirect guard on the post-sign-in return target.
 //   - sessionCookieDomainOpts: which hosts get an apex-scoped session cookie
 //     (so one sign-in spans the subdomains) vs a host-only one (localhost,
 //     staging — which must NOT bleed a token across environments).
 // Pure functions, no DB — requiring the route module does not open a pool.
+//
+// Both helpers derive their allowed hosts from the instance branding pack's
+// domains.cookieDomain, so the fixtures inject a SYNTHETIC pack (the
+// GDS_BRANDING_FILE seam, as tests/single_host_hall.mjs does) instead of
+// reading whatever config/branding.json happens to be on disk. That keeps the
+// assertions identical on every instance — the neutral core (cookieDomain "")
+// and a branded host alike. envPrefix is overridden too so an ambient
+// <PREFIX>_COOKIE_DOMAIN in the shell cannot reach the resolver.
+//
+// Run:  node tests/subdomain_auth.mjs
 
 import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// The apex every fixture below is built from. RFC 2606 reserved TLD — clearly
+// synthetic, never routable, and no host brand is baked into this file.
+const APEX = 'bongos-test.example';
+
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-subdomain-auth-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'SUBDOMAIN_AUTH_FIXTURE',
+  // Leading dot mirrors the real packs; configuredCookieApex() strips it.
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}` },
+}));
+process.env.GDS_BRANDING_FILE = brandFile;
+// The pack is only read once (auth.js resolves COOKIE_APEX at module load);
+// remove the temp dir on every exit path so runs don't accumulate in tmpdir.
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+// Required AFTER the pack is in place — auth.js resolves COOKIE_APEX at module
+// load, and branding() memoizes on its first call.
 const require = createRequire(import.meta.url);
 const authRoute = require('../src/bongos/routes/auth.js');
 
@@ -24,15 +56,15 @@ console.log('\nsafeReturnTo — accepts safe same-city targets:');
 ok(safeReturnTo('/builders') === '/builders', 'relative /builders');
 ok(safeReturnTo('/watch') === '/watch', 'relative /watch');
 ok(safeReturnTo('/builders/settings?x=1') === '/builders/settings?x=1', 'relative path with query');
-ok(safeReturnTo('https://builders.amazonprimea.com/watch') === 'https://builders.amazonprimea.com/watch', 'absolute builders subdomain');
-ok(safeReturnTo('https://amazonprimea.com/builders') === 'https://amazonprimea.com/builders', 'absolute apex');
-ok(safeReturnTo('https://status.amazonprimea.com/') === 'https://status.amazonprimea.com/', 'absolute status subdomain');
+ok(safeReturnTo(`https://builders.${APEX}/watch`) === `https://builders.${APEX}/watch`, 'absolute builders subdomain');
+ok(safeReturnTo(`https://${APEX}/builders`) === `https://${APEX}/builders`, 'absolute apex');
+ok(safeReturnTo(`https://status.${APEX}/`) === `https://status.${APEX}/`, 'absolute status subdomain');
 
 console.log('\nsafeReturnTo — rejects everything else (→ null, caller falls back):');
 ok(safeReturnTo('//evil.com') === null, 'protocol-relative //evil.com');
 ok(safeReturnTo('https://evil.com/builders') === null, 'foreign https origin');
-ok(safeReturnTo('https://amazonprimea.com.evil.com/') === null, 'lookalike suffix host');
-ok(safeReturnTo('http://amazonprimea.com/builders') === null, 'http (non-https) apex');
+ok(safeReturnTo(`https://${APEX}.evil.com/`) === null, 'lookalike suffix host');
+ok(safeReturnTo(`http://${APEX}/builders`) === null, 'http (non-https) apex');
 ok(safeReturnTo('javascript:alert(1)') === null, 'javascript: scheme');
 ok(safeReturnTo('/path\\with\\backslash') === null, 'backslash path');
 ok(safeReturnTo('') === null, 'empty');
@@ -43,15 +75,15 @@ ok(safeReturnTo('builders') === null, 'bare word (no leading slash, not a URL)')
 // ---- sessionCookieDomainOpts: cross-subdomain scoping ----------------------
 const reqWith = (host) => ({ headers: { host } });
 console.log('\nsessionCookieDomainOpts — apex-scoped on production hosts:');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com')).domain === '.amazonprimea.com', 'apex → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('www.amazonprimea.com')).domain === '.amazonprimea.com', 'www → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('builders.amazonprimea.com')).domain === '.amazonprimea.com', 'builders → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('status.amazonprimea.com')).domain === '.amazonprimea.com', 'status → .amazonprimea.com');
-ok(sessionCookieDomainOpts(reqWith('amazonprimea.com:3000')).domain === '.amazonprimea.com', 'apex with port');
+ok(sessionCookieDomainOpts(reqWith(APEX)).domain === `.${APEX}`, `apex → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`www.${APEX}`)).domain === `.${APEX}`, `www → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`builders.${APEX}`)).domain === `.${APEX}`, `builders → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`status.${APEX}`)).domain === `.${APEX}`, `status → .${APEX}`);
+ok(sessionCookieDomainOpts(reqWith(`${APEX}:3000`)).domain === `.${APEX}`, 'apex with port');
 
 console.log('\nsessionCookieDomainOpts — host-only elsewhere (no domain key):');
 ok(sessionCookieDomainOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
-ok(sessionCookieDomainOpts(reqWith('staging.amazonprimea.com')).domain === undefined, 'staging → host-only (no cross-env bleed)');
+ok(sessionCookieDomainOpts(reqWith(`staging.${APEX}`)).domain === undefined, 'staging → host-only (no cross-env bleed)');
 ok(sessionCookieDomainOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
 
 console.log(`\nSubdomain-auth tests: ${pass} passed, ${fail} failed`);