@bongos/core 1.19.20 → 1.19.21

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.20",
-  "core_contract": "1.19.20",
-  "source_commit": "d355706e8d215aa4e9b9ee249ef71670aa067e17",
+  "core_version": "1.19.21",
+  "core_contract": "1.19.21",
+  "source_commit": "1bcacbc141d1103f3b8e89d9c3963369740c783d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-10T01:27:05.376Z",
+  "built_at": "2026-08-11T00:39:38.782Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 284,
+    "docs_redacted": 285,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1203,
+    "functional_verbatim": 1204,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1508,
-  "tree_sha256": "793f4a63c1a41cbfbc18422b85bf8f21249f8fe051e8cd6a738b84f0139f5089",
+  "file_count": 1510,
+  "tree_sha256": "1f7f270a9f0d217360d9126213d6c7d752039999b895385c114df75fde81f14f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1264,10 +1264,15 @@
       "mode": "0000644",
       "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
     },
+    {
+      "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
+      "mode": "0000644",
+      "sha256": "f6176799c7731da3d4970b75e882e0ab88e31b1a412c87957b9a5085bfc799c7"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "165327e0c447cf9e549ba9389bc7eed6406a64631a9e2d714f7eb3ee80af8be0"
+      "sha256": "b3ed6866c5042d2ee2f1c5680af8d6ef85d36c70a4f9e208eac2e5922461f6dc"
     },
     {
       "path": "docs/api-reference.md",
@@ -1297,7 +1302,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "f57f118f5b863a82895129c70311a7c87e5424e22a793b82c637db2ee7e345a0"
+      "sha256": "dd85972912629d370d8fc79eff1661001e6b4ba9abe9866181c14fb0782c3131"
     },
     {
       "path": "docs/design-contract.md",
@@ -3997,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d4a29f817b3eaff3cfc617413d909abe57556a519646db6f8e2bc0baeaeb01da"
+      "sha256": "a408615d881c51b175e64ca336475849090253394df3bc7e428bb0e28d79d40e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b13a7ca8bef83027862f8b1aad071c74ec362bd85a1246050e7bc434fd96d346"
+      "sha256": "e9e8deee79bedc058f9870901d7afdb266d99443d4877059ece4e9cbe4501e2f"
     },
     {
       "path": "public-docs/index.html",
@@ -4502,7 +4507,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "91664a0a1338ded41b780179c16040e2c686f6ab92304891cb1bc6ef3ca805b6"
+      "sha256": "9709fcffab1d386c174666788687b1dfd974f141ab552ffd5641abd690259619"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -4692,7 +4697,7 @@
     {
       "path": "scripts/gds/gating.js",
       "mode": "0000644",
-      "sha256": "5de3e4129006035e844efd4c5a2147060228fe6c73fe0bbbf1ead72af2cc405c"
+      "sha256": "a304965e79b5ab717626bfb9c74358334576c69f5aefcefa059d46a092f46172"
     },
     {
       "path": "scripts/gds/gds-db-backup.service",
@@ -4782,7 +4787,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "a58a741f11ea7d34396dcb9e242825bf88326ca2709b7c726a91b06f60f9c24c"
+      "sha256": "e9fbb7ae477a445252f1171851be93fca14f58e4906d030c93d09b37d517ac20"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -5622,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8a34aa5b02db59b8ba5e821be8a0f38c8e6a66f10fccf728187f150ce87e86b3"
+      "sha256": "81389daa63b2184235f45d0eb6d9aec17debbd00a9f7ffb74d7508953f0317ba"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5997,7 +6002,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "d8493f101a0009dd550c1ccf126e5ceb6433013257aa4f307ca68b00788dc77e"
+      "sha256": "98ec16d513074b30de8cd897143e4a3df1b3e54132a09d015b99e13e870de384"
     },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
@@ -6359,6 +6364,11 @@
       "mode": "0000644",
       "sha256": "a5ca654f46407a3172cfa981f399c159c2769b440058eca509f568111614b00c"
     },
+    {
+      "path": "tests/gating_review_retired.mjs",
+      "mode": "0000644",
+      "sha256": "53cd6df5521ee48909b217483163bdf52ecfcc9aa5267f0b8a213c2b4b0f76bc"
+    },
     {
       "path": "tests/gen_freshness.mjs",
       "mode": "0000644",

package/docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md

@@ -0,0 +1,67 @@
+# ADR 0162 — Review gates retired: rank-consistent CI checks only on `main`
+
+**Date:** 2026-08-10
+**Context:** Owner directive (jaxri, Archon), recorded live 2026-08-08–10; idea 1000657 → task 1002635. Amends ADR 0159 (which introduced CODEOWNERS) and the gating posture of ADR 0058/0042.
+**Status:** Accepted. The live half (dropping `require_code_owner_reviews` from branch protection) was applied by the repo-admin account on 2026-08-10 and verified behaviorally (a probe PR touching a formerly-owned path read `mergeStateStatus: CLEAN` on a green `unit` check — PR 32, closed unmerged). This ADR lands the repo half so no re-arm path resurrects the gate.
+
+## The incident that forced the decision
+
+Wave 3 of the rank choke-point remediation built the merge gates inert (required `unit`
+check, `gating.js`, a CODEOWNERS file scoped to the gate-review HARD_FLOOR_GLOBS); task
+1002619 armed them. Within a day, the code-owner review requirement had stranded two
+graded-PASS wave-4 ships (PR 28 sat `BLOCKED` behind a review only the `example-owner` account
+could give) and then blocked the fix for the strand it caused (the ship.js ci-land fix,
+task 1002629, and the release-cascade fix, task 1002636, both touch owned paths).
+
+The mechanics are structural, not incidental. GitHub can only express the gate as
+**accounts** — it has no concept of GDS ranks; PR authors cannot approve their own PRs;
+and on this instance nearly every PR is authored by agent sessions running under the
+owner-archon's daily login. So "code-owner review" degenerates into "one specific
+GitHub account must click on every gate-surface PR," which is:
+
+1. **Identity-pinned, not rank-based** — against the instance's governance principle
+   (ADR 0016; the no-hardcoded-Archon-identity rule).
+2. **The opposite of the remediation's goal.** The owner's words: builders should have
+   *fewer* rank-related shipping problems, not more; a code-owners layer "can only
+   create shipping problems for builders."
+
+## Decision
+
+Review requirements on `main` are **retired permanently**:
+
+- Branch protection carries **required status checks only** (today: `unit`; the
+  `secret-scan` / `gate-review` contexts join when their workflows ship — ADR 0058).
+- `gating.js` `DEFAULT_PROTECTION` sets `required_pull_request_reviews: null`, and
+  `cmdOn` **normalizes both restore paths** (snapshot and default) to null — a snapshot
+  taken while the review gate was live must not resurrect it on an off/on cycle.
+- The `CODEOWNERS` file is **deleted**. The `CODEOWNERS` *glob* stays in
+  `gate-review.js` `HARD_FLOOR_GLOBS`, `protected-surfaces.json`, and the publish
+  denylist — so reintroducing the file is itself a flagged gate-surface change, and the
+  hard-floor path list keeps protecting the same surfaces where it actually enforces
+  (the sandbox gate).
+
+## What now guards the safety machinery
+
+The compensating controls are all rank-consistent and automatic:
+
+| Control | When it bites | Fails |
+|---|---|---|
+| required `unit` check (suite + fitness) | before every merge | closed |
+| gate-review sandbox (task 1002607) | agent ship flow on hard-floor paths | closed |
+| subagent grader panel | every GDS ship | closed |
+| post-merge main-audit (task 1002612, every push) | after any merge, incl. a bypass | audit + revert |
+
+## Consequences
+
+- **Positive:** no human click anywhere in the land path; a graded-PASS ship lands on
+  CI alone; the wave-4/-5 strand class cannot recur; the gate posture matches the
+  rank-first governance principle.
+- **Negative / accepted trade:** there is **no pre-merge human approval on
+  safety-machinery changes**. A compromised or prompt-injected session whose work
+  passes the unit check reaches `main`, and is caught *after* merge by the main-audit
+  rather than before. The owner chose this trade explicitly (2026-08-08, reaffirmed
+  2026-08-10) with the mitigations above in place.
+- **Reversal path:** re-add a CODEOWNERS file, restore a `required_pull_request_reviews`
+  block in `gating.js`, remove the `cmdOn` normalization, and re-apply protection from
+  an admin account. All four are deliberate steps — the gate cannot come back by
+  accident, which is the point of the normalization.

package/docs/adr/README.md

@@ -233,5 +233,6 @@ This keeps the decision history honest and traceable.
 
 | 0160 | [**The authoritative main audit gets a repo-verifiable caller** ([task 1002612](https://cloudbongos.com/builders#/task/1002612)). Findings G-3 + G-8, honest limit S-1: `main-audit.js` — the post-push layer [ADR 0043](<redacted>.md) designates authoritative — had two declared invokers that never existed in this git history, and `audit-authorship.sh` (the no-hardcoded-Archon-identity enforcer) had no caller either and turned out red with 340 pre-existing hits on untouched main (idea 1000653). Now a `main-audit` workflow audits every push to `main` over exactly the pushed `before..after` range (clamped-window fallback); the roster comes from the public leaderboard when no session exists (server-authoritative, login-only keying, an absent builder resolves as unresolved — never falsely trusted); new `--require-roster` makes an empty roster a loud DID-NOT-RUN exit 2 (an audit that cannot fire a blocker must not exit green); the lane runs non-strict per the audit's own zero-false-positive calibration; and `audit-authorship.sh` rides as an advisory job until the 1000653 triage. Detective lane, not a merge gate — deliberately outside the required PR contexts. Rider: the known-failing ratchet caught task 1002611's publish_manifest fix exactly as designed — entry removed, ceiling ratcheted 3 → 2, remaining entries re-owned to [task 1002617](https://cloudbongos.com/builders#/task/1002617), idea 1000542 superseded. Rejected: a GDS token secret (silent-fail dependency the devcontainer lane warned about), `--strict` in CI (permanent red rots into wallpaper), enforcing authorship before triage.](<redacted>.md) | governance / build pipeline |
 | 0161 | [**Publish on merge: every merge to core `main` auto-publishes `@bongos/core`** (task 1002620). Supersedes ADR 0137's manual owner-gated publish after its own "when to revisit" clause fired twice in three weeks: 171 commits/10 days, then 104 commits/5 days, sat on `main` reachable by no pin while every layer reported success. A `publish` workflow rides behind the required `unit` check (`workflow_run`, success-gated): when HEAD's `CORE_VERSION` is already on npm, CI bumps a PATCH via the shape-preserving `bump-version.js` (+ changelog line; pinned by `tests/bump_version.mjs`) and pushes the carrier commit; `package-core --self-verify --publish --live` builds through the fail-closed no-leak gate; the release is tagged `core-v<v>`. A MINOR/MAJOR stays a human in-task edit — it decides what patch-channel subscribers receive unattended (ADR 0136), a call CI must not make. Token custody knowingly reverses (owner-accepted): `NPM_TOKEN` write + `RELEASE_PUSH_TOKEN` PAT as Actions secrets, mitigated by the lane shipping INERT behind the `PUBLISH_ON_MERGE=1` repo variable — an owner kill-switch symmetrical to `gating.js`. Idempotent by version-compare; npm duplicate rejection is the backstop; queued no-cancel concurrency collapses merge races.](<redacted>.md) | build pipeline / distribution |
+| 0162 | [**Review gates retired: rank-consistent CI checks only on `main`** ([task 1002635](https://cloudbongos.com/builders#/task/1002635); owner directive, idea 1000657). Amends ADR 0159. Within a day of task 1002619 arming the merge gates, the code-owner review requirement had stranded two graded-PASS wave-4 ships (PR 28 sat BLOCKED behind a review only the repo-owner account could give) and then blocked the fixes for the strands it caused — structurally, not incidentally: GitHub can only express the gate as *accounts* (no rank concept, no self-approval), so on a solo-archon instance it degenerates into "one named login must click every gate-surface PR" — identity-pinned authority, against ADR 0016's rank principle and the remediation's own goal. Decision: branch protection carries required status checks ONLY; `gating.js` `DEFAULT_PROTECTION` sets `required_pull_request_reviews: null` and `cmdOn` normalizes BOTH restore paths so a pre-retirement snapshot cannot resurrect the gate (`tests/gating_review_retired.mjs` pins it with a counter-example); the CODEOWNERS *file* is deleted while its *glob* stays in the hard-floor lists so reintroducing it is itself gate-flagged. Accepted trade, chosen explicitly by the owner: no pre-merge human approval on safety-machinery changes — the unit check, the fail-closed gate-review sandbox, the grader panel, and the every-push main-audit are the net, catching a compromised session's merge after the fact rather than before.](<redacted>.md) | governance / build pipeline |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/canonical-permissions.md

@@ -250,11 +250,14 @@ Authority over *the code itself* rides the same ladder, enforced server-side fro
 
 ADR 0016's per-request rank check covers `/api/gds/*` only. Two surfaces it does **not** cover —
 `git push` to `main` and `ssh` to the droplet — were used in the Builder 25 incident to land an
-un-graded tiering change straight on prod `main`. The repo is a free-plan private repo, so GitHub
-branch protection is unavailable; the enforcement is therefore code-side, in three layers (ADR 0043).
-**Verified still true 2026-07-24** — no classic protection, no rulesets, no CODEOWNERS, and a
-non-admin merged PR #19 to `main` with zero required checks; see ADR 0043 §"Branch-protection status"
-for the probes. `main-audit.js` is therefore still the *authoritative* layer, not a backup one:
+un-graded tiering change straight on prod `main`. **Since 2026-08-08 (task 1002619), `main` HAS
+live branch protection: the required `unit` status check blocks every direct push, so all work
+lands via PR.** The protection is *checks-only* — a code-owner review requirement was briefly
+enforced and then deliberately retired by the owner (ADR 0162, task 1002635): gates are
+rank-consistent CI checks, never a named human's approval. (The 2026-07-24 state — no protection
+at all, PR #19 merged with zero checks — is preserved in ADR 0043 §"Branch-protection status" as
+history.) `main-audit.js` remains the authoritative *post-merge* layer — it catches what any
+pre-merge gate misses, independent of the builder's cooperation:
 
 - A builder **below Metic** (`xenos`, `thetes`) may **not modify permission-sensitive paths** — the
   rank/authz machinery, the ship/grade/deploy pipeline, DB `migrations/`, `infra/`, and the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.20",
+  "version": "1.19.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.20",
+      "version": "1.19.21",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.20",
+  "version": "1.19.21",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -72,5 +72,19 @@ function main() {
   console.log(JSON.stringify({ from, to, applied: apply }));
 }
 
-module.exports = { bumpPatch, CONST_RE };
+// The commit subject THIS lane writes for its own bump commits — publish.yml's
+// `git commit -m` mirrors it verbatim (tests/bump_version.mjs pins the two
+// against each other). isReleaseCommit is the cascade terminator (task 1002636):
+// publish.yml no-ops when current main HEAD matches, because everything at that
+// HEAD was already published by the run that created the commit. Deliberately
+// narrow — a HUMAN release commit ("release: core 1.19.2 — carrier for the
+// init-blocker fixes") must NOT match: that version is new and still needs
+// publishing.
+const RELEASE_COMMIT_RE = /^release: core \d+\.\d+\.\d+ — CI auto-patch carrier \(publish-on-merge/;
+
+function isReleaseCommit(subject) {
+  return RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
+}
+
+module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit };
 if (require.main === module) main();

package/scripts/gds/gating.js

@@ -2,13 +2,17 @@
 // scripts/gds/gating.js — owner kill-switch for main-branch merge gating.
 //
 // What "gating" means here — TWO independent levers, both toggled together:
-//   1. GitHub branch protection on `main`: required status checks + required
-//      code-owner review (CODEOWNERS). The required contexts are ONLY checks
-//      that exist and can pass today — currently `unit` (the suite + fitness
-//      lane, task 1002610). The planned `secret-scan` and `gate-review`
-//      contexts (ADR 0058 phase 3; CORE_EXPECTED_CHECKS in adopt-preflight.js)
-//      join DEFAULT_PROTECTION when their workflows ship — requiring a context
-//      nothing reports blocks every merge indefinitely (D-12, ADR 0159).
+//   1. GitHub branch protection on `main`: required status checks ONLY — no
+//      review requirement of any kind (ADR 0162, task 1002635: the owner
+//      retired the code-owner/human-approval layer after it stranded graded
+//      work; gates are rank-consistent CI checks, and the normalization in
+//      cmdOn keeps a pre-retirement snapshot from resurrecting it). The
+//      required contexts are ONLY checks that exist and can pass today —
+//      currently `unit` (the suite + fitness lane, task 1002610). The planned
+//      `secret-scan` and `gate-review` contexts (ADR 0058 phase 3;
+//      CORE_EXPECTED_CHECKS in adopt-preflight.js) join DEFAULT_PROTECTION
+//      when their workflows ship — requiring a context nothing reports blocks
+//      every merge indefinitely (D-12, ADR 0159).
 //   2. The application-layer trust gates that run on every PR — the gate-review
 //      and grade-gate CI workflows (ADR 0058 phases 1-3; NOT YET IN THE TREE —
 //      workflowState() reports them 'absent' and the toggles below no-op until
@@ -17,7 +21,8 @@
 //      (it escalates gate-surface changes — infra/, migrations/, CODEOWNERS,
 //      scripts/gds plumbing — to owner approval). Branch protection alone does
 //      NOT neutralize these, which is why `off` also `gh workflow disable`s them.
-// With gating ON, a gate-surface PR needs owner approval / --admin to merge.
+// With gating ON, every PR — gate-surface or not — merges on the required
+// status checks alone; no human approval is ever required (ADR 0162).
 // With gating OFF, ordinary `gh pr merge N` (and every builder / autonomous
 // session) merges with no checks and no approval. `unit` keeps running either
 // way — a real safety net that forces no approval.
@@ -78,12 +83,11 @@ const DEFAULT_PROTECTION = {
     ],
   },
   enforce_admins: false,
-  required_pull_request_reviews: {
-    dismiss_stale_reviews: false,
-    require_code_owner_reviews: true,
-    required_approving_review_count: 0,
-    require_last_push_approval: false,
-  },
+  // ADR 0162 (task 1002635): review gates are RETIRED — the owner chose
+  // rank-consistent CI checks over human-approval gates after the code-owner
+  // requirement stranded graded-PASS work (PR 28). Never reintroduce a
+  // required_pull_request_reviews block here; cmdOn also normalizes snapshots.
+  required_pull_request_reviews: null,
   restrictions: null,
 };
 
@@ -302,6 +306,10 @@ function cmdOn(repo) {
       putBody = DEFAULT_PROTECTION;
       console.log('⚠ branch protection: no snapshot — restoring the baked-in known-good default.');
     }
+    // ADR 0162 (task 1002635): review gates are retired. Normalize BOTH restore
+    // paths — a snapshot taken while the code-owner requirement was live would
+    // otherwise silently resurrect it on the next off/on cycle.
+    putBody = { ...putBody, required_pull_request_reviews: null };
     putProtection(repo, putBody);
     const after = getProtection(repo);
     if (!after) fail('PUT returned but protection still reads as OFF — check `gh` auth / admin rights');

package/scripts/gds/init.js

@@ -362,7 +362,7 @@ function kickoffTasks(spec) {
       title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
       kind: 'infra',
       description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
-        '(unit / secret-scan / gate-review) + CODEOWNERS, so untrusted builders cannot push straight to production. Skippable for a solo/local instance.',
+        '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
     },
   ];
   // Production topology is either AUTOMATED (the owner opted into provisioning — the

package/src/module-api.js

@@ -467,8 +467,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.18 with no explicit bump. run 31346996715. (task 1002620)
 //   1.19.20 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.19 with no explicit bump. run 31347092915. (task 1002620)
+//   1.19.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.20 with no explicit bump. run 31446766597. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.20'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.21'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bump_version.mjs

@@ -69,3 +69,45 @@ test('the REAL src/module-api.js is bumpable right now (shape not drifted)', ()
   assert.match(from, /^\d+\.\d+\.\d+$/);
   assert.ok(text.includes(`const CORE_VERSION = '${to}';`));
 });
+
+// ---- isReleaseCommit: the cascade terminator (task 1002636) ----
+//
+// The bug: publish.yml's bump+publish push re-fired the workflow, which found
+// the just-published version "taken" — the BUMP trigger, not a no-op — so every
+// release armed the next one (core 1.19.6 → 1.19.20+ from two work merges).
+// The terminator no-ops the run when main HEAD is this lane's own release
+// commit. These tests pin the predicate to the EXACT subject the workflow
+// writes (extracted from publish.yml, not retyped — the two can't drift apart)
+// and pin that a HUMAN release commit never matches (skipping one would
+// swallow its publish entirely).
+
+const { isReleaseCommit, RELEASE_COMMIT_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+const PUBLISH_YML = fs.readFileSync(path.join(ROOT, '.github', 'workflows', 'publish.yml'), 'utf8');
+
+test('matches the exact -m subject publish.yml writes (extracted, not retyped)', () => {
+  const m = PUBLISH_YML.match(/git commit -m "([^"]+)"/);
+  assert.ok(m, 'publish.yml must contain the bump git commit -m literal');
+  const subject = m[1].replace('${TO}', '9.9.9');
+  assert.ok(isReleaseCommit(subject), `predicate must match the workflow's own subject: ${subject}`);
+});
+
+test('a HUMAN release commit never matches — skipping it would swallow its publish', () => {
+  assert.equal(isReleaseCommit('release: core 1.19.2 — carrier for the init-blocker fixes (task 1002624)'), false);
+  assert.equal(isReleaseCommit('release: core 2.0.0 — the doorway break (ADR 9999)'), false);
+});
+
+test('work-merge subjects, junk, and empties never match', () => {
+  assert.equal(isReleaseCommit('Merge pull request #30 from lars589/claude/cloudbongos-npm-registry-b9a57f'), false);
+  assert.equal(isReleaseCommit('fix(ship): protection-aware deploy mode'), false);
+  assert.equal(isReleaseCommit(''), false);
+  assert.equal(isReleaseCommit(null), false);
+  assert.equal(isReleaseCommit(undefined), false);
+  assert.equal(RELEASE_COMMIT_RE.source.startsWith('^'), true, 'anchored — a subject QUOTING a release message must not match');
+});
+
+test('publish.yml wires the terminator: guard step present, every armed step gated', () => {
+  assert.ok(PUBLISH_YML.includes('id: relhead'), 'the Already released? guard step exists');
+  assert.match(PUBLISH_YML, /isReleaseCommit/, 'the guard delegates to bump-version.js — single source');
+  const gates = (PUBLISH_YML.match(/steps\.relhead\.outputs\.release_head == 'false'/g) || []).length;
+  assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, tag) — found ${gates}`);
+});

package/tests/gating_review_retired.mjs

@@ -0,0 +1,63 @@
+// tests/gating_review_retired.mjs — review gates stay retired (ADR 0162, task 1002635).
+//
+// The owner retired the code-owner/human-approval layer after it stranded
+// graded-PASS work (PR 28) — gates are rank-consistent CI checks only. Two
+// resurrection paths existed and both are pinned shut here:
+//   1. gating.js DEFAULT_PROTECTION carrying a required_pull_request_reviews
+//      block (the baked-in re-arm), and
+//   2. cmdOn replaying a pre-retirement SNAPSHOT whose put_body still holds
+//      require_code_owner_reviews: true.
+// gating.js is a CLI (main() runs on require), so these are source-shape pins
+// (the goal_advisory.mjs pattern), with a counter-example proving the checker
+// catches the old shape.
+//
+// Run:  node --test tests/gating_review_retired.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GATING = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gating.js'), 'utf8');
+
+// The retirement invariant, as a checkable predicate over the source.
+function reviewGateRetired(src) {
+  const defaultHasNull = /required_pull_request_reviews:\s*null/.test(src);
+  const noRequireTrue = !/require_code_owner_reviews:\s*true/.test(src);
+  const cmdOnNormalizes = /putBody\s*=\s*\{\s*\.\.\.putBody,\s*required_pull_request_reviews:\s*null\s*\}/.test(src);
+  return { defaultHasNull, noRequireTrue, cmdOnNormalizes, ok: defaultHasNull && noRequireTrue && cmdOnNormalizes };
+}
+
+test('DEFAULT_PROTECTION requires no reviews and no code-owner block exists anywhere', () => {
+  const r = reviewGateRetired(GATING);
+  assert.ok(r.defaultHasNull, 'DEFAULT_PROTECTION must set required_pull_request_reviews: null');
+  assert.ok(r.noRequireTrue, 'no require_code_owner_reviews: true may exist in gating.js (ADR 0162)');
+});
+
+test('cmdOn normalizes BOTH restore paths — a pre-retirement snapshot cannot resurrect the gate', () => {
+  const r = reviewGateRetired(GATING);
+  assert.ok(r.cmdOnNormalizes, 'cmdOn must overwrite required_pull_request_reviews to null before putProtection');
+});
+
+test('the CODEOWNERS file is gone; its GLOB guards remain where they enforce', () => {
+  assert.ok(!fs.existsSync(path.join(ROOT, 'CODEOWNERS')), 'CODEOWNERS must not exist (ADR 0162)');
+  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  assert.match(gateReview, /'CODEOWNERS'/, 'the HARD_FLOOR glob stays — reintroducing the file is itself gate-flagged');
+});
+
+test('the checker actually CATCHES the pre-retirement shape (not a no-op)', () => {
+  const oldShape = `
+const DEFAULT_PROTECTION = {
+  required_pull_request_reviews: {
+    dismiss_stale_reviews: false,
+    require_code_owner_reviews: true,
+    required_approving_review_count: 0,
+  },
+};
+function cmdOn(repo) { putProtection(repo, putBody); }`;
+  const r = reviewGateRetired(oldShape);
+  assert.equal(r.ok, false, 'the old review-gated shape must fail the predicate');
+  assert.equal(r.noRequireTrue, false, 'require_code_owner_reviews: true must be the detected offender');
+});