@bongos/core 1.19.263 → 1.19.265

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.263",
-  "core_contract": "1.19.263",
-  "source_commit": "37e76e1c5b93e63f78568bd133de202d80718835",
+  "core_version": "1.19.265",
+  "core_contract": "1.19.265",
+  "source_commit": "273b4bc62e5af39cd2f8a9b03017b684249b7429",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T21:43:04.995Z",
+  "built_at": "2026-08-20T17:19:44.827Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1364,
+    "functional_verbatim": 1365,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1704,
-  "tree_sha256": "1f21bf09538e80b09eeae9562e41106fc7c241e0a80f7bc3db5027dfb9755874",
+  "file_count": 1705,
+  "tree_sha256": "a85fe056ad157be858f1419eb6f90b7e6f4ec2c74efbb08eff74e590ad69f691",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4467,12 +4467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "58ecc72707cf6bf7bf66d7f8166ab6ba5aff26889dfa6d16c58d831106e0ee41"
+      "sha256": "712a84b80962707ce7da2ee914c67fa5ed7a0032028b71166a31eeda35518733"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b7ba32ed44f54e570d1050b609b36194fd9ae545bad8174dec727f6a8281ea10"
+      "sha256": "512cbdbfc69c237e2620b89d0c424eff4d5175b6ef91bba239c01e3f3714e169"
     },
     {
       "path": "public-docs/index.html",
@@ -5062,7 +5062,7 @@
     {
       "path": "scripts/gds/diagram-facts.js",
       "mode": "0000644",
-      "sha256": "fe57f283f06985234123a46b5ae055f4ecd9df26834cb99e58228a5cb649e0aa"
+      "sha256": "2aba736613cacecbc81b40b813db619eaa83871a8c2aad213ab73869347c7f56"
     },
     {
       "path": "scripts/gds/discipline-modes.json",
@@ -5167,7 +5167,7 @@
     {
       "path": "scripts/gds/gen-diagrams.js",
       "mode": "0000644",
-      "sha256": "569a06e7cb448dab63a3acbcbf9c5366e394252c38edbe477d4d58282a9984c4"
+      "sha256": "d002fe7dd2564dea5965c0801a5d58a61e6d29b3bf6823299177c78612bf492b"
     },
     {
       "path": "scripts/gds/gen-file-map.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "681de343f8491a2f22165246f21ac371a8f76411b395991c784635e8e9646ed7"
+      "sha256": "542d36dfe7dd25d20936844b237b6681b1e64d34c66448438cf7ef9d86abb79f"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -6117,7 +6117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ac17ec5369c8edf4cb20a63057aec474e85b3253c3e588c859d7d36a756091ab"
+      "sha256": "f1cba6e04ee2b596f61f0d459bad39496cc7f2ed4276a60fb744174f1328f05b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8249,6 +8249,11 @@
       "mode": "0000644",
       "sha256": "e236bc3d6882bc6ddf5d389371a92a96aec62769f14c37bbca31810bcbea0d61"
     },
+    {
+      "path": "tests/ship_error_shape.mjs",
+      "mode": "0000644",
+      "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
+    },
     {
       "path": "tests/ship_post_land_verify.mjs",
       "mode": "0000644",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.263",
+  "version": "1.19.265",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.263",
+      "version": "1.19.265",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.263",
+  "version": "1.19.265",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/diagram-facts.js

@@ -153,10 +153,12 @@ async function liveVersions() {
 // 2026-05-30), NOT the seed refs — the V3 renumber (migration 021) made
 // seed-ref R##s diverge from live ids in a couple of places (so a source_ref
 // lookup would be unreliable). On an instance that imported the origin backlog
-// under new ids they resolve through the IMPORT_ID_OFFSETS probe below. In particular the bounty-AWARDING gate is the
-// "auto-confirmation flow that awards drachmae" task (#286 / live ref R67), not
-// the security-ADR-stub task that the old hand-authored .mmd loosely called
-// "R68" (#287). Each entry documents the piece it drives.
+// under new ids they resolve through the IMPORT_ID_OFFSETS probe below.
+//
+// In particular the bounty-AWARDING gate is the "auto-confirmation flow that
+// awards drachmae" task (#286 / live ref R67), not the security-ADR-stub task
+// that the old hand-authored .mmd loosely called "R68" (#287). Each entry
+// documents the piece it drives.
 const CONCEPTUAL_TASK_IDS = {
   // 04-architecture (the MEMORY layer) — ADR 0024 cloneable-memory chain.
   273: 'R54 — builder_memory store schema',
@@ -184,16 +186,23 @@ const CONCEPTUAL_TASK_IDS = {
 //   897  — the per-builder sandbox live game preview on the box
 //   919  — the scoped dev-box session (box token deny-by-default)
 //   1025 — server-mediated branch publish (box uploads bundle, server pushes)
-//   859  — CI self-deploy (Actions deploys main→droplet; no key on any box)
 //   1027 — hardware-verify of the box→prod flow end-to-end (now SHIPPED)
 //   1028 — replaced the standing push PAT with a GitHub App (now SHIPPED)
+//
+// Every id here MUST drive a piece of the diagram. An id no consumer reads is
+// not merely dead weight: conceptualFacts() below degrades the WHOLE bundle to
+// null the moment any single id is unreachable, so an unused id can silently
+// stop 03 + 04 from regenerating at all (the failure shape task 1002667 fixed
+// for the offset case). Do NOT re-add 859 (CI self-deploy): the deploy leg is
+// the standalone AUTO-PULL of ADR 0108/0129, not a task-gated Actions job, so
+// gen-diagrams.js deliberately excludes it — see its comment at `box → prod`.
+// Removed in task 1002674.
 const DEV_BOX_TASK_IDS = {
   904: 'devbox-app — desktop on-off switch',
   774: 'browser-only box terminal (ttyd over tunnel)',
   897: 'per-builder sandbox live preview',
   919: 'scoped dev-box session (box token deny-by-default)',
   1025: 'server-mediated branch publish (box uploads bundle, server pushes)',
-  859: 'CI self-deploy (Actions deploys main to the droplet)',
   1027: 'hardware-verify the box-to-prod flow end-to-end',
   1028: 'GitHub App hardening (replace the standing push PAT)',
 };

package/scripts/gds/gen-diagrams.js

@@ -589,7 +589,11 @@ const CONCEPTUAL_TARGETS = [
   }
 
   if (changed.length === 0 && !assertChanged) {
-    console.log('gen-diagrams: mechanical diagrams already current — no changes.');
+    // task 1002674: say WHICH set was checked. The old wording claimed only
+    // "mechanical", which reads as "the conceptual pair was skipped" — the
+    // degraded case — even on a fully successful run. Verifying that 03 + 04
+    // actually regenerated then meant reading the source.
+    console.log(`gen-diagrams: all ${TARGETS.length} diagram(s) already current — no changes${f.conceptual ? '' : ' (conceptual pair SKIPPED — see above)'}.`);
     process.exit(0);
   }
 

package/scripts/gds/ship.js

@@ -729,7 +729,7 @@ async function uploadSessionOnShip(taskId) {
       recordUploadSkip(taskId, {
         code: `http_${r.status}`,
         reason:
-          `POST /api/gds/sessions returned ${r.status}${r.data && r.data.error ? ` (${r.data.error})` : ''} — ` +
+          `POST /api/gds/sessions returned ${r.status}${r.data && r.data.error ? ` (${apiErrorLine(r.data)})` : ''} — ` +
           'the API rejected or could not store the digest. This ship will NOT appear in the BFG session corpus.',
       });
     }
@@ -1268,7 +1268,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
       id: taskId,
       body: { branch, head_sha: headSha, value_summary: valueSummary, bundle_b64: bundleB64 },
     });
-    if (r.status === 403 && r.data && r.data.error === 'box_scope') {
+    if (r.status === 403 && normalizeApiError(r.data).code === 'box_scope') {
       console.log('  ci-land: this session is BOX-SCOPED — run /builder-reauth (browser, no terminal) to mint a real session, then re-ship. Task stays at confirmed.');
       return landBailed('this CLI session is box-scoped', '/builder-reauth');
     }
@@ -3160,9 +3160,39 @@ function normalizeApiError(data) {
   return {
     code: isEnvelope ? errRaw.code : errRaw,
     message: isEnvelope ? errRaw.message : undefined,
+    // task 1002789: `details` is where the envelope carries the structured
+    // payload the flat shape used to put at the TOP level (claimWorktree,
+    // step/reason, floors). A site that reads `data.<field>` directly is
+    // reading a field that moved. Fall back to the body so a legacy flat
+    // response still resolves.
+    details: (isEnvelope && errRaw.details && typeof errRaw.details === 'object')
+      ? errRaw.details
+      : (data && typeof data === 'object' ? data : {}),
   };
 }
 
+// task 1002789: the ONE renderer for a failed API call on the ship path.
+// Every generic bail site used to hand the raw body to console.error (or
+// interpolate `data.error` into a template, which stringifies the ADR 0116
+// envelope object to the literal "[object Object]"). Both hide a fully
+// diagnosable server error: console.error's util.inspect stops at depth 2, so
+// the `details` that names WHICH git step failed prints as "[Object]".
+// Collapse the body to one readable line instead, whichever shape it is.
+// Pure + exported for tests/ship_error_shape.mjs.
+function apiErrorLine(data, status) {
+  const { code, message, details } = normalizeApiError(data);
+  const head = code
+    ? (message && message !== code ? `${code}: ${message}` : code)
+    : (message || (status ? `HTTP ${status}` : 'unknown error'));
+  // Only the small scalar fields — a details blob can carry a whole bundle.
+  const extras = Object.entries(details || {})
+    .filter(([k, v]) => k !== 'code' && k !== 'message' && k !== 'error'
+      && (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean'))
+    .map(([k, v]) => `${k}: ${String(v).replace(/\s+/g, ' ').trim()}`);
+  const line = extras.length ? `${head} (${extras.join('; ')})` : head;
+  return status ? `${line} [HTTP ${status}]` : line;
+}
+
 // task 1002809: classify a FAILED post-land POST /tasks/<id>/ship. The merge
 // already succeeded, so the server may simply have landed the task first
 // (reconcile-on-read — task 1049 — or the ~5-min reconciler racing this call).
@@ -4068,13 +4098,14 @@ async function shipMain() {
     },
   });
   if (!r.ok) {
-    if (r.data?.error === 'CLAIM_SESSION_MISMATCH') {
-      const wt = r.data.claimWorktree;
+    const resolveErr = normalizeApiError(r.data);
+    if (resolveErr.code === 'CLAIM_SESSION_MISMATCH') {
+      const wt = resolveErr.details.claimWorktree;
       console.error(`This claim was created in a different session${wt ? ` (worktree: ${wt})` : ''}.`);
       console.error('You can only ship from the session that originally claimed this task.');
       console.error(`To force-release from this session: node scripts/gds/release.js ${taskId} --force`);
     } else {
-      console.error(`resolve failed (${r.status}):`, r.data);
+      console.error(`resolve failed: ${apiErrorLine(r.data, r.status)}`);
     }
     process.exit(1);
   }
@@ -4110,7 +4141,7 @@ async function shipMain() {
     // verify ran). --verified is a no-op for every other kind.
     const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
     if (!confirm.ok) {
-      if (confirm.status === 409 && confirm.data && confirm.data.error === 'verify_attestation_required') {
+      if (confirm.status === 409 && normalizeApiError(confirm.data).code === 'verify_attestation_required') {
         console.error('');
         console.error(`This is a VERIFICATION task — it won't confirm until you attest the verify actually passed.`);
         console.error(`Run the verification, then re-ship with --verified:`);
@@ -4139,7 +4170,7 @@ async function shipMain() {
         console.error(`  task.confirm.grade_bypass${floorNote} to POST /api/gds/tasks/${taskId}/confirm.`);
         process.exit(1);
       }
-      console.error(`manual-confirm failed (${confirm.status}):`, confirm.data);
+      console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);
       process.exit(1);
     }
     postGradeStatus = confirm.data.taskStatus;
@@ -4490,6 +4521,9 @@ module.exports = {
   // 'pending' (success), not failure. Exported so the semantics are unit-tested.
   classifyLandOutcome,
   normalizeApiError,
+  // task 1002789: the single one-line renderer for a failed API call. Exported
+  // so the "[object Object]" regression is pinned against BOTH wire shapes.
+  apiErrorLine,
   postLandShipOutcome,
   // task 1718: pure poll-path decision — enable-failure polls the SERVER (not a
   // dead-end strand at confirmed), enable-success watches GitHub. Exported so the

package/src/module-api.js

@@ -953,8 +953,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.261 with no explicit bump. run 32298063660. (task 1002620)
 //   1.19.263 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
+//   1.19.264 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.263 with no explicit bump. run 32396082154. (task 1002620)
+//   1.19.265 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.264 with no explicit bump. run 32396925426. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.263'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.265'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_error_shape.mjs

@@ -0,0 +1,153 @@
+// tests/ship_error_shape.mjs
+//
+// Unit tests for ship.js's API-error rendering (task 1002789).
+//
+// HIT FOR REAL on task 1002485: a fully diagnosable push failure reached the
+// builder as literally "ci-land: server publish failed - [object Object]".
+// The cause is one bug class repeated at several sites — ship.js read the
+// PRE-ADR-0116 flat body `{ error: 'code', …fields }` while the live server
+// emits the nested envelope `{ error: { code, message, details } }`:
+//
+//   * interpolating `data.error` into a template string stringifies the
+//     envelope OBJECT — that is the literal "[object Object]";
+//   * `data.error === 'some_code'` never matches, so the graceful branch
+//     behind it (box_scope re-auth, verify-attestation remedy, the
+//     CLAIM_SESSION_MISMATCH explanation) is DEAD CODE against a live server;
+//   * `data.<field>` reads a top-level field that MOVED into `error.details`.
+//
+// What we prove here (pure helpers only — no git, no network):
+//   1. normalizeApiError now carries `details`, from the envelope when nested
+//      and from the body itself on a legacy flat response.
+//   2. apiErrorLine renders BOTH shapes as one readable line and NEVER emits
+//      "[object Object]" — the regression this task exists to kill.
+//   3. It keeps the scalar detail fields that name what actually failed, and
+//      drops non-scalar blobs (a details payload can carry a whole bundle).
+//   4. It survives missing/odd/hostile bodies without throwing.
+//
+// Run:  node tests/ship_error_shape.mjs
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+const { normalizeApiError, apiErrorLine } = ship;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+function eq(actual, expected, msg) {
+  if (actual !== expected) throw new Error(`${msg || 'mismatch'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+function has(haystack, needle) {
+  if (!String(haystack).includes(needle)) throw new Error(`expected to contain ${JSON.stringify(needle)}, got ${JSON.stringify(haystack)}`);
+}
+function lacks(haystack, needle) {
+  if (String(haystack).includes(needle)) throw new Error(`expected NOT to contain ${JSON.stringify(needle)}, got ${JSON.stringify(haystack)}`);
+}
+
+// ---- 1. normalizeApiError carries details from both shapes ----
+
+test('normalizeApiError takes details from the envelope', () => {
+  const { code, details } = normalizeApiError({
+    error: { code: 'CLAIM_SESSION_MISMATCH', message: 'other session', details: { claimWorktree: 'wt-1002789' } },
+  });
+  eq(code, 'CLAIM_SESSION_MISMATCH');
+  eq(details.claimWorktree, 'wt-1002789');
+});
+
+test('normalizeApiError falls back to the body on the legacy flat shape', () => {
+  // The flat shape put the structured fields at the TOP level, so the body IS
+  // the details. Both server generations resolve through one read.
+  const { code, details } = normalizeApiError({ error: 'CLAIM_SESSION_MISMATCH', claimWorktree: 'wt-legacy' });
+  eq(code, 'CLAIM_SESSION_MISMATCH');
+  eq(details.claimWorktree, 'wt-legacy');
+});
+
+test('normalizeApiError still survives missing/odd bodies', () => {
+  eq(normalizeApiError(null).code, undefined);
+  eq(typeof normalizeApiError(null).details, 'object');
+  eq(normalizeApiError({}).code, undefined);
+});
+
+// ---- 2. apiErrorLine never emits "[object Object]" ----
+
+test('apiErrorLine renders the ADR 0116 envelope, not [object Object]', () => {
+  const line = apiErrorLine({
+    error: { code: 'publish_failed', message: 'push rejected', details: { step: 'push', reason: 'non-fast-forward' } },
+  }, 500);
+  lacks(line, '[object Object]');
+  has(line, 'publish_failed');
+  has(line, 'push rejected');
+  has(line, 'step: push');
+  has(line, 'non-fast-forward');
+  has(line, 'HTTP 500');
+});
+
+test('apiErrorLine renders the legacy flat shape', () => {
+  const line = apiErrorLine({ error: 'publish_failed', step: 'push' }, 500);
+  lacks(line, '[object Object]');
+  has(line, 'publish_failed');
+  has(line, 'step: push');
+});
+
+test('apiErrorLine does not repeat the code when message just echoes it', () => {
+  // envelope() defaults message to the code, so the naive `code: message`
+  // join would print "publish_failed: publish_failed".
+  const line = apiErrorLine({ error: { code: 'publish_failed', message: 'publish_failed' } }, 500);
+  lacks(line, 'publish_failed: publish_failed');
+  has(line, 'publish_failed');
+});
+
+// ---- 3. scalars kept, blobs dropped ----
+
+test('apiErrorLine keeps scalar details and drops blobs', () => {
+  const line = apiErrorLine({
+    error: {
+      code: 'publish_failed',
+      message: 'nope',
+      details: { step: 'push', attempt: 3, armed: false, bundle: { b64: 'x'.repeat(200) }, files: ['a', 'b'] },
+    },
+  }, 500);
+  has(line, 'step: push');
+  has(line, 'attempt: 3');
+  has(line, 'armed: false');
+  lacks(line, 'bundle');
+  lacks(line, 'files');
+  lacks(line, '[object Object]');
+});
+
+test('apiErrorLine flattens multi-line git stderr onto one line', () => {
+  const line = apiErrorLine({
+    error: { code: 'publish_failed', message: 'nope', details: { reason: 'error: failed to push\n hint: fetch first\n' } },
+  }, 500);
+  eq(line.includes('\n'), false, 'must be a single line');
+  has(line, 'fetch first');
+});
+
+// ---- 4. hostile / empty bodies ----
+
+test('apiErrorLine handles a body with no error at all', () => {
+  has(apiErrorLine({}, 503), 'HTTP 503');
+  has(apiErrorLine(null, 503), 'HTTP 503');
+  eq(apiErrorLine(null), 'unknown error');
+});
+
+test('apiErrorLine handles a null error member', () => {
+  const line = apiErrorLine({ error: null }, 500);
+  lacks(line, '[object Object]');
+  has(line, 'HTTP 500');
+});
+
+console.log('');
+console.log(`ship_error_shape: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);