@bongos/core 1.19.27 → 1.19.28

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.27",
-  "core_contract": "1.19.27",
-  "source_commit": "a8f09266a4b9cdbdf70ea92de3c2a26553aacab2",
+  "core_version": "1.19.28",
+  "core_contract": "1.19.28",
+  "source_commit": "10e31a3212982a5385e83bec33a5ba12b733929f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T13:38:48.421Z",
+  "built_at": "2026-08-11T14:01:24.503Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1511,
-  "tree_sha256": "b85699092f300b5bab1ab32e95763e4f032d2ee8f688466f4c4dc939048174bd",
+  "tree_sha256": "e1dee62e1e6e30b75671474f69e5e6b97f0ea598c9a66b5ad49867906f85e51d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "c8f356746096a6fe39e456b12367d29b6bbf4e39df1515c09144c95e239f1b49"
+      "sha256": "60b9338ed47d01e9f38fe3fa9f2f2cde6ff241b8e47efcb8fcf4c4f19d32c766"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a32cc5b3e33b39013ebe6508049b2ce0dac4c6ac8edce2adf396af265a0c4df8"
+      "sha256": "8ecf54691f56a0579f3d732323aebbe9620b3b46fa6f8711a959f20dac1cffaa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "aea4f2f3266f8107e00346fb410bb214997bc0cda76e7ecba36b7f2210b9b661"
+      "sha256": "d7dcf7da61008463a0e5ddb5da440f85bd845a2a0ea8d8125c2684dad24cdac6"
     },
     {
       "path": "public-docs/index.html",
@@ -5042,7 +5042,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "85712b5cd1e20a2d84646b117cbaadf0ee4903f278ca904eb863da4612ee937b"
+      "sha256": "7f0ad4e54c0e5c251f00c78c7a6065d4a8db7bc88f0492c75bc63f8929108203"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f75a298d5c776e9bb7ba33c75061ca193c73b0004eea7c0f6706f02b8daad0f0"
+      "sha256": "b97afd8c79d048c057170fb03010be8d89f051cc8d4c43a2ecb85343785fe194"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6357,7 +6357,7 @@
     {
       "path": "tests/gate_approvals.mjs",
       "mode": "0000644",
-      "sha256": "900923ab39dee11de4c59ec977555346aa52ba875d12e2b4ca27013bf99e51c2"
+      "sha256": "df503f198853f6fe3497a2e0317d90bee69cc275f024027ad569ee1cef0155b6"
     },
     {
       "path": "tests/gate_review.mjs",

package/modules/lifecycle/github-push.js

@@ -1002,6 +1002,10 @@ async function recheckPullRequest({ number }, deps = {}) {
   const { owner, repo } = repoInfo;
   const doFetch = deps.fetchImpl || fetch;
   const reopenDelayMs = Number.isFinite(deps.reopenDelayMs) ? deps.reopenDelayMs : RECHECK_REOPEN_DELAY_MS;
+  // task 1002644: injectable so the unit test pins the sleep's PLACE in the
+  // close→reopen sequence without a real timer — a wall-clock elapsed assertion
+  // around a real sleep flaked the unit lane (the only required merge check).
+  const doSleep = deps.sleepImpl || sleep;
   const api = `https://api.github.com/repos/${owner}/${repo}`;
   const patchState = async (state) => {
     const res = await doFetch(`${api}/pulls/${number}`, {
@@ -1018,7 +1022,7 @@ async function recheckPullRequest({ number }, deps = {}) {
   await patchState('closed');
   // Let GitHub register the close as a distinct state transition before reopening, so
   // the reopen actually dispatches a `pull_request: reopened` event (task 1241).
-  if (reopenDelayMs > 0) await sleep(reopenDelayMs);
+  if (reopenDelayMs > 0) await doSleep(reopenDelayMs);
   const reopened = await patchState('open');
   let autoMerge = false;
   try {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.27",
+  "version": "1.19.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.27",
+      "version": "1.19.28",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.27",
+  "version": "1.19.28",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -184,16 +184,31 @@ function main() {
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
-        stdio: ['ignore', 'ignore', 'pipe'],
+        // task 1002644: stdout used to be IGNORED, so the failing assertion (test
+        // files print their FAIL lines to stdout) was discarded and the only
+        // context shown was the last 3 STDERR lines — often stale diagnostic
+        // noise from an EARLIER, PASSING test. The live example: gate_approvals'
+        // route-catch console.error dump made every failure in that file read as
+        // a GraphQL/network outage, and the real flaky assertion was invisible.
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 16 * 1024 * 1024,
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
       console.log(`  ok    ${displayName}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
-      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
       console.log(`  FAIL  ${displayName} (${why})`);
-      if (stderr) console.log(`      ${stderr}`);
+      const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      // The actual failures first: the file's own FAIL lines, then its stdout
+      // tail (the last failure's assertion detail + summary), both bounded.
+      const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
+      for (const l of failLines) console.log(`      ${l.trim()}`);
+      if (stdoutText) {
+        for (const l of stdoutText.split('\n').slice(-5)) console.log(`      ${l}`);
+      }
+      const stderr = (err.stderr ? err.stderr.toString() : '').trim().split('\n').slice(-3).join('\n      ');
+      if (stderr) console.log(`      stderr: ${stderr}`);
       failures.push(displayName);
     }
   };

package/src/module-api.js

@@ -481,8 +481,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
 //   1.19.27 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.26 with no explicit bump. run 31497212656. (task 1002620)
+//   1.19.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.27 with no explicit bump. run 31499228797. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.27'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.28'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/gate_approvals.mjs

@@ -208,21 +208,26 @@ await t('recheckPullRequest: waits between close and reopen so GitHub fires a di
   // into no net change and dispatches no `pull_request: reopened` event, so the
   // gate-review run never re-fires. recheckPullRequest must sleep BETWEEN the close
   // PATCH and the reopen PATCH (deps.reopenDelayMs, default 4s in prod) so the reopen
-  // lands as a distinct state transition. We assert the delay elapses strictly between
-  // the two PATCHes and not before the close / after the reopen.
+  // lands as a distinct state transition.
+  //
+  // task 1002644: this used to sleep a REAL 30ms and assert wall-clock elapsed >=
+  // 30 — Date.now() truncation + NTP slew on CI runners can read a punctual timer
+  // as 29ms, which flaked the unit lane (the ONLY required merge check, ADR 0162).
+  // Inject the sleep and assert its PLACE in the event sequence instead — strictly
+  // stronger (total elapsed never proved the wait sat BETWEEN the two PATCHes) and
+  // fully deterministic.
   const events = [];
-  const delayMs = 30;
+  const delayMs = 4000; // the prod-default shape — never actually slept (injected)
   const fetchImpl = async (url, opts) => {
     const method = (opts && opts.method) || 'GET';
     if (method === 'PATCH') { events.push('patch:' + JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1', state: JSON.parse(opts.body).state }); }
     if (url === 'https://api.github.com/graphql') { events.push('automerge'); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); }
     throw new Error('unexpected ' + url + ' ' + method);
   };
-  const t0 = Date.now();
-  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, reopenDelayMs: delayMs });
-  const elapsed = Date.now() - t0;
-  assert.deepEqual(events, ['patch:closed', 'patch:open', 'automerge'], 'close then (after a wait) reopen then re-arm');
-  assert.ok(elapsed >= delayMs, `total elapsed (${elapsed}ms) must be at least the configured reopen delay (${delayMs}ms)`);
+  const sleepImpl = async (ms) => { events.push(`sleep:${ms}`); };
+  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, sleepImpl, reopenDelayMs: delayMs });
+  assert.deepEqual(events, ['patch:closed', `sleep:${delayMs}`, 'patch:open', 'automerge'],
+    'the wait happens BETWEEN the close and the reopen — a coalesced close+reopen dispatches no reopened event');
 });
 
 // ===========================================================================