@bongos/core 1.19.319 → 1.19.321

package/scripts/status-probe.mjs

@@ -34,10 +34,30 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+
+// Target + User-Agent come from the INSTANCE's own branding pack (task 1002757).
+// Both were founder literals, so another instance's uptime CI probed the founder
+// host and reported ITS health as their own. No literal fallback for the target:
+// a probe with nothing to probe must say so, not silently watch someone else.
+const requireCjs = createRequire(import.meta.url);
+const brandingSafe = () => { try { return requireCjs('../src/branding'); } catch { return null; } };
+const defaultTarget = () => {
+  const b = brandingSafe();
+  try {
+    const origin = b && b.branding().domains?.publicOrigin;
+    return origin ? `${String(origin).replace(/\/+$/, '')}/healthz` : null;
+  } catch { return null; }
+};
+const defaultUserAgent = () => {
+  const b = brandingSafe();
+  try { return `${b.userAgent().split('/')[0]}-status-probe/1.0 (+github-actions)`; }
+  catch { return 'cloud-bongos-status-probe/1.0 (+github-actions)'; }
+};
 
 const DEFAULTS = {
   dir: '.',
-  target: 'https://amazonprimea.com/healthz',
+  target: defaultTarget(),
   attempts: 3,
   'timeout-ms': 15000,
   'gap-ms': 10000,
@@ -70,7 +90,7 @@ async function attempt(target, timeoutMs) {
     const res = await fetch(target, {
       signal: ac.signal,
       redirect: 'manual', // a 200 must come from the origin, not a redirect chain
-      headers: { 'User-Agent': 'amazonprimea-status-probe/1.0 (+github-actions)' },
+      headers: { 'User-Agent': defaultUserAgent() },
     });
     return { ok: res.status === 200, httpStatus: res.status, latencyMs: Date.now() - start };
   } catch (_) {
@@ -125,6 +145,14 @@ async function main() {
   const historyFile = path.join(dir, 'history.jsonl');
   const statusFile = path.join(dir, 'status.json');
 
+  // No target means the branding pack names no public origin and none was passed
+  // (task 1002757 — there is deliberately no founder-host fallback to probe).
+  if (!args.target) {
+    console.error('status-probe: no target. Pass --target <url>, or give this instance a domains.publicOrigin in config/branding.json.');
+    process.exitCode = 2;
+    return;
+  }
+
   const result = await probe({
     target: args.target,
     attempts: args.attempts,

package/src/module-api.js

@@ -1065,8 +1065,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
 //   1.19.319 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.318 with no explicit bump. run 32670195088. (task 1002620)
+//   1.19.320 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.319 with no explicit bump. run 32678147546. (task 1002620)
+//   1.19.321 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.320 with no explicit bump. run 32679324013. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.319'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.321'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -368,5 +368,51 @@ t('a DENIED decision projects to null (the route returns 403, never a scope body
   assert.equal(access.scopeMetadata(), null, 'no args → null');
 });
 
+// ---------- task 1003227: config/ must be in the box's BASE slice ----------
+//
+// Without it a box cannot run its own quality gate: fitness.js compares against
+// config/fitness-baselines.json, and with the file absent the ratchet used to report
+// PASS (a planted 5,000-line + 94-cycle regression sailed through). So a boxed builder
+// shipped believing they were clean and learned otherwise from red CI, with nothing on
+// the box to reproduce it. Precedent for the same class: ADR 0174 put
+// config/government.json in the `government` globs, config/ was not in BASE, and task
+// 1003018 was RELEASED because its box could never see its own deliverable.
+
+t('1003227 BASE includes config/ so a box can read its own fitness baselines', () => {
+  const spec = access.decideSourceAccess({
+    rank: 'archon', status: 'active', scopeKeys: [], hasActiveClaims: false, moduleScopeMap: {},
+  });
+  assert.equal(spec.scope, 'base');
+  assert.ok(spec.spec.sparsePaths.includes('config'),
+    `base scope must carry config/; got ${spec.spec.sparsePaths.join(',')}`);
+});
+
+t('1003227 a TASK-scoped box carries config/ too (the common case — a claim is held)', () => {
+  // The REAL scope map, not a hand-rolled object — the shape matters here.
+  const scopeMap = require('../src/bongos/module-scope-map.js');
+  const spec = access.decideSourceAccess({
+    rank: 'xenos', status: 'active', scopeKeys: ['economy'], hasActiveClaims: true,
+    moduleScopeMap: scopeMap,
+  });
+  assert.equal(spec.scope, 'task');
+  assert.ok(spec.spec.sparsePaths.includes('config'), 'task scope must carry config/ as well');
+  assert.ok(spec.spec.sparsePaths.includes('modules/economy'),
+    `and still layer the claimed module on top; got ${spec.spec.sparsePaths.join(',')}`);
+});
+
+t('1003227 config/ is a cone-mode DIRECTORY entry (a file path aborts the whole set)', () => {
+  // ADR 0148: `git sparse-checkout set` rejects a file path, which kills the entire
+  // checkout — so every BASE entry must be a bare directory, no trailing slash.
+  for (const p of access.BASE_SPARSE_PATHS) {
+    assert.ok(!p.endsWith('/'), `${p} must not carry a trailing slash`);
+    // A dotted DIRECTORY (.claude, .devcontainer) is fine; what cone mode rejects is
+    // a file, so only test for an extension on the FINAL segment of a non-dotfile.
+    const last = p.split('/').pop();
+    if (!last.startsWith('.')) {
+      assert.ok(!/\.[a-z0-9]+$/i.test(last), `${p} looks like a FILE — cone mode would abort the set`);
+    }
+  }
+});
+
 console.log(`\nbox_access.mjs: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/fitness_ratchets.mjs

@@ -89,3 +89,85 @@ test('the committed baseline file parses and covers every hermetic metric', () =
     assert.ok(Number.isInteger(b.metrics[key]), `baseline missing ${key}`);
   }
 });
+
+// ---------- task 1003227: the gate must FAIL CLOSED on an unusable baseline ----------
+//
+// readBaselines used to `catch { return {} }`. An empty baseline map leaves every
+// `floor === undefined`, which compareToBaselines classifies as a WARNING — so a
+// checkout with no config/ reported the ratchet PASSED. Measured before the fix: a
+// planted 5,000-line + 94-cycle regression produced ZERO violations. That was not a
+// hypothetical checkout — config/ is absent from every dev box's sparse slice, so the
+// builders who most needed the gate were the ones silently exempt from it.
+//
+// checkQualityRatchets() reads the real repo, so these tests drive compareToBaselines
+// (pure) for the metric-level rules and exercise the file-level rule by pointing at a
+// baseline that does not exist.
+
+test('1003227 an ABSENT baseline file makes the gate hard-fail, not pass', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup`;
+  const had = fs.existsSync(real);
+  if (had) fs.renameSync(real, backup);
+  try {
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true, 'a gate that cannot read its floors must not report a pass');
+    assert.ok(r.violations.length > 0, 'and it must say so as a VIOLATION, not a warning');
+    assert.match(r.violations[0], /MISSING/, 'the first violation names the real cause');
+    assert.match(r.violations[0], /fails CLOSED/i, 'and states the posture explicitly');
+  } finally {
+    if (had) fs.renameSync(backup, real);
+  }
+});
+
+test('1003227 a MALFORMED baseline file also hard-fails', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup2`;
+  const had = fs.existsSync(real);
+  if (had) fs.copyFileSync(real, backup);
+  try {
+    fs.writeFileSync(real, '{ this is not json');
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true, 'unparseable is no more verifiable than absent');
+    assert.match(r.violations[0], /not valid JSON/);
+  } finally {
+    if (had) { fs.copyFileSync(backup, real); fs.unlinkSync(backup); }
+  }
+});
+
+test('1003227 a baseline file with no "metrics" object hard-fails', async () => {
+  const fs = require('node:fs');
+  const real = rat.BASELINE_PATH;
+  const backup = `${real}.1003227-test-backup3`;
+  const had = fs.existsSync(real);
+  if (had) fs.copyFileSync(real, backup);
+  try {
+    fs.writeFileSync(real, JSON.stringify({ _comment: 'no metrics key' }));
+    const r = rat.checkQualityRatchets();
+    assert.equal(r.hardFail, true);
+    assert.match(r.violations[0], /no "metrics" object/);
+  } finally {
+    if (had) { fs.copyFileSync(backup, real); fs.unlinkSync(backup); }
+  }
+});
+
+test('1003227 a missing KEY for a NEW metric stays a warning (adding a metric must not brick CI)', () => {
+  // The two absences are different facts and must not collapse: no FILE = cannot
+  // verify = fail; no KEY = a genuinely new metric = warn.
+  const { violations, warnings } = rat.compareToBaselines(
+    { brand_new_metric: 7 },
+    { excess_lines_total: 100 },
+  );
+  assert.deepEqual(violations, [], 'a new metric with no floor yet must not fail the build');
+  assert.match(warnings.join(' '), /no baseline for "brand_new_metric"/);
+});
+
+test('1003227 a real regression is still caught when the baselines ARE readable', () => {
+  const { violations } = rat.compareToBaselines(
+    { excess_lines_total: 5100, require_cycle_count: 99 },
+    { excess_lines_total: 100, require_cycle_count: 5 },
+  );
+  assert.equal(violations.length, 2, 'both regressions reported');
+  assert.match(violations.join(' '), /never raise the baseline to pass/);
+});

package/tests/helpers.mjs

@@ -142,3 +142,16 @@ export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
     .sort();
   return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
 }
+
+// shipCliSource — the ship CLI as one source string.
+//
+// The companion to lifecycleDbSource above, for the same reason: task 1003205
+// carved the 4,613-line scripts/gds/ship.js into ship.js (a re-export facade +
+// the CLI entry point) plus ship-*.js phase modules. Tests that assert "the ship
+// CLI does X" by regexing its source mean the CLI as a whole, not one file.
+export function shipCliSource(scriptsDir = path.join(ROOT, 'scripts', 'gds')) {
+  const files = fs.readdirSync(scriptsDir)
+    .filter((f) => f === 'ship.js' || (f.startsWith('ship-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(scriptsDir, f), 'utf8')).join('\n');
+}

package/tests/provision.mjs

@@ -144,10 +144,16 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
     root: '/srv/bongos/spike-harbor', fromVersion: '1.19.2', toVersion: '1.19.196',
     repo, ownerToken: 'ghs_xxx', credFile: '/tmp/cred',
   });
+  // task 1002757: the bot email is RESOLVED (env → instance apex → neutral
+  // .invalid), never the hub's own address hardcoded — a self-hosted provisioner
+  // must not attribute its commits to the hub. Assert against the resolver so
+  // this pins the behaviour, not one instance's literal.
   assert.deepEqual(withTok.config, [
     'git -C /srv/bongos/spike-harbor config user.name "Cloud Bongos"',
-    'git -C /srv/bongos/spike-harbor config user.email "bot@cloudbongos.com"',
+    `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
+  assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
+  assert.doesNotMatch(P.provisionerBotEmail({}), /amazonprimea/i, 'never a founder-host address');
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);

package/tests/regrade_eligibility.mjs

@@ -198,5 +198,48 @@ test('buildGradePayload confidence defaults to null when signals omit it', () =>
   assert.equal(body.subagent_output.confidence, null);
 });
 
+// ---------- task 1003221: don't prescribe a command the caller can't run ----------
+//
+// The 'confirmed' answer hardcoded "run /merge-mode", which lands by pushing main
+// via push-main.js (SEC #863 / ADR 0043) and needs an authenticated gh plus a main
+// checkout. A server-mediated builder (pushVia()==='server' — every dev box) has
+// neither, so the advice was unreachable by construction. It cost a real builder
+// 163 minutes on 2026-08-21. strandNextStep already had the right wording for both
+// modes; these pin that the two modes now diverge and that neither regresses.
+
+test('1003221 a server-mediated builder is NOT told to run /merge-mode', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 601, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'server',
+  });
+  assert.equal(v.ok, false);
+  assert.match(v.reason, /already 'confirmed'/, 'still says why a re-grade is refused');
+  assert.doesNotMatch(v.reason, /run \/merge-mode/, 'must not prescribe the unreachable command');
+  assert.match(v.reason, /ship\.js 601/, 'names the command that DOES work here');
+  assert.match(v.reason, /NOT available here/, 'and says plainly why /merge-mode is out');
+});
+
+test('1003221 a laptop builder still gets /merge-mode (no regression)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 602, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'local',
+  });
+  assert.match(v.reason, /\/merge-mode/, 'the laptop path keeps its working advice');
+  assert.match(v.reason, /ship\.js 602/, 'and still offers the resume alternative');
+});
+
+test('1003221 omitting pushMode keeps the historical wording (backward compatible)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 603, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+  });
+  assert.match(v.reason, /\/merge-mode/, 'an old caller/test that passes no pushMode is unchanged');
+});
+
 console.log(`\n--regrade eligibility (#678) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_assurance.mjs

@@ -33,6 +33,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { shipCliSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
@@ -178,8 +179,9 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
   // Without this, the gate would refuse exactly the --db-only / --allow-empty
   // flow CLAUDE.md calls a supported shape — turning a correctness fix into a
   // regression for the builders who rely on it.
-  const src = read('scripts/gds/ship.js');
-  assert.match(src, /no_artifact:\s*true/, 'ship.js must send the declaration on an empty land');
+  // task 1003205: the ship CLI is ship.js + ship-*.js now — read the family.
+  const src = shipCliSource();
+  assert.match(src, /no_artifact:\s*true/, 'the ship CLI must send the declaration on an empty land');
   assert.match(src, /landed\(\{ noArtifact: true/,
     'and the deliberate-empty land sites must mark themselves as such');
 });

package/tests/ship_publish_error.mjs

@@ -115,5 +115,48 @@ test('the "non-fast-forward" wording triggers the same hint through the envelope
 });
 
 console.log('');
+// ---------- task 1003221: a non-fast-forward has TWO causes ----------
+//
+// The hint used to give ONE diagnosis — "the server already moved <branch>" — and
+// prescribe `reset onto origin/<branch>`. That is right when the server is ahead
+// and DESTRUCTIVE when it is not: a builder who rebased or amended an
+// already-published branch would be told to throw away the commits they just made.
+// That was the real 2026-08-21 case. opts.localHistoryRewritten discriminates;
+// null (git could not tell) must keep the original wording rather than guess.
+const NFF = {
+  error: { code: 'publish_failed', message: 'publish_failed',
+           details: { step: 'push', reason: '! [rejected] main -> main (non-fast-forward)' } },
+};
+
+test('1003221 rewritten local history is told to MERGE, never reset', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: true });
+  assert.match(out, /APPEND-ONLY/);
+  assert.match(out, /git merge origin\/claude\/x/, 'names the merge that actually recovers');
+  assert.match(out, /Do NOT reset or re-rebase/, 'and forbids the lossy move explicitly');
+  assert.doesNotMatch(out, /reset onto/, 'must not carry the server-ahead remedy');
+});
+
+test('1003221 a server-ahead non-fast-forward keeps the reset remedy', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: false });
+  assert.match(out, /the server already moved claude\/x/);
+  assert.match(out, /reset onto origin\/claude\/x/);
+  assert.doesNotMatch(out, /APPEND-ONLY/);
+});
+
+test('1003221 an UNKNOWN cause (null) does not invent a diagnosis', () => {
+  const unknown = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: null });
+  const legacy = ship.formatPublishFailure(NFF, 500, 'claude/x');
+  assert.equal(unknown, legacy, 'null must be byte-identical to the pre-fix wording');
+  assert.match(unknown, /reset onto/);
+});
+
+test('1003221 a non-NFF failure gains no hint from either flag', () => {
+  const other = { error: { code: 'publish_failed', details: { step: 'bundle', reason: 'bad object' } } };
+  for (const v of [true, false, null]) {
+    const out = ship.formatPublishFailure(other, 500, 'claude/x', { localHistoryRewritten: v });
+    assert.doesNotMatch(out, /APPEND-ONLY|reset onto/, `flag ${v} must not add a remedy to an unrelated failure`);
+  }
+});
+
 console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);