@bongos/core 1.19.437 → 1.19.439

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.437",
-  "core_contract": "1.19.437",
-  "source_commit": "a19cfca1c4490ec543603d83defdefb98de8da80",
+  "core_version": "1.19.439",
+  "core_contract": "1.19.439",
+  "source_commit": "a9bd9c057a92dcd86325488ea8d64d1c5a75d21d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-30T03:08:23.716Z",
+  "built_at": "2026-08-30T03:36:36.256Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 369,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1743,
+    "functional_verbatim": 1744,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2135,
-  "tree_sha256": "a3d39a99e32c492d5ae17ae906d89add5544bc902225fa056e0c6c8f9f4110ca",
+  "file_count": 2136,
+  "tree_sha256": "fdf406bc7811d1bced5270e2d1877f3bc5d5a984dfcef33e85fca42755942d6d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -262,7 +262,7 @@
     {
       "path": ".claude/skills/strand-fix/SKILL.md",
       "mode": "0000644",
-      "sha256": "9a0b4f5bebdf780c4bfadde487146cb8ab5d08b3a748ee8623f336d7cbec5291"
+      "sha256": "1444494f4a8f4168c025ef5ac0fd45f88c5217ec3293921cde3ae47b339b3699"
     },
     {
       "path": ".claude/skills/worktree-clean/SKILL.md",
@@ -1997,7 +1997,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "eb14f5a0f47e80dfc687ef5193e73de5da6d937a90e88ad71bb4e2e6d70c2ad3"
+      "sha256": "f8707c2be03ce4ab61535e578a1f9bc5bbfa39d46d2158e1b6e7500feaa714dd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4712,7 +4712,7 @@
     {
       "path": "modules/lifecycle/ship-assurance.js",
       "mode": "0000644",
-      "sha256": "2938d8ea651af09b3c73d294057c153ce079170ae34a42e3e94025daab097dcf"
+      "sha256": "9bbbabd157420ffc7ed8c323436a27045da0d7bc7c8bfd7f4c44f300855556b1"
     },
     {
       "path": "modules/lifecycle/ship-card.js",
@@ -5607,12 +5607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "38ae27226a931dea4012fd645931624e0592a047c14350cfd0c5252b2230c0d6"
+      "sha256": "40089194b27619101fe9a2d6ba75e51f24ffd219bf995e79af8f291a032a59f0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "54a547f0c6490348fe2695d83d7a0639fd9c583a0472bc3974db590ee23e1434"
+      "sha256": "771d5f5e8c60847e2f0ded55d6d427bb6bda9a0d1e27c58a7918f7b5ceff4eda"
     },
     {
       "path": "public-docs/index.html",
@@ -7747,7 +7747,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0537028fe74fccf01b238c487a133a416cedfcdceba1d212c4259f50101c6014"
+      "sha256": "03cd7ebddf88e2be932ca827ec4853b0ce8ae0426e475aa6b84b4e813ebfb06e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9164,6 +9164,11 @@
       "mode": "0000644",
       "sha256": "ed1e14050ba219a52736c2cd70f4d4333a345fb0018211c85293a995c7f0aac7"
     },
+    {
+      "path": "tests/hooks_drain.mjs",
+      "mode": "0000644",
+      "sha256": "d616a075d7e48e2123c08a60b023aad2d2c1cc1bb4a73caa9b6e8189dda30e6f"
+    },
     {
       "path": "tests/host_topology_skips.mjs",
       "mode": "0000644",
@@ -10267,7 +10272,7 @@
     {
       "path": "tests/ship_assurance.mjs",
       "mode": "0000644",
-      "sha256": "7257c4041ba48300172bbacbed4b0727ebd222e3626c7e871d845c048646dc12"
+      "sha256": "63f7b9e24126449b55d8c4fd0c5d8ff4dc11fea2e4eeb7b60d87d66722d5f518"
     },
     {
       "path": "tests/ship_autolinkify.mjs",

package/.claude/skills/strand-fix/SKILL.md

@@ -32,7 +32,7 @@ node scripts/gds/skill-preflight.js strand-fix   # exits 1 naming what is MISSIN
    gh pr list --search "N" --state all --json number,state,mergeable,url
    ```
 2. **Pick the ONE matching case.**
-   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed (the ship deleted the branch before the reconciler probed — task 1002724). Flip it: `node scripts/gds/api.js POST /api/gds/tasks/N/ship --body '{}'`. Credits land here (ADR 0120).
+   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed. The proof is the claim's recorded tip (`claims.published_head_sha`, task 1547) being an ancestor of main — and a `no_branch_no_tip` claim has none (the work rode in on another branch, e.g. a cloud-agent batch, or a `--here` claim). **Record the tip first**: the owner (Archon) sets that column on the task's latest claim to the full 40-char SHA of the main commit — a direct DB write on the box as the DB owner, so it runs under this task's own ledger with the SQL in the ship note (`UPDATE claims SET published_head_sha = '<sha>' WHERE id = (SELECT id FROM claims WHERE task_id = N ORDER BY claimed_at DESC, id DESC LIMIT 1)`). Then the reconciler proves it within ≤5 min, or flip it yourself: `node scripts/gds/api.js POST /api/gds/tasks/N/ship --body '{}'`. Never `no_artifact: true` here — the artifact exists, and the ledger would record a falsehood. Credits land on the flip (ADR 0120). (Before task 1003434 the manual POST refused even with a tip when the claim had no branch; the reconciler path always worked.)
    - **B. A local branch exists with commits ahead of `origin/main` and no PR**: the ship never pushed. From that worktree: `git push -u origin <branch>` then `gh pr create --base main --head <branch> --fill`. Green `unit` → server auto-merge → the reconciler flips it within ~5 min. If it merges but does not flip, do **A**.
    - **C. A PR exists but is `CONFLICTING`**: the branch owner rebases it (`git merge origin/main`, resolve, push) — not this skill, and never `--force`. Report the PR URL and stop.
    - **D. Nothing anywhere** — no branch, no PR, no commit: a codeless confirm. Ask what the task delivered. Work done outside this repo (on the box's instance checkout, a DB-only change captured in the ship note) is legitimately artifact-free → **A** with the reason in the ship body: `--body '{"note":"codeless: <where the work lives>"}'`. If the work was never done, release it instead so it returns to `ready`: `node scripts/gds/release.js N --reason "stranded codeless confirm; nothing delivered"`.

package/docs/module-api-changelog.md

@@ -1311,5 +1311,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.435 with no explicit bump. run 33288364716. (task 1002620)
   1.19.437 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.436 with no explicit bump. run 33289560561. (task 1002620)
+  1.19.438 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.437 with no explicit bump. run 33290212472. (task 1002620)
+  1.19.439 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.438 with no explicit bump. run 33290633434. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/ship-assurance.js

@@ -67,13 +67,22 @@ function normalizeShipAssurance(a) {
 //
 // `deps` is injected so this is unit-testable with no network and no DB.
 async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeError }) {
+  const report = (e) => { if (onProbeError) onProbeError(e); };
+  // The tip is the durable proof (task 1547); the branch/PR status is only a
+  // WITNESS for the out-of-band fallback (task 1002615). A claim with no branch
+  // makes getPublishStatus throw BAD_BRANCH — that used to abort the whole probe
+  // before landProvenForTask ever saw a recorded tip, so a commit provably on main
+  // was refused as "not proven" (strands 1003285/1003286, task 1003434). Each step
+  // now fails on its own: a status miss degrades to status=null, never to no-proof.
+  let publishedSha = null;
+  try { publishedSha = await db.getClaimPublishedSha(taskId); } catch (e) { report(e); }
+  let status = null;
+  try { status = await githubPush.getPublishStatus({ taskId, publishedSha }); } catch (e) { report(e); }
   try {
-    const publishedSha = await db.getClaimPublishedSha(taskId);
-    const status = await githubPush.getPublishStatus({ taskId, publishedSha });
     const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
     if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };
   } catch (e) {
-    if (onProbeError) onProbeError(e);
+    report(e);
   }
 
   if (body.no_artifact === true) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.437",
+  "version": "1.19.439",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.437",
+      "version": "1.19.439",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.437",
+  "version": "1.19.439",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.437'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.439'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hooks_drain.mjs

@@ -0,0 +1,58 @@
+// tests/hooks_drain.mjs — the hooks that talk to the API must exit by DRAINING, never
+// process.exit() (task 1003433; task 1003432 for the Stop hook). On Windows, exiting
+// while a pooled socket is mid-close aborts Node with libuv's UV_HANDLE_CLOSING
+// assertion — a red "hook error" line on every prompt. Each hook is spawned the way
+// the harness spawns it; the contract is: exits on its own, exit 0, no abort on stderr.
+//
+// Offline by construction: no session token in the env and a throwaway HOME, so every
+// hook takes its "not signed in" no-op path — the exit mechanics are what's under test.
+//
+// .claude/hooks/ is instance-materialized and package-excluded (PROTECTED_TOPOLOGY_EXCLUDE
+// in scripts/gds/publish-manifest.js), so a clean core checkout has no hooks: skip cleanly.
+//
+// Run:  node tests/hooks_drain.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HOOKS = ['recall-hints', 'rank-change-greeting', 'conductor'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
+
+if (!HOOKS.every((p) => fs.existsSync(p))) {
+  console.log('hooks_drain: SKIP — .claude/hooks/ is not materialized in this checkout (package-excluded).');
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOME = fs.mkdtempSync(path.join(os.tmpdir(), 'hooks-drain-'));
+const transcript = path.join(HOME, 't.jsonl');
+fs.writeFileSync(transcript, JSON.stringify({ type: 'assistant', message: { content: [{ type: 'text', text: 'hello' }] } }) + '\n');
+const payload = JSON.stringify({ session_id: 's1', transcript_path: transcript, cwd: ROOT, hook_event_name: 'UserPromptSubmit', prompt: 'status?' });
+
+const env = { ...process.env, HOME, USERPROFILE: HOME, CLAUDE_PROJECT_DIR: ROOT };
+for (const k of Object.keys(env)) if (/_API_BASE$|^OTB_|^CLOUDBONGOS_|^GDS_|^PMS_/.test(k)) delete env[k];
+
+for (const hook of HOOKS) {
+  t(`${path.basename(hook)} exits on its own with 0 and no libuv abort (x3)`, () => {
+    for (let i = 0; i < 3; i++) {
+      const r = spawnSync(process.execPath, [hook], { input: payload, encoding: 'utf8', timeout: 15000, env });
+      assert.equal(r.signal, null, `run ${i}: killed by ${r.signal} — did not drain`);
+      assert.equal(r.status, 0, `run ${i}: exit ${r.status}\n${r.stderr}`);
+      assert.ok(!/Assertion failed/.test(r.stderr || ''), `run ${i}: libuv abort on stderr:\n${r.stderr}`);
+    }
+  });
+}
+
+fs.rmSync(HOME, { recursive: true, force: true });
+console.log(`\nhooks_drain: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/ship_assurance.mjs

@@ -186,5 +186,57 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
     'and the deliberate-empty land sites must mark themselves as such');
 });
 
+// task 1003434 — a recorded tip proves the land even when the claim has no branch.
+// Strands 1003285/1003286: commits on main, no branch on the claim. Once the tip was
+// recorded, POST /ship still refused, because getPublishStatus threw BAD_BRANCH before
+// landProvenForTask ever saw the tip. The status probe is a witness, not a
+// prerequisite: its failure must degrade to status=null, never discard the proof.
+const { deriveShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
+const TIP = 'a'.repeat(40);
+console.log('\nthe tip proof does not depend on the branch/PR probe');
+await t('tip in main + getPublishStatus throwing (no branch on the claim) → proof', async () => {
+  const seen = [];
+  const r = await deriveShipAssurance({
+    taskId: 1003285,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      getPublishStatus: async () => { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; },
+      landProvenForTask: async ({ publishedSha, status }) => {
+        seen.push({ publishedSha, status });
+        return publishedSha === TIP ? { proven: true, reason: 'published tip in main' } : { proven: false };
+      },
+    },
+    onProbeError: (e) => seen.push({ probeError: e.code }),
+  });
+  assert.equal(seen.some((s) => s.publishedSha === TIP && s.status === null), true, 'the proof ran with status=null');
+  assert.equal(seen.some((s) => s.probeError === 'BAD_BRANCH'), true, 'the probe failure was still reported');
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+});
+await t('no tip + getPublishStatus throwing → still the 409 refusal (nothing to prove)', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1003253,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      getPublishStatus: async () => { throw new Error('BAD_BRANCH'); },
+      landProvenForTask: async () => ({ proven: false, reason: 'no tip, no PR' }),
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+await t('a proof failure (compare API down) still falls through to the refusal, not a throw', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      getPublishStatus: async () => null,
+      landProvenForTask: async () => { throw new Error('STATUS_FETCH_FAILED'); },
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);