@bongos/core 1.19.82 → 1.19.83

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.82",
-  "core_contract": "1.19.82",
-  "source_commit": "9ca69eb29ee6b3ee602e17cbf1d1ef1ebc9df5f9",
+  "core_version": "1.19.83",
+  "core_contract": "1.19.83",
+  "source_commit": "fff49f72b2b345f6b610b37c943bc45b963f2b40",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:14:31.232Z",
+  "built_at": "2026-08-12T23:29:40.091Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1227,
+    "functional_verbatim": 1228,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1543,
-  "tree_sha256": "253f8de922c6d8cc2023e6a2d28b363fafa2cfdec666f96afc3a0e5d879a918f",
+  "file_count": 1544,
+  "tree_sha256": "ec5d11dea2b4d13543a2593e7b1c13583eefea55e3ffca3b42cd9835cfdd134a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "a574107524d7b0c85130df49b2b165b94dc1d1b0efe1493b7952e49c053c8a53"
+      "sha256": "6f51c67939eacaf510774894625d0a09e6883e4c8e1d8fdea2cf35f8d9f58ea4"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -3412,7 +3412,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "1a7ef193f9f2829668f5dd612972e6cca43fd84dec1e13d2b1c20f7fd99766f9"
+      "sha256": "0534cf4522f5a644301946abf6a703852375fe269401902dfae10d7b9192c3d5"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b41abda8346dddd1c07e48067f2d9d0127aaad506519710b08cea5373a993b98"
+      "sha256": "4e476d4e4a1ce4f6f0065ee8a18903571b5c89783f90929d62b5b5d9b4afe385"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0ed0a2fa31ababaeef64de35d41cba12b4308fef35fe2d831a0532ac503581c8"
+      "sha256": "db68efb63158fb5e544d9afc252161739f7c54c832509dc03fa45878675cb990"
     },
     {
       "path": "public-docs/index.html",
@@ -5039,6 +5039,11 @@
       "mode": "0000644",
       "sha256": "7ad384495370312a57f7c1f0dab4770888c83afd08b89a8dc27aebae408abfd1"
     },
+    {
+      "path": "scripts/gds/publish-credential-check.js",
+      "mode": "0000644",
+      "sha256": "0d700716747617c43e3cf410ef9395cc2f28fff342feef400a8ae45209e893c1"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
@@ -5687,7 +5692,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "793ab7f173efc8c4137e658cae4617f09a9c0df1e1783cd28396337eac6aa83b"
+      "sha256": "95dd72f2698cf288bc35875f4c9a0503393024525c6c2918902e6b22ce1f93f5"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7232,7 +7237,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "e3f843387deb2d2a8f2668490bc740f7291d141b2de70c1556a84cb429bdc21d"
+      "sha256": "ea46629917c3236b9dfb7133af643a9fecc9a205323c345e16671b5093606fd6"
     },
     {
       "path": "tests/publish_manifest.mjs",

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -38,6 +38,10 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 
 > **Update (2026-06-13, task 1028 — GitHub App):** the preferred server credential is now a **GitHub App**, not a standing PAT. The server holds only the App private key (`GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + `GITHUB_APP_PRIVATE_KEY`) and mints a short-lived (~1h), repo-scoped **installation token** per push window — so there's no standing push secret at rest. `github-push.js resolveToken()` prefers the App and falls back to the PAT (`GITHUB_PUSH_TOKEN`) during cutover; `isConfigured()` is true if **either** is set, so the route's inert-safe `503` is unchanged. The App JWT is RS256-signed with `node:crypto` (no new dependency). Same single-repo scopes (Contents r/w + PR r/w + Actions read) and the same can't-touch-`main` guarantee. **LIVE on prod as of 2026-06-13 (task 1043 cutover, blocker 31 resolved):** the App (App ID 4047551, installation 140135657, `repository_selection=selected`) is installed and its key is set in `/etc/example/web-source.env`; verified that the server mints + uses an installation token (`publish-status` → 200, and a broken key fails loud as `503`/error rather than falling back). The old `GITHUB_PUSH_TOKEN` was **removed** — there is now **no standing push secret at rest**, only the App private key.
 
+> **Update (2026-08-12, task 1002733 — verify `Actions: read`, and verify WHICH credential is live):** the 2026-06-13 note above says the PAT was removed and the App is live. **On cloudbongos.com that is no longer true.** Checked on the host this session: <redacted> sets `GITHUB_PUSH_TOKEN` and **none** of `GITHUB_APP_ID` / `GITHUB_APP_INSTALLATION_ID` / `GITHUB_APP_PRIVATE_KEY`. So `appConfigured()` is false and `resolveToken()` falls through to the **PAT** — the App is not the running credential here. Whichever one an instance is actually on, **that** one needs `Actions: read`; don't assume from this ADR's history. If the live credential lacks it, `getPublishStatus`'s deploy probe cannot see workflow runs and reports a merged PR as still deploying **forever**, which stranded task 1002695 at `confirmed` across four reconciler sweeps on 2026-08-12. That failure is invisible from the outside: on a private repo GitHub returns 404 for both "no such workflow" and "not yours", so a single probe cannot tell a legitimately workflow-less instance (the ADR 0108 pin-bump shape) from a blind credential.
+>
+> Check it with `node scripts/gds/publish-credential-check.js` on the host — it lists the repo's workflows as a control call first, so `blind` and `readable_no_workflow` are distinguishable. Task 1002724 makes a blind probe non-fatal (the reconciler falls back to the git-history land proof), but a blind credential means the deploy gate is **not being enforced**, only bypassed.
+
 ## Consequences
 
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.

package/modules/lifecycle/github-push.js

@@ -492,6 +492,87 @@ async function getPublishStatus({ branch }, deps = {}) {
   };
 }
 
+// probeDeployVisibility (task 1002733) — can this instance's publish credential READ
+// the Actions API at all?
+//
+// WHY THIS EXISTS. getPublishStatus's deploy probe answers a question about ONE
+// workflow, and on a private repo GitHub deliberately blurs "not there" and "not
+// yours" — both can surface as 404. So a single call cannot distinguish "this repo
+// has no deploy-prod.yml" (fine; the merge is the land, ADR 0108) from "this token
+// cannot see Actions" (a silent misconfiguration that made task 1002695 strand at
+// confirmed across 4 sweeps on 2026-08-12). Until task 1002724 there was no way to
+// tell them apart without a shell on the host and a hand-run of the API.
+//
+// The fix is a CONTROL call: list the repo's workflows. If that succeeds we can read
+// Actions, so a 404 on deploy-prod.yml genuinely means the file is absent. If the
+// list itself is refused, the credential is blind and every deploy verdict it gives
+// is meaningless.
+//
+// ADR 0055 specifies this credential as Contents rw + Pull requests rw + Actions:
+// read. NOTE resolveToken precedence is deps.token > App installation token > PAT, so
+// an instance runs on ONE of them and the other is irrelevant: a correctly-scoped PAT
+// can be masked by a narrower App grant, and equally an App that was never configured
+// means the PAT is live no matter what the ADR's history says. cloudbongos.com is the
+// second case — checked 2026-08-12, web.env sets GITHUB_PUSH_TOKEN and no GITHUB_APP_*.
+// The remediation string below resolves which one is live rather than guessing.
+async function probeDeployVisibility(deps = {}) {
+  const token = await resolveToken(deps);
+  if (!token) {
+    return { state: 'no_credential', http: null, detail: 'no push credential configured (GITHUB_PUSH_TOKEN / App)', remediation: null };
+  }
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) {
+    return { state: 'no_repo_info', http: null, detail: 'repo owner/name could not be resolved', remediation: null };
+  }
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  const api = `https://api.github.com/repos/${owner}/${repo}`;
+  // Name the credential that is ACTUALLY live, so the remediation points at the right
+  // one. resolveToken() prefers the App and falls back to GITHUB_PUSH_TOKEN, so an
+  // instance can be on either — and cloudbongos.com is on the PAT despite ADR 0055's
+  // history saying the App replaced it (task 1002733).
+  const live = appConfigured() ? 'the GitHub App (GITHUB_APP_* are set — it wins over any PAT)' : 'the PAT in GITHUB_PUSH_TOKEN (no GITHUB_APP_* configured)';
+  const GRANT = `Grant 'Actions: read' on ${owner}/${repo} to ${live} (ADR 0055).`;
+
+  let listRes;
+  try {
+    listRes = await doFetch(`${api}/actions/workflows?per_page=1`, { headers: ghHeaders(token) });
+  } catch (e) {
+    return { state: 'unknown', http: null, detail: `workflows list threw: ${e && e.message}`, remediation: null };
+  }
+  if (!listRes.ok) {
+    return {
+      state: 'blind',
+      http: listRes.status,
+      detail: `cannot list workflows (HTTP ${listRes.status}) — every deploy verdict from this credential is unreliable`,
+      remediation: GRANT,
+    };
+  }
+
+  // Actions is readable. Now the specific workflow: present, or genuinely absent?
+  let runsRes;
+  try {
+    runsRes = await doFetch(`${api}/actions/workflows/deploy-prod.yml/runs?branch=main&per_page=1`, { headers: ghHeaders(token) });
+  } catch (e) {
+    return { state: 'unknown', http: null, detail: `workflow-runs threw: ${e && e.message}`, remediation: null };
+  }
+  if (runsRes.ok) {
+    return { state: 'readable', http: runsRes.status, detail: 'Actions readable; deploy-prod.yml present — the deploy gate is real', remediation: null };
+  }
+  if (runsRes.status === 404) {
+    return {
+      state: 'readable_no_workflow', http: 404,
+      detail: 'Actions readable and deploy-prod.yml is genuinely absent — the merge IS the land (ADR 0108 pin-bump publishing)',
+      remediation: null,
+    };
+  }
+  return {
+    state: 'blind', http: runsRes.status,
+    detail: `workflows list succeeded but deploy-prod.yml runs returned HTTP ${runsRes.status}`,
+    remediation: GRANT,
+  };
+}
+
 // task 1547 — does the PR matched by getPublishStatus actually belong to THIS task?
 // The robust land proof is published-tip containment; this is the fallback used when
 // no published tip was recorded (a legacy row, or a publish in flight across the
@@ -1145,6 +1226,7 @@ module.exports = {
   GATE_OWNER_APPROVED_CONTEXT,
   landConfirmed,
   deployProbeBlind,
+  probeDeployVisibility,
   landProvenForTask,
   prReferencesTask,
   findTaskPullRequest,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.82",
+  "version": "1.19.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.82",
+      "version": "1.19.83",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.82",
+  "version": "1.19.83",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-credential-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// scripts/gds/publish-credential-check.js — can the publish credential SEE Actions?
+// (task 1002733, promoted from idea 1000705.)
+//
+// Run ON THE HOST, where GITHUB_PUSH_TOKEN / the GitHub App env lives:
+//   node scripts/gds/publish-credential-check.js
+//
+// WHY. On 2026-08-12 task 1002695 stranded at 'confirmed' across four reconciler
+// sweeps: its PR was MERGED with green checks, but the server's deploy probe kept
+// answering 'pending' because the credential could not read the Actions API. That
+// blindness was invisible — the only way to find it was to notice a strand and
+// hand-run getPublishStatus against the live server. This turns a silent
+// misconfiguration into a one-command answer.
+//
+// Task 1002724 stopped the blindness from stranding work (a blind probe no longer
+// vetoes a git-history-proven land). This tells you whether you are relying on that
+// fallback instead of a real deploy gate.
+//
+// Exit codes: 0 = credential can read Actions (gate is real, or the workflow is
+// legitimately absent), 1 = BLIND (remediation printed), 2 = nothing to check.
+
+const githubPush = require('../../modules/lifecycle/github-push');
+const { cliExit } = require('./cli-lib');
+
+const C = process.stdout.isTTY
+  ? { g: '\x1b[32m', y: '\x1b[33m', r: '\x1b[31m', b: '\x1b[1m', x: '\x1b[0m' }
+  : { g: '', y: '', r: '', b: '', x: '' };
+
+(async () => {
+  if (!githubPush.isConfigured()) {
+    console.log(`${C.y}!${C.x} No publish credential configured on this machine.`);
+    console.log('  This check belongs on the server/host that holds GITHUB_PUSH_TOKEN or the GitHub App env.');
+    return cliExit(2);
+  }
+
+  let probe;
+  try {
+    probe = await githubPush.probeDeployVisibility();
+  } catch (e) {
+    console.log(`${C.r}✖${C.x} probe failed: ${e && e.message}`);
+    return cliExit(1);
+  }
+
+  const http = probe.http ? ` (HTTP ${probe.http})` : '';
+  switch (probe.state) {
+    case 'readable':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'readable_no_workflow':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'blind':
+      console.log(`${C.r}✖${C.x} ${C.b}BLIND${C.x}${http} — ${probe.detail}`);
+      console.log('');
+      console.log(`  ${C.b}Fix:${C.x} ${probe.remediation}`);
+      console.log('  Until then the reconciler falls back to the git-history land proof (task 1002724),');
+      console.log('  so work still lands — but the deploy gate is not actually being enforced.');
+      return cliExit(1);
+    default:
+      console.log(`${C.y}!${C.x} ${probe.state}${http} — ${probe.detail}`);
+      return cliExit(2);
+  }
+})();

package/src/module-api.js

@@ -591,8 +591,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
 //   1.19.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
+//   1.19.83 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.82 with no explicit bump. run 31651046759. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.82'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.83'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -570,5 +570,74 @@ await t('landConfirmed: unconfigured deploy counts as landed, but ONLY when merg
   assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'none' }), false, 'none ≠ unconfigured — no PR at all is not a land');
 });
 
+// ===========================================================================
+// task 1002733 — probeDeployVisibility: is the publish credential BLIND?
+//
+// On a private repo GitHub deliberately blurs "not there" and "not yours" — both
+// can surface as 404 — so one call cannot tell "this repo has no deploy-prod.yml"
+// (fine) from "this credential cannot read Actions" (the silent misconfiguration
+// that stranded task 1002695 across 4 sweeps). The CONTROL call is listing the
+// repo's workflows: if that works, a 404 on the specific workflow is genuine.
+// ===========================================================================
+
+await t('probeDeployVisibility: workflows list 403 → blind, with remediation', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(403, { message: 'Resource not accessible' });
+    throw new Error('must not probe the specific workflow once the list is refused: ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+  assert.match(p.remediation, /Actions: read/i);
+  // The remediation must name the credential that is ACTUALLY live rather than
+  // guessing: resolveToken prefers the App and falls back to GITHUB_PUSH_TOKEN, and an
+  // instance runs on exactly one of them. Pointing at the wrong one sends the operator
+  // to widen permissions on a credential that is not in play (cloudbongos.com is on
+  // the PAT, despite ADR 0055's history saying the App replaced it — task 1002733).
+  assert.match(
+    p.remediation, /GITHUB_APP_\*|GITHUB_PUSH_TOKEN/,
+    'must identify which credential resolveToken will actually use'
+  );
+});
+
+await t('probeDeployVisibility: list OK + runs 404 → readable_no_workflow (NOT blind)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [{ id: 1, path: '.github/workflows/unit.yml' }] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(404, { message: 'Not Found' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable_no_workflow', 'a 404 behind a readable list means the workflow is genuinely absent');
+  assert.equal(p.remediation, null, 'nothing to fix — this is the ADR 0108 pin-bump shape');
+});
+
+await t('probeDeployVisibility: list OK + runs OK → readable (the deploy gate is real)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(200, { workflow_runs: [] });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable');
+  assert.equal(p.remediation, null);
+});
+
+await t('probeDeployVisibility: list OK but runs 403 → still blind', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(403, { message: 'nope' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+});
+
+await t('probeDeployVisibility: no credential → no_credential, not a false alarm', async () => {
+  const p = await gp.probeDeployVisibility({ token: null, repoInfo: REPO, fetchImpl: async () => { throw new Error('must not fetch'); } });
+  assert.equal(p.state, 'no_credential');
+  assert.equal(p.remediation, null);
+});
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);