@bongos/core 1.19.83 → 1.19.85

package/src/module-api.js

@@ -593,8 +593,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
 //   1.19.83 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.82 with no explicit bump. run 31651046759. (task 1002620)
+//   1.19.84 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.83 with no explicit bump. run 31651217970. (task 1002620)
+//   1.19.85 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.84 with no explicit bump. run 31651469729. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.83'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.85'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -228,8 +228,9 @@ await t('getPublishStatus: no PR for the head → none', async () => {
 // task 1002472 — an instance with NO deploy-prod.yml must not wait on it forever.
 // The 404 is unambiguous: the /pulls fetch above already threw if the repo were
 // unreachable, so a 404 HERE means the workflow file is absent — permanent, not
-// transient. Anything else (5xx/403/network) stays 'pending' so a real deploy is
-// still waited on.
+// transient. task 1002737 folds 403 into this same bucket (see the test below);
+// anything else (5xx/429/network) still stays 'pending'/'unavailable' so a real
+// deploy is still waited on.
 await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deploy-prod.yml)', async () => {
   const mergeSha = 'd'.repeat(40);
   const fetchImpl = async (url) => {
@@ -242,18 +243,39 @@ await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deplo
   assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
 });
 
-// task 1002724 — an unreadable deploy state is its OWN thing: not "no workflow"
-// (which would land it) and not "a deploy is running" (which vetoes the land proof
-// forever). A 403 from a token without `actions:read` never resolves, and calling
-// it 'pending' stranded task 1002695 at confirmed across 4 sweeps on 2026-08-12.
-await t('getPublishStatus: merged + workflow-runs 5xx/403 → unavailable, never landConfirmed', async () => {
+// task 1002737 — a 403 (token lacks `actions:read`) is the SAME permanent shape as a
+// missing workflow file: the Actions API can never be read on this token, not just
+// right now. Folding it into 'unconfigured' lets landConfirmed() flip the instant the
+// PR merges, instead of leaning on the git-history bypass (deployProbeBlind) to route
+// around a probe that would 403 on every single sweep forever. This is the live
+// cloudbongos.com shape (GITHUB_PUSH_TOKEN has Contents/Pull requests/Commit statuses
+// but not Actions) that stranded 1001772/1002725/1002726/1002729 at confirmed.
+await t('getPublishStatus: merged + workflow-runs 403 → unconfigured (permanent scope gap, not unavailable)', async () => {
+  const mergeSha = 'f'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(403, { message: 'Resource not accessible by personal access token' });
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'unconfigured', 'a permanent scope gap must resolve like a missing workflow, not stay unavailable');
+  assert.equal(s.deploy_probe.http, 403, 'the probe must carry the HTTP status for diagnosis');
+  assert.equal(gp.landConfirmed(s), true, 'a merged PR with an unreadable-forever deploy probe must land on its own');
+  assert.equal(gp.deployProbeBlind(s), false, 'this is not blindness — it is a known-permanent non-deploying config');
+});
+
+// task 1002724 — a genuinely TRANSIENT read failure (5xx/429/other) is its OWN thing:
+// not "no workflow" (which would land it) and not "a deploy is running" (which vetoes
+// the land proof forever). Calling it 'pending' stranded task 1002695 at confirmed
+// across 4 sweeps on 2026-08-12.
+await t('getPublishStatus: merged + workflow-runs 5xx → unavailable, never landConfirmed', async () => {
   const mergeSha = 'e'.repeat(40);
   const mk = (code) => async (url) => {
     if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
     if (url.includes('deploy-prod.yml/runs')) return jsonRes(code, { message: 'nope' });
     throw new Error('unexpected ' + url);
   };
-  for (const code of [500, 502, 403]) {
+  for (const code of [500, 502, 429]) {
     const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
     assert.equal(s.deploy_status, 'unavailable', `${code} must NOT be read as "no workflow" nor as a running deploy`);
     assert.equal(s.deploy_probe.http, code, 'the probe must carry the HTTP status for diagnosis');

package/tests/publish_reconciler.mjs

@@ -340,17 +340,24 @@ test('1002472 merged + deploy unconfigured + published tip in main → ships', a
 // task 1002724 — the deploy probe went BLIND and vetoed a provable land forever.
 //
 // Live on 2026-08-12: task 1002695 / PR 91 was MERGED with green checks at
-// 20:25:23Z, but the server's deploy probe answered 'pending' (a 403 from a token
-// without `actions:read` — permanent, not transient). merged + !landConfirmed made
-// prMidDeploy true, which SUPPRESSED landProvenForTask on every sweep, so four
-// sweeps across 18 minutes all logged a bare '1002695:pr_not_landed' and only a
-// manual POST /ship cleared it. A probe that cannot see anything must not outrank
-// main's git history, and the disposition must say which probe refused.
+// 20:25:23Z, but the server's deploy probe answered 'pending' (at the time, a 403
+// from a token without `actions:read` fell through to 'pending' — permanent, not
+// transient). merged + !landConfirmed made prMidDeploy true, which SUPPRESSED
+// landProvenForTask on every sweep, so four sweeps across 18 minutes all logged a
+// bare '1002695:pr_not_landed' and only a manual POST /ship cleared it. A probe
+// that cannot see anything must not outrank main's git history, and the
+// disposition must say which probe refused.
+//
+// task 1002737 later gave THAT specific 403 shape its own direct fix (folded into
+// 'unconfigured', landConfirmed() true immediately — see publish_branch_route.mjs).
+// This test's fixture uses a 500 instead, so it still exercises the general "blind
+// probe, git history wins" safety net this task built — the one still needed for a
+// genuinely transient 5xx/429, where 'unconfigured' would be the wrong answer.
 // ---------------------------------------------------------------------------
 const BLIND = (id) => ({
   ...landedPrFor(id),
   deploy_status: 'unavailable',
-  deploy_probe: { state: 'unavailable', http: 403, detail: 'workflow-runs read failed (HTTP 403)' },
+  deploy_probe: { state: 'unavailable', http: 500, detail: 'workflow-runs read failed (HTTP 500)' },
   merge_sha: MERGE_SHA,
 });