@bongos/core 1.19.84 → 1.19.86

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.84",
-  "core_contract": "1.19.84",
-  "source_commit": "39493e5006e0adc42f628e8fcc7a96ff0a10a024",
+  "core_version": "1.19.86",
+  "core_contract": "1.19.86",
+  "source_commit": "d492268af911f3775f9577d12281d2c38399727f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:32:24.005Z",
+  "built_at": "2026-08-13T00:41:13.561Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1550,
-  "tree_sha256": "5b888a43d2616ba06ba176e5611635624d1e8f8d6bf60225393639f236b5fba9",
+  "tree_sha256": "6f0e9235712ce2021a2856ab9a969734a249d91bd64b367f1341555824ea03b8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3422,7 +3422,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "0534cf4522f5a644301946abf6a703852375fe269401902dfae10d7b9192c3d5"
+      "sha256": "aef4e5dca5cbea3c7c2041b877a98204f2cb21c3a9ce017cad57955d2212cf96"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -4082,12 +4082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "af4e543cec8805d479252218ee7fb173f5daa82683719b544a5809c265426638"
+      "sha256": "2bd4658aa54dea1a2ee6fdd04989f69633896a45aa8461017ad6b48abeb95579"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "34009dd8769a83f36d6825e22ac90bae4370416e06e280746c78ba44afcd9624"
+      "sha256": "719540bff50475655aee54cfa4ca4f261e04ec1039b6e4b7d0428b6843420fc5"
     },
     {
       "path": "public-docs/index.html",
@@ -5722,7 +5722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c6df7e76c73ea039b407602d8e05f082f1ecb7447fa629fd6a9d8fdaa38f3f51"
+      "sha256": "0a7e91c72a110593259da6dca1a15fbdc2b474a5016d6ddfbb129311909ac292"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7267,7 +7267,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "ea46629917c3236b9dfb7133af643a9fecc9a205323c345e16671b5093606fd6"
+      "sha256": "db309db9b8fe350a64708d2a0c9dd1622ad0e5bfdef7c89775721ff3daa7042d"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7277,7 +7277,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "ff2428b394a50abf4a593fcbfdb98afe4b56ffdbbffdc81198a102e72b480b9f"
+      "sha256": "fed6533bd829adc0fc2126c48b28248c90bd32660650f2af91fee112e3f7369a"
     },
     {
       "path": "tests/rank_gate.mjs",

package/modules/lifecycle/github-push.js

@@ -385,8 +385,11 @@ async function enableAutoMerge({ nodeId }, deps = {}) {
 //   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
 //   pr_state ∈ open|closed|none,
 //   deploy_status ∈ pending|success|none|unconfigured|unavailable
-//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472;
-//    'unavailable'  = we could not READ the deploy state at all — task 1002724).
+//   ('unconfigured' = this repo has no deploy-prod.yml (404), OR the token can never
+//      read the Actions API (403 — task 1002737: a permanent scope gap reads the same
+//      as a permanently-missing workflow, so both are "no readable deploy to wait for";
+//      task 1002472 for the 404 case);
+//    'unavailable'  = a transient read failure (5xx/429/other) — task 1002724).
 //   deploy_probe = { state, http, detail } — WHY the probe landed where it did,
 //   so a stuck disposition is diagnosable without a shell on the host.
 // Mirrors ship.js pollCiDeploy's two-stage check (PR merged -> deploy run).
@@ -457,27 +460,43 @@ async function getPublishStatus({ branch }, deps = {}) {
           detail: exact ? 'deploy run for the merge commit' : 'main deploy succeeded after the merge (ADR 0161 carrier)',
         };
       }
-    } else if (runsRes.status === 404) {
-      // task 1002472 — the workflow FILE does not exist in this repo, so there is no
-      // deploy to wait for and 'pending' would never resolve. The 404 is unambiguous:
+    } else if (runsRes.status === 404 || runsRes.status === 403) {
+      // task 1002472 — the workflow FILE does not exist in this repo (404), so there is
+      // no deploy to wait for and 'pending' would never resolve. The 404 is unambiguous:
       // the /pulls fetch above already threw STATUS_FETCH_FAILED if the repo were
       // unreachable, so reaching here means the repo resolved and only the workflow is
       // missing — a permanent condition. Instances that publish by pin-bump
       // (package-core → bongos upgrade, ADR 0108) never have a deploy-prod.yml at all;
       // reporting 'pending' pinned every merged PR at confirmed forever.
+      //
+      // task 1002737 — a 403 is the SAME permanent shape, just for a different reason:
+      // GITHUB_PUSH_TOKEN has Contents/Pull requests/Commit statuses but not
+      // `actions:read`, so the Actions API is categorically unreadable, not
+      // intermittently unreadable. That is not "waiting on a deploy" (transient,
+      // 5xx/429 territory) — it is "this instance can never see deploy runs", which is
+      // exactly what 'unconfigured' already means for the no-workflow-file case. Folding
+      // 403 into 'unconfigured' (rather than 'unavailable') lets landConfirmed() flip the
+      // moment the PR merges, instead of depending on the git-history bypass
+      // (deployProbeBlind) to route around a probe that will 403 on every sweep forever.
       deployStatus = 'unconfigured';
-      deployProbe = { state: 'unconfigured', http: 404, detail: 'no deploy-prod.yml in this repo' };
+      deployProbe = {
+        state: 'unconfigured', http: runsRes.status,
+        detail: runsRes.status === 404
+          ? 'no deploy-prod.yml in this repo'
+          : 'workflow-runs read forbidden (token lacks Actions:read) — treated as no readable deploy to wait for',
+      };
     } else {
       // task 1002724 — this branch used to fall through as 'pending' on the comment
-      // "5xx/403/rate-limit is transient". A 403 from a token without `actions:read`
-      // is NOT transient, it is forever — and 'pending' on a MERGED PR makes the
-      // reconciler suppress the land proof on every sweep (prMidDeploy), so the task
-      // strands at 'confirmed' permanently with a bare 'pr_not_landed' and no clue
-      // why. That is exactly the live 2026-08-12 strand (task 1002695 / PR 91:
-      // GitHub reported MERGED with green checks, the server reported deploy
-      // 'pending' for 18 min across 4 sweeps, and only a manual ship cleared it).
-      // Call it what it is — we could not READ the deploy state — and let the
-      // reconciler decide whether git history already proves the land.
+      // "5xx/403/rate-limit is transient". 403 is handled above (task 1002737: it is
+      // forever, not transient); what's left here (5xx, 429, other 4xx) IS genuinely
+      // transient or unexpected, so 'pending' on a MERGED PR making the reconciler
+      // suppress the land proof on every sweep (prMidDeploy) used to strand the task at
+      // 'confirmed' permanently with a bare 'pr_not_landed' and no clue why. That was
+      // the live 2026-08-12 strand (task 1002695 / PR 91: GitHub reported MERGED with
+      // green checks, the server reported deploy 'pending' for 18 min across 4 sweeps,
+      // and only a manual ship cleared it). Call it what it is — we could not READ the
+      // deploy state — and let the reconciler decide whether git history already
+      // proves the land.
       deployStatus = 'unavailable';
       deployProbe = { state: 'unavailable', http: runsRes.status, detail: `workflow-runs read failed (HTTP ${runsRes.status})` };
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.84",
+  "version": "1.19.86",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.84",
+      "version": "1.19.86",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.84",
+  "version": "1.19.86",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -595,8 +595,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.82 with no explicit bump. run 31651046759. (task 1002620)
 //   1.19.84 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.83 with no explicit bump. run 31651217970. (task 1002620)
+//   1.19.85 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.84 with no explicit bump. run 31651469729. (task 1002620)
+//   1.19.86 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.85 with no explicit bump. run 31655210981. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.84'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.86'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -228,8 +228,9 @@ await t('getPublishStatus: no PR for the head → none', async () => {
 // task 1002472 — an instance with NO deploy-prod.yml must not wait on it forever.
 // The 404 is unambiguous: the /pulls fetch above already threw if the repo were
 // unreachable, so a 404 HERE means the workflow file is absent — permanent, not
-// transient. Anything else (5xx/403/network) stays 'pending' so a real deploy is
-// still waited on.
+// transient. task 1002737 folds 403 into this same bucket (see the test below);
+// anything else (5xx/429/network) still stays 'pending'/'unavailable' so a real
+// deploy is still waited on.
 await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deploy-prod.yml)', async () => {
   const mergeSha = 'd'.repeat(40);
   const fetchImpl = async (url) => {
@@ -242,18 +243,39 @@ await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deplo
   assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
 });
 
-// task 1002724 — an unreadable deploy state is its OWN thing: not "no workflow"
-// (which would land it) and not "a deploy is running" (which vetoes the land proof
-// forever). A 403 from a token without `actions:read` never resolves, and calling
-// it 'pending' stranded task 1002695 at confirmed across 4 sweeps on 2026-08-12.
-await t('getPublishStatus: merged + workflow-runs 5xx/403 → unavailable, never landConfirmed', async () => {
+// task 1002737 — a 403 (token lacks `actions:read`) is the SAME permanent shape as a
+// missing workflow file: the Actions API can never be read on this token, not just
+// right now. Folding it into 'unconfigured' lets landConfirmed() flip the instant the
+// PR merges, instead of leaning on the git-history bypass (deployProbeBlind) to route
+// around a probe that would 403 on every single sweep forever. This is the live
+// cloudbongos.com shape (GITHUB_PUSH_TOKEN has Contents/Pull requests/Commit statuses
+// but not Actions) that stranded 1001772/1002725/1002726/1002729 at confirmed.
+await t('getPublishStatus: merged + workflow-runs 403 → unconfigured (permanent scope gap, not unavailable)', async () => {
+  const mergeSha = 'f'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(403, { message: 'Resource not accessible by personal access token' });
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'unconfigured', 'a permanent scope gap must resolve like a missing workflow, not stay unavailable');
+  assert.equal(s.deploy_probe.http, 403, 'the probe must carry the HTTP status for diagnosis');
+  assert.equal(gp.landConfirmed(s), true, 'a merged PR with an unreadable-forever deploy probe must land on its own');
+  assert.equal(gp.deployProbeBlind(s), false, 'this is not blindness — it is a known-permanent non-deploying config');
+});
+
+// task 1002724 — a genuinely TRANSIENT read failure (5xx/429/other) is its OWN thing:
+// not "no workflow" (which would land it) and not "a deploy is running" (which vetoes
+// the land proof forever). Calling it 'pending' stranded task 1002695 at confirmed
+// across 4 sweeps on 2026-08-12.
+await t('getPublishStatus: merged + workflow-runs 5xx → unavailable, never landConfirmed', async () => {
   const mergeSha = 'e'.repeat(40);
   const mk = (code) => async (url) => {
     if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
     if (url.includes('deploy-prod.yml/runs')) return jsonRes(code, { message: 'nope' });
     throw new Error('unexpected ' + url);
   };
-  for (const code of [500, 502, 403]) {
+  for (const code of [500, 502, 429]) {
     const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
     assert.equal(s.deploy_status, 'unavailable', `${code} must NOT be read as "no workflow" nor as a running deploy`);
     assert.equal(s.deploy_probe.http, code, 'the probe must carry the HTTP status for diagnosis');

package/tests/publish_reconciler.mjs

@@ -340,17 +340,24 @@ test('1002472 merged + deploy unconfigured + published tip in main → ships', a
 // task 1002724 — the deploy probe went BLIND and vetoed a provable land forever.
 //
 // Live on 2026-08-12: task 1002695 / PR 91 was MERGED with green checks at
-// 20:25:23Z, but the server's deploy probe answered 'pending' (a 403 from a token
-// without `actions:read` — permanent, not transient). merged + !landConfirmed made
-// prMidDeploy true, which SUPPRESSED landProvenForTask on every sweep, so four
-// sweeps across 18 minutes all logged a bare '1002695:pr_not_landed' and only a
-// manual POST /ship cleared it. A probe that cannot see anything must not outrank
-// main's git history, and the disposition must say which probe refused.
+// 20:25:23Z, but the server's deploy probe answered 'pending' (at the time, a 403
+// from a token without `actions:read` fell through to 'pending' — permanent, not
+// transient). merged + !landConfirmed made prMidDeploy true, which SUPPRESSED
+// landProvenForTask on every sweep, so four sweeps across 18 minutes all logged a
+// bare '1002695:pr_not_landed' and only a manual POST /ship cleared it. A probe
+// that cannot see anything must not outrank main's git history, and the
+// disposition must say which probe refused.
+//
+// task 1002737 later gave THAT specific 403 shape its own direct fix (folded into
+// 'unconfigured', landConfirmed() true immediately — see publish_branch_route.mjs).
+// This test's fixture uses a 500 instead, so it still exercises the general "blind
+// probe, git history wins" safety net this task built — the one still needed for a
+// genuinely transient 5xx/429, where 'unconfigured' would be the wrong answer.
 // ---------------------------------------------------------------------------
 const BLIND = (id) => ({
   ...landedPrFor(id),
   deploy_status: 'unavailable',
-  deploy_probe: { state: 'unavailable', http: 403, detail: 'workflow-runs read failed (HTTP 403)' },
+  deploy_probe: { state: 'unavailable', http: 500, detail: 'workflow-runs read failed (HTTP 500)' },
   merge_sha: MERGE_SHA,
 });