@bongos/core 1.19.865 → 1.19.867

package/tests/ship_merge_gate.mjs

@@ -0,0 +1,172 @@
+// tests/ship_merge_gate.mjs — the fitness gate on the merge result (task 1004032).
+//
+// WHY. The local-merge land path pushes straight to origin/main, where no
+// required status check can reach it. On 2026-09-17 a branch that ALREADY
+// failed fitness was merged and pushed by ship.js, main went red, and three
+// confirmed tasks could not land until the baseline was raised by hand.
+//
+// The load-bearing assertions are the two that were wrong before this gate
+// existed: a merge result that regresses a clean base must be REFUSED, and a
+// failure inherited from an already-red base must NOT be — a gate that blocked
+// on an inherited failure would have deadlocked that same incident instead of
+// merely spoiling an afternoon.
+//
+// The decision is exercised as the pure function it is; the wiring is pinned
+// separately by reading ship-merge.js, because a correct verdict that is never
+// consulted, or consulted after the push, is worth nothing.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gate = require(path.join(ROOT, 'scripts', 'gds', 'ship-merge-gate.js'));
+
+test('a clean merge result is waved through, and the base is never consulted', () => {
+  assert.deepEqual(gate.mergeGateVerdict({ mergeClean: true, baseClean: null }), { block: false, reason: 'clean' });
+  assert.deepEqual(gate.mergeGateVerdict({ mergeClean: true, baseClean: false }), { block: false, reason: 'clean' });
+});
+
+test('THE INCIDENT: a failing merge result over a clean base is REFUSED', () => {
+  const verdict = gate.mergeGateVerdict({ mergeClean: false, baseClean: true });
+  assert.equal(verdict.block, true, 'a branch that turns main red must not be pushed');
+  assert.equal(verdict.reason, 'regression');
+});
+
+test('an INHERITED failure is not the shipper’s fault — it must not block', () => {
+  const verdict = gate.mergeGateVerdict({ mergeClean: false, baseClean: false });
+  assert.equal(verdict.block, false, 'blocking here deadlocks every ship while main is red');
+  assert.equal(verdict.reason, 'pre-existing');
+});
+
+test('an unmeasurable base blocks — the gate may not guess innocence', () => {
+  for (const baseClean of [null, undefined]) {
+    const verdict = gate.mergeGateVerdict({ mergeClean: false, baseClean });
+    assert.equal(verdict.block, true);
+    assert.equal(verdict.reason, 'unmeasured-base');
+  }
+});
+
+test('every verdict reason carries a message that names its own case', () => {
+  const seen = new Set();
+  for (const reason of ['clean', 'pre-existing', 'regression', 'unmeasured-base']) {
+    const msg = gate.gateMessage(reason);
+    assert.match(msg, /fitness/, `${reason} must say what was measured`);
+    assert.equal(seen.has(msg), false, `${reason} reuses another verdict’s wording`);
+    seen.add(msg);
+  }
+  // A blocked ship has to say the task is parked, or the builder reads a bare
+  // failure and re-runs the ship instead of fixing the tree.
+  assert.match(gate.gateMessage('regression'), /confirmed/);
+  assert.match(gate.gateMessage('unmeasured-base'), /confirmed/);
+});
+
+test('probeBaseClean cannot answer without a base commit', () => {
+  // The null-sha case must not reach `git worktree add` at all: an empty ref
+  // there resolves to HEAD, which after the merge is the merge itself — the
+  // gate would then compare the merge result against ITSELF and always pass.
+  assert.equal(gate.probeBaseClean(ROOT, null), null);
+  assert.equal(gate.probeBaseClean(ROOT, ''), null);
+});
+
+test('WIRING: ship-merge.js runs the gate BEFORE the push that makes it main', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-merge.js'), 'utf8');
+  const gateAt = src.indexOf('gateMergeResult({');
+  const pushAt = src.indexOf('push-main.js');
+  assert.notEqual(gateAt, -1, 'ship-merge.js must call the gate');
+  assert.notEqual(pushAt, -1, 'ship-merge.js must still push through push-main.js');
+  assert.ok(gateAt < pushAt, 'the gate runs after the push — it would measure a main that is already red');
+  // …and it must actually act on the verdict. A call whose result is dropped
+  // reads as a gate in a diff and is a no-op at runtime.
+  assert.match(src, /fitnessVerdict\.block/, 'the verdict must be consulted');
+  assert.match(src.slice(gateAt, pushAt), /return landBailed\(/, 'a blocked merge must bail before the push');
+});
+
+test('the gate measures the PRE-MERGE base, captured before the branch lands', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-merge.js'), 'utf8');
+  const baseAt = src.indexOf('const baseSha =');
+  const mergeAt = src.indexOf('buildMergeArgv(branch, valueSummary)');
+  assert.notEqual(baseAt, -1, 'the base sha must be captured');
+  assert.ok(baseAt < mergeAt, 'the base sha is read after the merge — it would name the merge commit itself');
+});
+
+// The bug that the first cut of this gate actually shipped with, and that only
+// a replay of the real incident caught: fitness.js resolves the repo it
+// measures from its OWN __dirname and ignores cwd, so running this worktree's
+// copy against another tree measures this worktree and calls the other one
+// clean. These fixtures are exit codes, not real gates — if runFitnessAt ever
+// goes back to invoking a fixed sibling script, the failing fixture returns
+// true and this reds.
+function fakeTree(exitCode) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-fixture-'));
+  fs.mkdirSync(path.join(dir, 'scripts', 'gds'), { recursive: true });
+  const body = exitCode === 0 ? 'process.exit(0);\n' : `process.exit(${exitCode});\n`;
+  fs.writeFileSync(path.join(dir, 'scripts', 'gds', 'fitness.js'), body);
+  return dir;
+}
+
+test('runFitnessAt runs the MEASURED TREE\u2019s own fitness.js, not this one\u2019s', () => {
+  const green = fakeTree(0);
+  const red = fakeTree(1);
+  try {
+    assert.equal(gate.runFitnessAt(green), true, 'a passing tree must certify');
+    assert.equal(gate.runFitnessAt(red), false, 'a failing tree reported clean means the wrong tree was measured');
+  } finally {
+    fs.rmSync(green, { recursive: true, force: true });
+    fs.rmSync(red, { recursive: true, force: true });
+  }
+});
+
+test('a tree with no fitness.js cannot be certified', () => {
+  const bare = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-bare-'));
+  try {
+    assert.equal(gate.runFitnessAt(bare), false, 'no gate present must read as "cannot certify", never as clean');
+  } finally {
+    fs.rmSync(bare, { recursive: true, force: true });
+  }
+});
+
+// The hacker finding on the first cut: a boolean outcome made "fitness crashed"
+// and "fitness found something" the same answer, and since a FAILING base waves
+// the ship through, a merely-broken probe would have certified a real
+// regression as inherited. A control that degrades to permissive under infra
+// flakiness is not a control.
+test('a crashed run is UNMEASURABLE, not a finding', () => {
+  const crashed = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-crash-'));
+  fs.mkdirSync(path.join(crashed, 'scripts', 'gds'), { recursive: true });
+  // A tree whose gate cannot even be parsed: node exits non-zero, so this one
+  // still reads as a finding — that is deliberate, it IS a broken committed
+  // gate. The infra case is the one below it: no gate in the tree at all.
+  try {
+    assert.equal(gate.fitnessOutcome(path.join(crashed, 'nope')), 'unmeasurable');
+    assert.equal(gate.fitnessOutcome(crashed), 'unmeasurable', 'a tree with no fitness.js cannot be judged');
+  } finally {
+    fs.rmSync(crashed, { recursive: true, force: true });
+  }
+});
+
+test('the tri-state keeps clean and failing apart', () => {
+  const green = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-green-'));
+  const red = fs.mkdtempSync(path.join(os.tmpdir(), 'merge-gate-red-'));
+  for (const [dir, code] of [[green, 0], [red, 1]]) {
+    fs.mkdirSync(path.join(dir, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'scripts', 'gds', 'fitness.js'), `process.exit(${code});\n`);
+  }
+  try {
+    assert.equal(gate.fitnessOutcome(green), 'clean');
+    assert.equal(gate.fitnessOutcome(red), 'failing', 'a non-zero exit is a real verdict, not infra noise');
+  } finally {
+    fs.rmSync(green, { recursive: true, force: true });
+    fs.rmSync(red, { recursive: true, force: true });
+  }
+});
+
+test('an unmeasurable base blocks rather than waving the ship through', () => {
+  // The end-to-end shape of the finding: probeBaseClean returns null for a base
+  // it could not measure, and null blocks.
+  assert.equal(gate.mergeGateVerdict({ mergeClean: false, baseClean: null }).block, true);
+});