@bongos/core 1.19.875 → 1.19.877

package/scripts/gds/deploy-main-audit-gate.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+# scripts/gds/deploy-main-audit-gate.sh — the SEC #863 / ADR 0043 deploy-side gate.
+#
+# Refuses a deploy when a builder BELOW Metic modified a permission-sensitive path in the
+# delta this deploy introduces. Run from the instance checkout root, AFTER the working tree
+# has been moved to the new commit and BEFORE anything is migrated or restarted.
+#
+#   OTB_DEPLOY_PREV_SHA="$(git rev-parse HEAD)"; export OTB_DEPLOY_PREV_SHA   # BEFORE the pull
+#   git reset --hard origin/main
+#   sh node_modules/@bongos/core/scripts/gds/deploy-main-audit-gate.sh || exit 1
+#   ...migrate, restart...
+#
+# WHY THIS LIVES IN THE CORE (task 1001426). It used to live in the control-plane repo's
+# infra/, where a standalone instance checkout cannot reach it — and on cloudbongos.com it
+# was never wired into ~/deploy.sh at all, so the "poison never reaches prod" check had
+# never once run. Shipping it beside main-audit.js means every instance inherits the gate
+# with its pinned core, and there is no per-instance copy to drift.
+#
+# THE MARKER IS THE CHECKED-OUT HEAD, AND IT ADVANCES ONLY ON SUCCESS.
+# That is the substance of this task and the reason the restore below is in the GATE rather
+# than in each caller's deploy script. The gate can only audit what was pulled, so it runs
+# after the tree has already moved. Exiting non-zero and leaving it moved would mean the
+# next deploy computes OTB_DEPLOY_PREV_SHA from the POISONED commit, never re-audits that
+# delta, and finds the poison already checked out — the marker-bypass this gate exists to
+# close, reintroduced one layer up. So a refusal puts the tree back where it started.
+# Set OTB_GATE_NO_RESTORE=1 only when the caller restores it itself.
+#
+# STRICT IS OFF BY DEFAULT, AND THAT IS NOT LAZINESS. Rank resolution keys on github_login
+# only (#863-followup finding #6: display_name is builder-controlled, so keying it let one
+# builder alias another's rank). A deploy lane whose commits are authored under a human
+# display name ("Firstname Lastname") rather than the builder's github_login therefore
+# resolves to nothing, and OTB_AUDIT_STRICT=1 would block every deploy forever.
+# Non-strict still hard-blocks the incident class this was built for: a RESOLVED below-Metic
+# author touching a protected path. Turn strict on once the lane commits under logins.
+#
+# KNOWN LIMIT, stated because a gate nobody distrusts is worse than no gate: if the roster
+# cannot be read at all, every author is unresolved and non-strict passes. main-audit.js
+# announces that loudly on stderr (task 1001426 gave it a fallback and a voice — it used to
+# fail silently and return an empty map, so the gate reported a clean audit that never ran).
+# Availability is chosen over a hard stop deliberately: a database blip must not freeze
+# deploys. Read the stderr.
+
+set -eu
+
+if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ]; then
+  OTB_AUDIT_RANGE="${OTB_DEPLOY_PREV_SHA}..HEAD"; export OTB_AUDIT_RANGE
+  echo "main audit: range ${OTB_AUDIT_RANGE} (exact deploy delta)"
+else
+  echo "main audit: OTB_DEPLOY_PREV_SHA not set — falling back to the wide window."
+  echo "  (Recommended: capture OTB_DEPLOY_PREV_SHA=\$(git rev-parse HEAD) BEFORE the pull;"
+  echo "   without it a poisoned commit buried under the window can escape, and a refusal"
+  echo "   cannot put the tree back.)"
+fi
+
+STRICT=""
+[ "${OTB_AUDIT_STRICT:-0}" = "1" ] && STRICT="--strict"
+
+# Prefer the installed core; fall back to an in-tree checkout (the core repo itself).
+MAIN_AUDIT="node_modules/@bongos/core/scripts/gds/main-audit.js"
+[ -f "$MAIN_AUDIT" ] || MAIN_AUDIT="scripts/gds/main-audit.js"
+if [ ! -f "$MAIN_AUDIT" ]; then
+  echo "X DEPLOY ABORTED: main-audit.js not found (looked in node_modules/@bongos/core and in-tree)."
+  echo "  A gate that cannot find its auditor must fail closed, not wave the deploy through."
+  exit 1
+fi
+
+if node "$MAIN_AUDIT" --verify-head --db ${STRICT}; then
+  echo "OK main audit clean${STRICT:+ (strict)} — proceeding with deploy."
+  exit 0
+fi
+
+echo ""
+echo "X DEPLOY ABORTED (SEC #863): a below-Metic${STRICT:+ or unresolved} author modified a"
+echo "  permission-sensitive path in this deploy. Investigate and revert before deploying:"
+echo "      node $MAIN_AUDIT --range \"\${OTB_AUDIT_RANGE:-HEAD~200..HEAD}\" --revert"
+
+if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ] && [ "${OTB_GATE_NO_RESTORE:-0}" != "1" ]; then
+  if git rev-parse --verify --quiet "${OTB_DEPLOY_PREV_SHA}^{commit}" >/dev/null; then
+    echo ""
+    echo "  restoring the checkout to ${OTB_DEPLOY_PREV_SHA} — the deployed marker advances only on success,"
+    echo "  so the NEXT deploy re-audits this same delta instead of treating it as already-reviewed."
+    git reset --hard "${OTB_DEPLOY_PREV_SHA}" >/dev/null
+  else
+    echo ""
+    echo "  ::WARNING:: cannot restore — ${OTB_DEPLOY_PREV_SHA} is not a commit in this checkout."
+    echo "  The tree is left at the REFUSED commit; the next deploy will not re-audit this delta."
+  fi
+fi
+
+exit 1

package/scripts/gds/main-audit.js

@@ -251,6 +251,13 @@ function rowsToMap(rows) {
   return map;
 }
 
+// Where getBuildersRoster lives. It was carved out of src/bongos/db.js into the
+// lifecycle module (goal 1000010's per-domain db.js split) and this file was not
+// updated with it, so `--db` threw `db.getBuildersRoster is not a function` on every
+// run — for however long that carve has been landed. Kept as a named constant so the
+// next carve breaks a test (tests/main_audit_db_roster.mjs) rather than a deploy gate.
+const ROSTER_DB_MODULE = '../../modules/lifecycle/db.js';
+
 // API mode (default): for an Archon session / operator laptop. DB mode (--db):
 // for the droplet deploy gate, which has DB access but no GDS session — it reads
 // the roster straight from Postgres. db.js is lazy-required so importing this
@@ -258,13 +265,24 @@ function rowsToMap(rows) {
 async function fetchRankMap({ useDb = false } = {}) {
   if (useDb) {
     try {
-      const db = require('../../src/bongos/db.js');
+      const db = require(ROSTER_DB_MODULE);
+      if (typeof db.getBuildersRoster !== 'function') {
+        // The exact failure this file already shipped once, named rather than caught as a
+        // generic TypeError: a moved export reads identically to "no database" otherwise.
+        throw new Error(`${ROSTER_DB_MODULE} exports no getBuildersRoster — it has moved again`);
+      }
       const roster = await db.getBuildersRoster({ staleHours: 24 });
-      return rowsToMap(roster.builders || roster);
+      const map = rowsToMap(roster.builders || roster);
+      if (Object.keys(map).length) return map;
+      console.error('main-audit: --db roster read returned NO builders — falling through to the API/public roster.');
     } catch (e) {
-      console.error(`main-audit: --db roster read failed (${e.message})`);
-      return {};
+      console.error(`main-audit: --db roster read failed (${e.message}) — falling through to the API/public roster.`);
     }
+    // FALL THROUGH, do not return {}. Returning an empty map here is the vacuous green
+    // this file's own comment warns about twelve lines down: with no ranks, every author
+    // resolves to null, no blocker can ever fire, and the gate reports success for the
+    // reason it was built to prevent. A `--db` gate that cannot reach Postgres is better
+    // served by the public leaderboard than by silence.
   }
   try {
     const api = await cliClient({ allowUnauthenticated: true });
@@ -394,4 +412,8 @@ if (require.main === module) {
 module.exports = {
   analyzeCommits, resolveRank, parseCommits, rowsToMap,
   clampWindow, defaultRange, firstParentDepth, DEFAULT_WINDOW,
+  // Exported so a test can assert the address is LIVE without a database. The --db
+  // path was dead for as long as the db.js carve has been landed precisely because
+  // nothing checked that this require target still exports what it is called for.
+  ROSTER_DB_MODULE, fetchRankMap,
 };

package/scripts/gds/run-unit-tests.js

@@ -213,12 +213,27 @@ const KNOWN_FAILING = new Set([
 // suites set exitCode rather than hard-exiting, so they do not hit this.
 const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
 
+// A suite that reports honest skips ends `N passed, 0 failed, M skipped` (task 1003993), so
+// the optional suffix is part of a clean verdict. Without it, the first suite to start telling
+// the truth about unrun coverage would have its clean verdict read as unrecognised and its
+// Windows teardown abort counted as a real failure — a fix for one honesty bug creating another.
+const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
+
+// `  SKIP <name>` from a suite's own stdout. Counted here rather than parsed out of the summary
+// line so a suite that prints skips without a summary suffix is still surfaced.
+const SKIP_LINE_RE = /^\s*SKIP\b/;
+
+function countSkips(stdout) {
+  if (!stdout) return 0;
+  return stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+}
+
 function isCleanTeardownAbort(stdout, stderr) {
   if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
   // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
   if (/^\s*FAIL\b/m.test(stdout)) return false;
   const lastLine = stdout.trim().split('\n').pop();
-  return /\b[1-9]\d* passed, 0 failed\s*$/.test(lastLine);
+  return CLEAN_VERDICT_RE.test(lastLine);
 }
 
 // The failing tests as ONE line, for the `unit-report` commit status the workflow
@@ -427,9 +442,13 @@ function main() {
 
   const failures = [];
   const teardownAborts = [];
+  // A GREEN suite that skipped cases is the shape this roll-up used to hide: the suite said so
+  // on its own stdout, which was discarded on success, so the only visible line was `ok` and a
+  // session reading the roll-up could not tell exercised coverage from absent coverage.
+  const skipped = [];
   const runOne = (displayName, filePath) => {
     try {
-      execFileSync(process.execPath, [filePath], {
+      const out = execFileSync(process.execPath, [filePath], {
         // task 1002644: stdout used to be IGNORED, so the failing assertion (test
         // files print their FAIL lines to stdout) was discarded and the only
         // context shown was the last 3 STDERR lines — often stale diagnostic
@@ -441,9 +460,16 @@ function main() {
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
-      console.log(`  ok    ${displayName}`);
+      const n = countSkips(out ? out.toString() : '');
+      if (n) skipped.push({ name: displayName, n });
+      console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run on this platform)` : ''}`);
     } catch (err) {
-      const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
+      // `exit null` on its own is unreadable, and it is what a HANG looks like here: the
+      // signal that ended the process is the whole diagnosis, so say it (task 1004052 —
+      // a test that hung for the full budget reported `exit null` and nothing else).
+      const why = err.killed
+        ? `TIMEOUT after ${perTestTimeout / 1000}s${err.signal ? `, ${err.signal}` : ''}`
+        : `exit ${err.status}${err.signal ? ` (${err.signal})` : ''}`;
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
       if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
         console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
@@ -453,6 +479,16 @@ function main() {
       console.log(`  FAIL  ${displayName} (${why})`);
       // The actual failures first: the file's own FAIL lines, then its stdout
       // tail (the last failure's assertion detail + summary), both bounded.
+      // EMPTY STDOUT IS ITSELF THE CLUE, and it used to print as a blank gap. node:test
+      // buffers a file's whole report until the file finishes, so a suite that hangs
+      // mid-run emits NOTHING — which reads as "no detail available" when it actually
+      // means "it never got to the end". Name that, and name how to find the case.
+      if (!stdoutText) {
+        console.log('        (no output at all — node:test buffers a file\'s report until it finishes,');
+        console.log('         so this suite did not reach the end. To find which case: run it on the same');
+        console.log('         platform with each case writing its name to STDERR before it runs; stderr is');
+        console.log('         unbuffered, so the last name with no completion is the one that hung.)');
+      }
       const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
       for (const l of failLines) console.log(`      ${l.trim()}`);
       if (stdoutText) {
@@ -492,6 +528,11 @@ function main() {
   if (teardownAborts.length) {
     console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
   }
+  if (skipped.length) {
+    const n = skipped.reduce((sum, s) => sum + s.n, 0);
+    console.log(`${label}: ${n} case(s) NOT RUN on this platform — ${skipped.map((s) => `${s.name} (${s.n})`).join(', ')}`);
+    console.log(`${label}: a skipped case is not a passing one. Green here does not mean that coverage was exercised.`);
+  }
   reportToWorkflow(failures);
   if (failures.length === 0) {
     console.log(`${label}: all ${total} passed.`);
@@ -503,4 +544,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests, isCleanTeardownAbort, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };
+module.exports = { discoverModuleTests, isCleanTeardownAbort, countSkips, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.875'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.877'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');