@bongos/core 1.19.876 → 1.19.877

package/tests/autonomy_runner_health.mjs

@@ -0,0 +1,135 @@
+// tests/autonomy_runner_health.mjs — a dead runner is visible, not silent (task 1003905).
+//
+// The done-when's second half: "a runner that has stopped heartbeating is visible
+// from the hall." The asymmetry is the whole design — a running machine can say
+// so, a dead one cannot say anything — so the signal is the AGE of the last
+// check-in, never a status the runner writes. These pin the four answers and, more
+// importantly, the three DIFFERENT kinds of quiet.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { describeRunner, humanAge, ageS, ALIVE_S, LATE_S } = require('../modules/autonomy/runner-health.js');
+
+const NOW = Date.parse('2026-09-19T12:00:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const hb = (over = {}) => ({ host: 'winbox', pid: 4242, mode: 'full', last_seen_at: agoS(30), ...over });
+
+test('no row at all is NEVER SEEN, and that is not a failure', () => {
+  // Telling an owner their runner "died" before it ever ran is how a status light
+  // trains people to ignore it.
+  for (const none of [null, undefined, 'nope', 42]) {
+    const d = describeRunner(none, { nowMs: NOW });
+    assert.equal(d.state, 'never_seen', String(none));
+    assert.equal(d.ok, true, 'never set up is not broken');
+    assert.match(d.detail, /has ever checked in/);
+  }
+});
+
+test('the four states follow the age of the last check-in, nothing else', () => {
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(10) }), { nowMs: NOW }).state, 'alive');
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(ALIVE_S - 1) }), { nowMs: NOW }).state, 'alive');
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(ALIVE_S + 1) }), { nowMs: NOW }).state, 'late');
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(LATE_S - 1) }), { nowMs: NOW }).state, 'late');
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(LATE_S + 1) }), { nowMs: NOW }).state, 'dead');
+  assert.equal(describeRunner(hb({ last_seen_at: agoS(86400) }), { nowMs: NOW }).state, 'dead');
+});
+
+test('a runner mid-worker goes quiet legitimately, and LATE says so rather than crying dead', () => {
+  // A worker may hold the loop for ninety minutes. Reporting every honest hour of
+  // work as a corpse is worse than saying nothing, because it teaches the owner to
+  // ignore the one that matters.
+  const building = describeRunner(hb({ last_seen_at: agoS(70 * 60), working_task_id: '1003905' }), { nowMs: NOW });
+  assert.equal(building.state, 'late');
+  assert.equal(building.ok, true, 'late is not an alarm');
+  assert.match(building.detail, /expected while task 1003905 builds/);
+  assert.equal(building.workingTaskId, '1003905');
+});
+
+test('a gap longer than any worker takes IS the alarm', () => {
+  const d = describeRunner(hb({ last_seen_at: agoS(5 * 3600), working_task_id: '1003905' }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+  assert.equal(d.ok, false);
+  assert.match(d.detail, /longer than any worker takes/);
+  assert.match(d.detail, /winbox/, 'name the host — an owner with two machines needs to know which');
+});
+
+test('an unreadable check-in raises the alarm rather than explaining it away', () => {
+  // A row that exists but cannot be read is a runner we heard from once and cannot
+  // account for now. On a liveness check the fail direction is to raise the alarm.
+  for (const bad of ['', 'not a date', null, undefined]) {
+    const d = describeRunner(hb({ last_seen_at: bad }), { nowMs: NOW });
+    assert.equal(d.state, 'dead', JSON.stringify(bad));
+    assert.equal(d.ok, false);
+  }
+  // And it is NOT never_seen — the row exists, so something ran once.
+  assert.notEqual(describeRunner(hb({ last_seen_at: 'x' }), { nowMs: NOW }).state, 'never_seen');
+});
+
+test('a probing runner reads as alive, because probing is working', () => {
+  const d = describeRunner(hb({ mode: 'probing', last_seen_at: agoS(20) }), { nowMs: NOW });
+  assert.equal(d.state, 'alive');
+  assert.equal(d.mode, 'probing');
+  assert.match(d.detail, /probing after failures/);
+});
+
+test('a clock skew into the future never reads as ancient', () => {
+  const d = describeRunner(hb({ last_seen_at: new Date(NOW + 60_000).toISOString() }), { nowMs: NOW });
+  assert.equal(d.ageS, 0);
+  assert.equal(d.state, 'alive');
+});
+
+test('every answer carries a readable age and a sentence', () => {
+  for (const s of [0, 30, 300, ALIVE_S + 60, LATE_S + 60, 86400 * 3]) {
+    const d = describeRunner(hb({ last_seen_at: agoS(s) }), { nowMs: NOW });
+    assert.ok(typeof d.detail === 'string' && d.detail.length, `${s}s needs a sentence`);
+    assert.ok(typeof d.age === 'string' && d.age.length, `${s}s needs a readable age`);
+    assert.equal(d.ageS, s);
+  }
+});
+
+test('humanAge reads like a person wrote it', () => {
+  assert.equal(humanAge(45), '45s');
+  assert.equal(humanAge(300), '5m');
+  assert.equal(humanAge(7200), '2h');
+  assert.equal(humanAge(86400 * 3), '3d');
+  assert.equal(humanAge(NaN), 'unknown');
+});
+
+test('ageS refuses to invent a number it cannot compute', () => {
+  assert.equal(ageS('nope', NOW), null);
+  assert.equal(ageS(agoS(10), NaN), null);
+  assert.equal(ageS(agoS(10), NOW), 10);
+});
+
+// ── the forgery the grader found (task 1003905) ─────────────────────────────────
+
+test('a heartbeat row is keyed by the CALLER, so liveness cannot be forged', async () => {
+  // THE ATTACK: with `host` alone as the primary key, any authenticated builder
+  // could POST a heartbeat naming the real runner's hostname and keep the signal
+  // reading "alive" forever — defeating the one property this table exists for,
+  // that a dead machine holding broad spawn permissions becomes visible.
+  //
+  // An ownership check in the handler would also close it, and would be one `if`
+  // away from removal by a later edit that looked reasonable. The caller is in the
+  // KEY instead, so the forgery is impossible rather than merely checked for.
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const sql = fs.readFileSync(path.join(process.cwd(), 'modules/autonomy/migrations/autonomy_002_runner_heartbeat.sql'), 'utf8');
+  assert.match(sql, /PRIMARY KEY \(builder_id, host\)/, 'the caller must be half the key');
+  assert.doesNotMatch(sql, /host\s+text PRIMARY KEY/, 'host alone as the key is the forgeable shape');
+
+  const db = fs.readFileSync(path.join(process.cwd(), 'modules/autonomy/db.js'), 'utf8');
+  assert.match(db, /ON CONFLICT \(builder_id, host\)/, 'the upsert must collide per builder, not per host');
+  assert.match(db, /readRunnerHeartbeats\(builderId\)/, 'the read is scoped to one builder');
+  assert.match(db, /WHERE builder_id = \$1/);
+
+  const routes = fs.readFileSync(path.join(process.cwd(), 'modules/autonomy/routes/autonomy.js'), 'utf8');
+  // The identity must come from the SESSION. A `host` from the body is fine; a
+  // builder id from the body would hand the attacker the key back.
+  assert.match(routes, /builderId: req\.builder\.id/);
+  assert.doesNotMatch(routes, /builderId: (b|req\.body)\./, 'never take the caller’s identity from the body');
+  assert.match(routes, /readRunnerHeartbeats\(req\.builder\.id\)/);
+});

package/tests/bump_version.mjs

@@ -16,9 +16,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
+import { shallowCloneReason } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
 const bump = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
 const { bumpPatch, CONST_RE } = bump;
 // The LIVE test below reads this repo's real release history (task 1003202).
@@ -347,11 +349,20 @@ test('a hand-bumped branch passes the LIVE check its own PR runs', () => {
   assert.equal(bump.laneReleasedVersions(subjects).has('1.20.0'), true);
 });
 
-test('LIVE: the version HEAD declares is one this lane already released', () => {
+test('LIVE: the version HEAD declares is one this lane already released', (t) => {
   // The steady state the lane depends on: HEAD carries the version set by the
   // previous release commit, so `taken` is true and the auto-bump fires. If this
   // ever reads false on a normal main checkout, the lane would try to republish
   // an existing version.
+  //
+  // This reads the whole release history, so it cannot run on a shallow clone — a
+  // cloud session sees ~46 release commits instead of hundreds and the assertion
+  // below fails on the clone, not on the code (task 1004049). Skip with the reason
+  // printed, never a silent return: an unrunnable case that reports as a pass is the
+  // defect task 1003993 is open on.
+  const shallow = shallowCloneReason(ROOT);
+  if (shallow) { t.skip(shallow); return; }
+
   const headVersion = /^const CORE_VERSION = '([0-9.]+)';/m
     .exec(fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8'))[1];
   const subjects = execFileSync('git', ['log', '--format=%s', 'HEAD'], { encoding: 'utf8', cwd: ROOT }).split('\n');

package/tests/cli_package.mjs

@@ -19,6 +19,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { childEnv } from './helpers.mjs';
 
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -34,8 +35,17 @@ const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 // rather than inlined twice: this is the third site in the repo to need it (after
 // tests/cli_sessions.mjs in task 1003760 and tests/cli_surface.mjs in task 1003941),
 // and every one of them got it half-right first.
+//
+// AND AN INHERITED API BASE IS NOT ISOLATION EITHER (task 1004049). The same
+// shape of hole, one env var over: resolveApiBase() reads the CANONICAL
+// <PREFIX>_API_BASE before any legacy spelling, so the `CLOUDBONGOS_API_BASE:
+// 'http://127.0.0.1:45999'` the verbs below rely on to be a DEAD port is silently
+// shadowed on any box that exports the canonical one — every Bongos session box.
+// The verbs then made real calls to the live instance instead of failing fast
+// against a closed port, which is why this test ran for minutes and timed out
+// rather than failing with something readable. childEnv strips every spelling.
 function homelessEnv(home, extra = {}) {
-  return { ...process.env, HOME: home, USERPROFILE: home, HOMEDRIVE: '', HOMEPATH: home, ...extra };
+  return childEnv({ HOME: home, USERPROFILE: home, HOMEDRIVE: '', HOMEPATH: home, ...extra });
 }
 const BUILDER = path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js');
 // Running npm from a test (task 1003529). On Windows `npm` is a .cmd shim: bare

package/tests/deploy_audit_gate.mjs

@@ -0,0 +1,154 @@
+// tests/deploy_audit_gate.mjs
+//
+// The deployed marker advances ONLY on success (task 1001426, SEC #863 / ADR 0043).
+//
+// The gate audits what a deploy pulled, so it can only run AFTER the working tree has moved
+// to the new commit. That ordering is what the original row calls the marker-bypass: refuse
+// the deploy, exit, and leave the tree sitting on the refused commit, and the NEXT deploy
+// computes its "previously deployed" SHA from the poison. That delta is then never audited
+// again — and it is already checked out. The gate closes it by putting the tree back.
+//
+// There is no marker FILE on a standalone instance; the marker is the checked-out HEAD.
+// These cases pin that, against a stub auditor so the assertions are about the gate's own
+// control flow and never about rank resolution (covered in tests/main_audit_db_roster.mjs).
+//
+// Run:  node --test tests/deploy_audit_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GATE = path.join(ROOT, 'scripts', 'gds', 'deploy-main-audit-gate.sh');
+
+// A throwaway repo with two commits, checked out at the second — the state a deploy is in
+// when the gate runs: PREV is what was deployed, HEAD is what was just pulled.
+function makeRepo({ auditor = 'exit 0' } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-gate-'));
+  const git = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8' });
+  git('init', '-q', '-b', 'main');
+  git('config', 'user.email', 'test@example.com');
+  git('config', 'user.name', 'Test');
+  fs.writeFileSync(path.join(dir, 'a.txt'), 'one\n');
+  git('add', '-A'); git('commit', '-q', '-m', 'one');
+  const prev = git('rev-parse', 'HEAD').trim();
+  fs.writeFileSync(path.join(dir, 'a.txt'), 'two\n');
+  git('add', '-A'); git('commit', '-q', '-m', 'two (the pulled commit)');
+  const head = git('rev-parse', 'HEAD').trim();
+
+  if (auditor !== null) {
+    const gdsDir = path.join(dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'), `process.${auditor.replace('exit ', 'exit(')});\n`);
+  }
+  return { dir, prev, head, git };
+}
+
+function runGate(repo, env = {}) {
+  const r = spawnSync('sh', [GATE], {
+    cwd: repo.dir, encoding: 'utf8',
+    env: { ...process.env, ...env },
+  });
+  return { code: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
+}
+
+const headOf = (repo) => repo.git('rev-parse', 'HEAD').trim();
+
+test('a CLEAN audit leaves the deploy on the new commit and exits 0', () => {
+  const repo = makeRepo({ auditor: 'exit 0' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 0, r.out);
+    assert.equal(headOf(repo), repo.head, 'a passing gate must not move the tree');
+    assert.match(r.out, /exact deploy delta/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('THE BUG: a REFUSED audit puts the checkout back, so the next deploy re-audits the same delta', () => {
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 1, 'a refusal must abort the deploy');
+    assert.equal(
+      headOf(repo), repo.prev,
+      'the tree must be restored to the previously-deployed SHA. Left advanced, the next '
+      + "deploy's OTB_DEPLOY_PREV_SHA is the POISONED commit and its delta is never re-audited",
+    );
+    assert.match(r.out, /DEPLOY ABORTED/);
+    assert.match(r.out, /advances only on success/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('the range handed to the auditor is the exact deploy delta, not a window', () => {
+  // Pinned because the whole row is named for an audit range that could be slipped under.
+  const repo = makeRepo({ auditor: null });
+  try {
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
+      'require("fs").writeFileSync("range.txt", process.env.OTB_AUDIT_RANGE || "UNSET");\n');
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 0, r.out);
+    assert.equal(
+      fs.readFileSync(path.join(repo.dir, 'range.txt'), 'utf8'), `${repo.prev}..HEAD`,
+      'the auditor must receive <previously-deployed>..HEAD',
+    );
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('with no previous SHA there is nothing to restore to, and the gate says so', () => {
+  // The degraded mode: still audits (wide window), still refuses, but cannot undo the move.
+  // It must not pretend otherwise — a silent non-restore is the bug wearing a disguise.
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, {});
+    assert.equal(r.code, 1);
+    assert.equal(headOf(repo), repo.head, 'nothing to restore to');
+    assert.match(r.out, /OTB_DEPLOY_PREV_SHA not set/);
+    assert.match(r.out, /cannot put the tree back/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('OTB_GATE_NO_RESTORE=1 leaves the tree to a caller that restores it itself', () => {
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev, OTB_GATE_NO_RESTORE: '1' });
+    assert.equal(r.code, 1);
+    assert.equal(headOf(repo), repo.head, 'the opt-out must actually opt out');
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('a missing auditor FAILS CLOSED — it never waves the deploy through', () => {
+  // The failure mode that would quietly disarm every instance: upgrade the core, lose the
+  // script, and a gate that treated "not found" as "nothing to report" would pass forever.
+  const repo = makeRepo({ auditor: null });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 1, 'no auditor must abort the deploy, not permit it');
+    assert.match(r.out, /main-audit\.js not found/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('OTB_AUDIT_STRICT=1 is passed through, and is OFF by default', () => {
+  const repo = makeRepo({ auditor: null });
+  try {
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
+      'require("fs").writeFileSync("argv.txt", process.argv.slice(2).join(" "));\n');
+
+    runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(
+      fs.readFileSync(path.join(repo.dir, 'argv.txt'), 'utf8').includes('--strict'), false,
+      'strict must default OFF: a lane committing under display names resolves to nothing, '
+      + 'so strict would block every deploy forever',
+    );
+
+    runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev, OTB_AUDIT_STRICT: '1' });
+    assert.match(fs.readFileSync(path.join(repo.dir, 'argv.txt'), 'utf8'), /--strict/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});

package/tests/deploy_divergence_line.mjs

@@ -23,11 +23,13 @@ import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { childEnv, API_BASE_ENV_PREFIXES } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const { line } = require('../scripts/gds/deploy-divergence.js');
+const ic = require('../src/instance-config.js');
 const SCRIPT = path.join(ROOT, 'scripts/gds/deploy-divergence.js');
 
 // Run `--line` exactly as SessionStart does. Returns {status, stdout} instead of
@@ -36,7 +38,7 @@ function runLine(env = {}) {
   const res = spawnSync(
     process.execPath,
     [SCRIPT, '--line', '--timeout-ms', '2500'],
-    { cwd: ROOT, encoding: 'utf8', timeout: 30000, env: { ...process.env, ...env } },
+    { cwd: ROOT, encoding: 'utf8', timeout: 30000, env: childEnv(env) },
   );
   return { status: res.status, stdout: String(res.stdout || '').trim(), stderr: String(res.stderr || '') };
 }
@@ -101,6 +103,50 @@ test('--line exits 0 and stays silent when the instance is unreachable', () => {
   assert.equal(r.stdout, '', 'an unreachable instance must print NOTHING to stdout');
 });
 
+test('childEnv strips EVERY spelling of the api base, so an offline stub cannot be shadowed', () => {
+  // THE BUG THIS PINS (task 1004049). The case above sets only LEGACY spellings.
+  // resolveApiBase() reads the canonical `<PREFIX>_API_BASE` FIRST, so on any box
+  // that exports it — every Bongos session box — the legacy stub was silently
+  // shadowed and `--line` went and read the LIVE instance. The assertion then
+  // compared production's real divergence banner against '' and failed. It passed in
+  // CI, where the canonical var is unset, which is why it survived: the test was only
+  // ever in control on the one machine nobody was debugging on.
+  //
+  // This is asserted against childEnv directly rather than by spawning --line at a
+  // real host, and the reason is the subject of this very task: an end-to-end version
+  // would pass or fail according to whether production happened to be mid-release at
+  // the time, which is another ambient dependency. The mechanism is what must hold,
+  // so the mechanism is what is pinned.
+  // The stub prefix is TAKEN FROM the imported list rather than typed, for the same
+  // single-source reason childEnv imports it — and because the repo's rename ratchet
+  // (goal 1000073 C5) counts a typed legacy prefix as a new literal.
+  const STUB = ic.LEGACY_ENV_PREFIXES.at(-1);
+  const STUB_VAR = `${STUB}_API_BASE`;
+  const DEAD = 'http://127.0.0.1:9';
+
+  // Every OTHER spelling points at a host that would answer — the shape of a real
+  // session box — so a survivor is the difference between offline and not.
+  const box = { PATH: process.env.PATH };
+  for (const prefix of API_BASE_ENV_PREFIXES) box[`${prefix}_API_BASE`] = 'https://example.invalid';
+
+  const out = childEnv({ [STUB_VAR]: DEAD }, { base: box });
+
+  for (const prefix of API_BASE_ENV_PREFIXES.filter((p) => p !== STUB)) {
+    assert.equal(out[`${prefix}_API_BASE`], undefined,
+      `${prefix}_API_BASE survived — it would shadow the stub the test set`);
+  }
+  assert.equal(out[STUB_VAR], DEAD, 'the override the test set must survive');
+  assert.equal(out.PATH, process.env.PATH, 'unrelated environment must be passed through untouched');
+
+  // The list is derived from instance-config, not copied here: a prefix added or
+  // sunset there must not need an edit in the test suite to keep working.
+  assert.ok(API_BASE_ENV_PREFIXES.includes(ic.envPrefix() || ic.FALLBACK_ENV_PREFIX),
+    'the canonical prefix must be among those stripped');
+  for (const legacy of ic.LEGACY_ENV_PREFIXES) {
+    assert.ok(API_BASE_ENV_PREFIXES.includes(legacy), `legacy prefix ${legacy} must be stripped too`);
+  }
+});
+
 test('--line exits 0 against the REAL instance (the 127 regression)', { timeout: 60000 }, () => {
   // The success path is the one that broke: a live socket to tear down is exactly
   // what process.exit() raced. Skips only if the network is unavailable, so it

package/tests/helpers.mjs

@@ -70,6 +70,8 @@ export function makeSqlAwareClient(handler) {
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -434,3 +436,62 @@ export function sqlColumnLines(sql) {
     // whose NAME contained a scanned word would otherwise read as a column.
     .filter((l) => l && !/^(CREATE TABLE|CONSTRAINT|CHECK|\))/.test(l));
 }
+
+// childEnv — build the environment for a spawned child so the API base the test
+// SETS is the API base the child USES (task 1004049).
+//
+// The trap this closes: `src/instance-config.js resolveApiBase()` reads the
+// CANONICAL `<PREFIX>_API_BASE` first and only then the legacy spellings. A test
+// that passes `{ ...process.env, <LEGACY>_API_BASE: stub }` is therefore only in
+// control on a box where the canonical var is UNSET. On a box where it is set —
+// which is every Bongos session box, the tooling exports it — the canonical value
+// wins, the test's stub is silently shadowed, and the child talks to the REAL
+// instance.
+//
+// That is not hypothetical. It is how tests/deploy_divergence_line.mjs came to
+// assert "stays silent when the instance is unreachable" while printing a live
+// reading of the production host; how tests/setup_device_flow_fallback.mjs came to
+// verify a token against the real /me instead of its local stub; and why
+// tests/cli_package.mjs ran every verb against production and timed out after
+// minutes instead of failing fast against a closed port (3.7s once fixed). All
+// three passed in CI, where the canonical var is unset, and failed everywhere else.
+//
+// The prefix list is IMPORTED, never copied: instance-config.js is the single
+// source that decides which spellings resolve, so a prefix added or sunset there
+// must not need a matching edit here — a stale copy would reintroduce exactly the
+// silent-shadowing bug this helper exists to prevent.
+const helperRequire = createRequire(import.meta.url);
+const ic = helperRequire(path.join(ROOT, 'src', 'instance-config.js'));
+export const API_BASE_ENV_PREFIXES = [ic.envPrefix(), ic.FALLBACK_ENV_PREFIX, ...ic.LEGACY_ENV_PREFIXES]
+  .filter(Boolean)
+  .filter((p, i, a) => a.indexOf(p) === i);
+
+export function childEnv(overrides = {}, { base = process.env } = {}) {
+  const env = { ...base };
+  for (const prefix of API_BASE_ENV_PREFIXES) delete env[`${prefix}_API_BASE`];
+  return { ...env, ...overrides };
+}
+
+// shallowCloneReason — why a history-reading test cannot run HERE, or null (task 1004049).
+//
+// A cloud session clones shallow, so a test that counts release commits or walks a
+// date window sees a truncated log and asserts against a number that was never going
+// to be right. That is not a defect in the code under test and must not read as one.
+//
+// It must not read as a PASS either. Task 1003993 (same goal) is open precisely
+// because sanitize_rebuild.mjs counted two SKIPPED cases as passed and reported
+// 760/760 while its only real coverage never ran. So the contract here is: return a
+// REASON, and let the caller hand it to node:test's t.skip(), which reports the case
+// under `# skipped` where a reader can see it — never a silent early return.
+export function shallowCloneReason(root = ROOT) {
+  let shallow = false;
+  try {
+    shallow = execFileSync('git', ['rev-parse', '--is-shallow-repository'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .trim() === 'true';
+  } catch {
+    return null; // not a git checkout at all: let the test fail honestly rather than skip
+  }
+  if (!shallow) return null;
+  return 'shallow clone — full history is unavailable here, so this case cannot be evaluated '
+    + '(git fetch --unshallow to run it)';
+}

package/tests/main_audit_db_roster.mjs

@@ -0,0 +1,97 @@
+// tests/main_audit_db_roster.mjs
+//
+// main-audit.js `--db` must be able to REACH the roster (task 1001426).
+//
+// `--db` is the mode the deploy gate uses: the droplet has Postgres but no Bongos session,
+// so it resolves builder ranks straight from the database. It called
+// `require('../../src/bongos/db.js').getBuildersRoster(...)`. That function was carved out
+// of the core db.js into the lifecycle module (goal 1000010's per-domain split) and this
+// caller was not moved with it, so every `--db` run died with
+//
+//     main-audit: --db roster read failed (db.getBuildersRoster is not a function)
+//
+// and returned an EMPTY rank map. An empty map is not a neutral outcome for this tool: every
+// author then resolves to null, no blocker can fire, and the audit reports success — the
+// vacuous green this file's own comments warn about for the API path. Non-strict said
+// "clean" for the one reason it exists to catch; strict said BLOCKER on every commit.
+//
+// Two assertions, because the bug needed both to happen: the address must be live, and a
+// failure to read it must not be laundered into an empty map.
+//
+// Run:  node --test tests/main_audit_db_roster.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const audit = require('../scripts/gds/main-audit.js');
+
+test('the --db roster address is LIVE: that module really exports getBuildersRoster', () => {
+  // Resolved from main-audit.js's OWN directory, exactly as the lazy require() inside it
+  // does — so this fails for the same reason the gate would, and never for a different one.
+  const auditDir = path.dirname(require.resolve('../scripts/gds/main-audit.js'));
+  const mod = require(path.resolve(auditDir, audit.ROSTER_DB_MODULE));
+  assert.equal(
+    typeof mod.getBuildersRoster, 'function',
+    `${audit.ROSTER_DB_MODULE} must export getBuildersRoster — main-audit.js --db calls it, `
+    + 'and a moved export reads exactly like "no database" at the deploy gate',
+  );
+});
+
+test('the OLD address is genuinely dead — this is not a cosmetic rename', () => {
+  // Kept so the next reader can see the carve actually happened, rather than wondering
+  // whether the require was simply a typo that never worked.
+  const coreDb = require('../src/bongos/db.js');
+  assert.equal(
+    typeof coreDb.getBuildersRoster, 'undefined',
+    'src/bongos/db.js no longer owns the roster; if it does again, collapse the two paths '
+    + 'rather than leaving main-audit.js pointing at whichever one happens to answer',
+  );
+});
+
+test('rowsToMap keys ONLY on github_login — a display name must never resolve a rank', () => {
+  // #863-followup finding #6. display_name is builder-controlled, so keying it let one
+  // builder alias another login's rank. This is also WHY a deploy lane's own commits stay
+  // unresolved on a standalone instance: they are authored under a human display name,
+  // not a github_login.
+  const map = audit.rowsToMap([
+    { github_login: 'somebuilder', display_name: 'Someone Else', rank: 'xenos' },
+    { display_name: 'Firstname Lastname', rank: 'archon' },
+  ]);
+  assert.equal(map.somebuilder, 'xenos');
+  assert.equal(map['firstname lastname'], undefined, 'a display name must not carry a rank');
+  assert.equal(Object.keys(map).length, 1);
+});
+
+test('an unreadable --db roster does NOT resolve to an empty map in silence', async () => {
+  // The vacuous green, asserted directly. fetchRankMap({useDb:true}) is forced to fail by
+  // pointing it at a database that cannot exist, and must then FALL THROUGH to the
+  // API/public roster rather than returning {}. Offline (no network in the unit lane) the
+  // fallbacks also fail and the map is legitimately empty — so what is pinned here is that
+  // the failure was ANNOUNCED on stderr, which is what a gate operator needs in order to
+  // know the audit did not actually run.
+  const errs = [];
+  const realError = console.error;
+  console.error = (...a) => errs.push(a.join(' '));
+  const realPg = process.env.PGDATABASE;
+  process.env.PGDATABASE = 'cloudbongos_no_such_db_for_tests';
+  try {
+    const map = await audit.fetchRankMap({ useDb: true });
+    assert.equal(typeof map, 'object', 'still returns a map rather than throwing at the gate');
+  } finally {
+    console.error = realError;
+    if (realPg === undefined) delete process.env.PGDATABASE; else process.env.PGDATABASE = realPg;
+  }
+  const said = errs.join('\n');
+  assert.match(
+    said, /--db roster read (failed|returned NO builders)/,
+    'a --db roster that cannot be read must say so on stderr; silence here is what made '
+    + 'the dead require survive — the gate exits 0 and looks like a pass',
+  );
+  assert.match(
+    said, /falling through/,
+    'and it must say it is falling through, so nobody reads the empty map as "roster is empty"',
+  );
+});

package/tests/publish_watch.mjs

@@ -10,9 +10,11 @@ import assert from 'node:assert/strict';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { shallowCloneReason } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(import.meta.dirname, '..');
+
 const pw = require(path.join(ROOT, 'scripts', 'gds', 'publish-watch.js'));
 
 const REL = (v, iso, sha = 'abcdef1234567890') =>
@@ -80,6 +82,13 @@ test('a read that returned nothing must not read as "nothing missing"', () => {
 });
 
 test('LIVE: replays the real 2026-09-13 publish outage from git + the registry', (t) => {
+  // Needs real history: a shallow clone's origin/main does not reach back to the
+  // incident window, so the log below comes back empty and the count reads 0 (task
+  // 1004049). Skipped with the reason stated, for the same reason the unreachable
+  // registry below is skipped rather than failed — and never as a silent pass.
+  const shallow = shallowCloneReason(ROOT);
+  if (shallow) { t.skip(shallow); return; }
+
   // The eight carrier commits exist on main...
   // Bounded: this runs on every ordinary suite run, so it reads a window around
   // the incident rather than the whole history.

package/tests/setup_device_flow_fallback.mjs

@@ -25,6 +25,7 @@
 // Run:  node tests/setup_device_flow_fallback.mjs
 
 import { strict as assert } from 'node:assert';
+import { childEnv } from './helpers.mjs';
 import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
 import http from 'node:http';
@@ -144,7 +145,7 @@ fs.writeFileSync(driverPath, [
 function redeemInChild(token, home) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, [driverPath, token], {
-      env: { ...process.env, HOME: home, USERPROFILE: home, GDS_API_BASE: BASE, OTB_API_BASE: BASE },
+      env: childEnv({ HOME: home, USERPROFILE: home, GDS_API_BASE: BASE, OTB_API_BASE: BASE }),
     });
     let stdout = '', stderr = '';
     child.stdout.on('data', (c) => { stdout += c; });