@bongos/core 1.19.876 → 1.19.878

package/scripts/gds/deploy-main-audit-gate.sh

@@ -0,0 +1,90 @@
+#!/bin/sh
+# scripts/gds/deploy-main-audit-gate.sh — the SEC #863 / ADR 0043 deploy-side gate.
+#
+# Refuses a deploy when a builder BELOW Metic modified a permission-sensitive path in the
+# delta this deploy introduces. Run from the instance checkout root, AFTER the working tree
+# has been moved to the new commit and BEFORE anything is migrated or restarted.
+#
+#   OTB_DEPLOY_PREV_SHA="$(git rev-parse HEAD)"; export OTB_DEPLOY_PREV_SHA   # BEFORE the pull
+#   git reset --hard origin/main
+#   sh node_modules/@bongos/core/scripts/gds/deploy-main-audit-gate.sh || exit 1
+#   ...migrate, restart...
+#
+# WHY THIS LIVES IN THE CORE (task 1001426). It used to live in the control-plane repo's
+# infra/, where a standalone instance checkout cannot reach it — and on cloudbongos.com it
+# was never wired into ~/deploy.sh at all, so the "poison never reaches prod" check had
+# never once run. Shipping it beside main-audit.js means every instance inherits the gate
+# with its pinned core, and there is no per-instance copy to drift.
+#
+# THE MARKER IS THE CHECKED-OUT HEAD, AND IT ADVANCES ONLY ON SUCCESS.
+# That is the substance of this task and the reason the restore below is in the GATE rather
+# than in each caller's deploy script. The gate can only audit what was pulled, so it runs
+# after the tree has already moved. Exiting non-zero and leaving it moved would mean the
+# next deploy computes OTB_DEPLOY_PREV_SHA from the POISONED commit, never re-audits that
+# delta, and finds the poison already checked out — the marker-bypass this gate exists to
+# close, reintroduced one layer up. So a refusal puts the tree back where it started.
+# Set OTB_GATE_NO_RESTORE=1 only when the caller restores it itself.
+#
+# STRICT IS OFF BY DEFAULT, AND THAT IS NOT LAZINESS. Rank resolution keys on github_login
+# only (#863-followup finding #6: display_name is builder-controlled, so keying it let one
+# builder alias another's rank). A deploy lane whose commits are authored under a human
+# display name ("Firstname Lastname") rather than the builder's github_login therefore
+# resolves to nothing, and OTB_AUDIT_STRICT=1 would block every deploy forever.
+# Non-strict still hard-blocks the incident class this was built for: a RESOLVED below-Metic
+# author touching a protected path. Turn strict on once the lane commits under logins.
+#
+# KNOWN LIMIT, stated because a gate nobody distrusts is worse than no gate: if the roster
+# cannot be read at all, every author is unresolved and non-strict passes. main-audit.js
+# announces that loudly on stderr (task 1001426 gave it a fallback and a voice — it used to
+# fail silently and return an empty map, so the gate reported a clean audit that never ran).
+# Availability is chosen over a hard stop deliberately: a database blip must not freeze
+# deploys. Read the stderr.
+
+set -eu
+
+if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ]; then
+  OTB_AUDIT_RANGE="${OTB_DEPLOY_PREV_SHA}..HEAD"; export OTB_AUDIT_RANGE
+  echo "main audit: range ${OTB_AUDIT_RANGE} (exact deploy delta)"
+else
+  echo "main audit: OTB_DEPLOY_PREV_SHA not set — falling back to the wide window."
+  echo "  (Recommended: capture OTB_DEPLOY_PREV_SHA=\$(git rev-parse HEAD) BEFORE the pull;"
+  echo "   without it a poisoned commit buried under the window can escape, and a refusal"
+  echo "   cannot put the tree back.)"
+fi
+
+STRICT=""
+[ "${OTB_AUDIT_STRICT:-0}" = "1" ] && STRICT="--strict"
+
+# Prefer the installed core; fall back to an in-tree checkout (the core repo itself).
+MAIN_AUDIT="node_modules/@bongos/core/scripts/gds/main-audit.js"
+[ -f "$MAIN_AUDIT" ] || MAIN_AUDIT="scripts/gds/main-audit.js"
+if [ ! -f "$MAIN_AUDIT" ]; then
+  echo "X DEPLOY ABORTED: main-audit.js not found (looked in node_modules/@bongos/core and in-tree)."
+  echo "  A gate that cannot find its auditor must fail closed, not wave the deploy through."
+  exit 1
+fi
+
+if node "$MAIN_AUDIT" --verify-head --db ${STRICT}; then
+  echo "OK main audit clean${STRICT:+ (strict)} — proceeding with deploy."
+  exit 0
+fi
+
+echo ""
+echo "X DEPLOY ABORTED (SEC #863): a below-Metic${STRICT:+ or unresolved} author modified a"
+echo "  permission-sensitive path in this deploy. Investigate and revert before deploying:"
+echo "      node $MAIN_AUDIT --range \"\${OTB_AUDIT_RANGE:-HEAD~200..HEAD}\" --revert"
+
+if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ] && [ "${OTB_GATE_NO_RESTORE:-0}" != "1" ]; then
+  if git rev-parse --verify --quiet "${OTB_DEPLOY_PREV_SHA}^{commit}" >/dev/null; then
+    echo ""
+    echo "  restoring the checkout to ${OTB_DEPLOY_PREV_SHA} — the deployed marker advances only on success,"
+    echo "  so the NEXT deploy re-audits this same delta instead of treating it as already-reviewed."
+    git reset --hard "${OTB_DEPLOY_PREV_SHA}" >/dev/null
+  else
+    echo ""
+    echo "  ::WARNING:: cannot restore — ${OTB_DEPLOY_PREV_SHA} is not a commit in this checkout."
+    echo "  The tree is left at the REFUSED commit; the next deploy will not re-audit this delta."
+  fi
+fi
+
+exit 1

package/scripts/gds/main-audit.js

@@ -251,6 +251,13 @@ function rowsToMap(rows) {
   return map;
 }
 
+// Where getBuildersRoster lives. It was carved out of src/bongos/db.js into the
+// lifecycle module (goal 1000010's per-domain db.js split) and this file was not
+// updated with it, so `--db` threw `db.getBuildersRoster is not a function` on every
+// run — for however long that carve has been landed. Kept as a named constant so the
+// next carve breaks a test (tests/main_audit_db_roster.mjs) rather than a deploy gate.
+const ROSTER_DB_MODULE = '../../modules/lifecycle/db.js';
+
 // API mode (default): for an Archon session / operator laptop. DB mode (--db):
 // for the droplet deploy gate, which has DB access but no GDS session — it reads
 // the roster straight from Postgres. db.js is lazy-required so importing this
@@ -258,13 +265,24 @@ function rowsToMap(rows) {
 async function fetchRankMap({ useDb = false } = {}) {
   if (useDb) {
     try {
-      const db = require('../../src/bongos/db.js');
+      const db = require(ROSTER_DB_MODULE);
+      if (typeof db.getBuildersRoster !== 'function') {
+        // The exact failure this file already shipped once, named rather than caught as a
+        // generic TypeError: a moved export reads identically to "no database" otherwise.
+        throw new Error(`${ROSTER_DB_MODULE} exports no getBuildersRoster — it has moved again`);
+      }
       const roster = await db.getBuildersRoster({ staleHours: 24 });
-      return rowsToMap(roster.builders || roster);
+      const map = rowsToMap(roster.builders || roster);
+      if (Object.keys(map).length) return map;
+      console.error('main-audit: --db roster read returned NO builders — falling through to the API/public roster.');
     } catch (e) {
-      console.error(`main-audit: --db roster read failed (${e.message})`);
-      return {};
+      console.error(`main-audit: --db roster read failed (${e.message}) — falling through to the API/public roster.`);
     }
+    // FALL THROUGH, do not return {}. Returning an empty map here is the vacuous green
+    // this file's own comment warns about twelve lines down: with no ranks, every author
+    // resolves to null, no blocker can ever fire, and the gate reports success for the
+    // reason it was built to prevent. A `--db` gate that cannot reach Postgres is better
+    // served by the public leaderboard than by silence.
   }
   try {
     const api = await cliClient({ allowUnauthenticated: true });
@@ -394,4 +412,8 @@ if (require.main === module) {
 module.exports = {
   analyzeCommits, resolveRank, parseCommits, rowsToMap,
   clampWindow, defaultRange, firstParentDepth, DEFAULT_WINDOW,
+  // Exported so a test can assert the address is LIVE without a database. The --db
+  // path was dead for as long as the db.js carve has been landed precisely because
+  // nothing checked that this require target still exports what it is called for.
+  ROSTER_DB_MODULE, fetchRankMap,
 };

package/scripts/gds/provision-core-upgrade.js

@@ -187,6 +187,25 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const healthUrl = `http://127.0.0.1:${inst.port}/healthz`;
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
   const sudoP = privileged ? 'sudo ' : '';
+  // WHERE THE CLI LIVES AND WHERE THE TARGET LIVES ARE DIFFERENT PLACES (task 1004053).
+  //
+  // `scripts/gds/upgrade.js` ships in the CORE checkout. A provisioned instance root holds
+  // no scripts/ directory at all — its core sits under node_modules/@bongos/core — so
+  // running the CLI with cwd = the instance root resolved nothing, and EVERY standalone
+  // upgrade died before it began:
+  //
+  //   Error: Cannot find module '/srv/<base>/<slug>/scripts/gds/upgrade.js'
+  //
+  // It worked only where instanceDir HAPPENED to be this checkout — the control-plane self
+  // row and a co-tenant — which is why it survived to production: the shapes that are
+  // upgraded by hand are the shapes the relative path fits. Every ACTIVE tenant is
+  // standalone, so the deploy door could not move a single one of them.
+  //
+  // upgrade.js's own header states the contract this restores: "Runs from the consumer
+  // instance root (default) or `--instance <dir>`. This script ships IN the core … against
+  // `--instance <consumer>`." So: run it where it exists, and NAME the target.
+  const runDir = REPO_ROOT;
+  const targetArg = instanceDir === REPO_ROOT ? '' : `--instance ${instanceDir}`;
   const cli = path.posix.join('scripts', 'gds', 'upgrade.js');
   const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
     ? intent.requested_by.replace(/^api:archon:/, '')
@@ -195,6 +214,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
     `${sudoP}node ${cli}`,
     '--registry',
     `--to ${to}`,
+    targetArg,
     `--service ${inst.slug}`,
     `--health-url ${healthUrl}`,
     `--version-url ${versionUrl}`,
@@ -204,13 +224,13 @@ async function coreUpgradeInstance(inst, deps, intent) {
   ].filter(Boolean).join(' ');
 
   if (!apply) {
-    log(`  ✓ would run: ${cmd} (dry-run — nothing ran)`);
+    log(`  ✓ would run (in ${runDir}): ${cmd} (dry-run — nothing ran)`);
     log(`  ✓ would then read ${versionUrl} on the box and require it to say ${to}`);
     return { ok: true, served: null };
   }
   try {
-    log(`  [upgrade] ${cmd}`);
-    boxExec(cmd, { cwd: instanceDir });
+    log(`  [upgrade] (in ${runDir}) ${cmd}`);
+    boxExec(cmd, { cwd: runDir });
   } catch (e) {
     // upgrade.js rolls itself back on a failed health check or an unchanged served
     // version, so by the time this throws the instance is back on the core it had.

package/scripts/gds/run-unit-tests.js

@@ -464,7 +464,12 @@ function main() {
       if (n) skipped.push({ name: displayName, n });
       console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run on this platform)` : ''}`);
     } catch (err) {
-      const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
+      // `exit null` on its own is unreadable, and it is what a HANG looks like here: the
+      // signal that ended the process is the whole diagnosis, so say it (task 1004052 —
+      // a test that hung for the full budget reported `exit null` and nothing else).
+      const why = err.killed
+        ? `TIMEOUT after ${perTestTimeout / 1000}s${err.signal ? `, ${err.signal}` : ''}`
+        : `exit ${err.status}${err.signal ? ` (${err.signal})` : ''}`;
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
       if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
         console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
@@ -474,6 +479,16 @@ function main() {
       console.log(`  FAIL  ${displayName} (${why})`);
       // The actual failures first: the file's own FAIL lines, then its stdout
       // tail (the last failure's assertion detail + summary), both bounded.
+      // EMPTY STDOUT IS ITSELF THE CLUE, and it used to print as a blank gap. node:test
+      // buffers a file's whole report until the file finishes, so a suite that hangs
+      // mid-run emits NOTHING — which reads as "no detail available" when it actually
+      // means "it never got to the end". Name that, and name how to find the case.
+      if (!stdoutText) {
+        console.log('        (no output at all — node:test buffers a file\'s report until it finishes,');
+        console.log('         so this suite did not reach the end. To find which case: run it on the same');
+        console.log('         platform with each case writing its name to STDERR before it runs; stderr is');
+        console.log('         unbuffered, so the last name with no completion is the one that hung.)');
+      }
       const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
       for (const l of failLines) console.log(`      ${l.trim()}`);
       if (stdoutText) {

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.876'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.878'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');