@bongos/core 1.19.883 → 1.19.885

package/scripts/gds/ship-land.js

@@ -438,24 +438,100 @@ async function pollServerPublish(taskId, branch) {
 // Best-effort + never throws: a non-Metic author, an unconfigured server, or a
 // transient failure just leaves the PR un-attested → it escalates (the safe
 // direction). A non-gate PR is unaffected by the attestation either way.
+//
+// task 1004055 — the endpoint does TWO things, and only one of them was ever
+// reported. Besides the attestation (best-effort, and declining is a legitimate
+// answer) it records claims.published_head_sha, the tip that makes the ship
+// PROVABLE — and that half is load-bearing, not best-effort: without it POST /ship
+// refuses the confirmed→shipped flip. So this returns { recorded, attested, reason }
+// rather than undefined, and callers act on `recorded`. It still never throws.
 async function attestGateTrust(taskId, headSha) {
-  if (!headSha) return;
+  if (!headSha) return { recorded: false, attested: false, reason: 'no head SHA to attest' };
+  let r;
   try {
-    const r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
-    if (r.ok && r.data) {
-      if (r.data.attested) {
-        console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
-      } else {
-        console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
-      }
-    } else if (r.status === 503) {
-      console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
+  } catch (e) {
+    // task 1004055: a bare `catch (_) {}` here meant a thrown request error left NO
+    // trace at all — the quietest of the failure shapes, and the one that reached
+    // the builder as an unexplained ship_land_not_proven.
+    console.log(`  ci-land: gate attestation request failed (${(e && e.message) || 'unknown error'}).`);
+    return { recorded: false, attested: false, reason: `request failed (${(e && e.message) || 'unknown error'})` };
+  }
+  const recorded = landProofRecorded(r);
+  if (r.ok && r.data) {
+    if (r.data.attested) {
+      console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
     } else {
-      console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+      console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
     }
-  } catch (_) {
-    /* best-effort — never block the ship on the attestation */
+    return { recorded, attested: !!r.data.attested, reason: r.data.reason || null };
+  }
+  if (r.status === 503) {
+    console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    return { recorded, attested: false, reason: 'the server has no push credential' };
   }
+  console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+  return { recorded, attested: false, reason: `HTTP ${r.status}` };
+}
+
+// landProofRecorded — PURE. Did an attest-gate response actually record
+// claims.published_head_sha (task 1004055)? That row is the durable per-task land
+// proof; without it POST /tasks/:id/ship refuses with ship_land_not_proven and the
+// task strands at 'confirmed' with its work already on main.
+//
+// The server SAYS so in `tip_recorded` — on the 200 body and in the 503's details,
+// because the write deliberately sits BEFORE the credential check. Prefer that.
+// A server that predates the field sends neither, which is the NORMAL state here:
+// an instance runs a PINNED core, so it lags main by however long the pin sits
+// still. For those, fall back to the route's contract — the write is above the
+// credential 503, so 200 and 503 both mean the tip landed and nothing else does.
+// Exported so the truth table is pinned with no server.
+function landProofRecorded(r) {
+  if (!r || typeof r.status !== 'number') return false;
+  const body = r.data || {};
+  const explicit = body.tip_recorded !== undefined
+    ? body.tip_recorded
+    : (body.error && body.error.details ? body.error.details.tip_recorded : undefined);
+  if (explicit !== undefined) return explicit === true;
+  return r.status === 200 || r.status === 503;
+}
+
+// landProofWarningLines — PURE. What to print when the proof did NOT get recorded
+// (task 1004055). Without it POST /ship refuses, the task parks at 'confirmed' —
+// which gates the builder's WHOLE queue — and the publish-reconciler eventually
+// writes strand:land_not_proven, after which nothing heals it. Say it HERE, while
+// the sha is still on screen, and hand over the calls that fix it, rather than
+// letting it surface as an opaque 409 later.
+//
+// `merged` is the tense, and it is the whole difference between the two callers:
+// the local-merge path has ALREADY put the work on main and needs the full
+// two-call recovery now; the PR path has only pushed, so the land may still be
+// minutes away and the same recovery would be premature. Exported so both
+// wordings are pinned.
+function landProofWarningLines(taskId, sha, reason, { merged = true } = {}) {
+  const head = sha || '<the merge commit on main>';
+  const why = `  WARNING: the land proof for task ${taskId} was NOT recorded (${reason || 'unknown'}).`;
+  const fix = `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"${head}"}'`;
+  if (!merged) {
+    return [
+      '',
+      why,
+      '  Nothing is lost yet — the branch is pushed and the PR still lands normally.',
+      '  But if the ship then refuses with ship_land_not_proven, re-record the tip',
+      '  against the merge commit and re-run the ship:',
+      `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"<the merge commit on main>"}'`,
+      `    node scripts/gds/ship.js ${taskId}`,
+    ];
+  }
+  return [
+    '',
+    why,
+    '  The merge IS on main, but the server cannot prove the land is this task\'s, so',
+    '  the confirmed -> shipped flip will be refused (ship_land_not_proven) and the',
+    '  task will park at confirmed — which blocks every new claim you make. Fix it:',
+    fix,
+    `    node scripts/gds/api.js POST /tasks/${taskId}/ship --body '{}'`,
+  ];
 }
 
 // pickStaleGateReviewRun — PURE. Among `gh run list --json
@@ -596,7 +672,14 @@ async function ciLandLocal(taskId, branch, valueSummary) {
   // and a Metic+ gate-surface PR auto-passes — race-free for a fresh PR, since the
   // `gh pr create` below is what fires gate-review and it runs only after this
   // returns. (A reused open PR is handled by the re-run nudge after auto-merge.)
-  await attestGateTrust(taskId, headSha);
+  // task 1004055: the same call also records the land proof, so a miss here is not
+  // cosmetic — check it rather than firing and forgetting. Not fatal on this path:
+  // the branch is pushed and the PR lands regardless, so say what to do IF the ship
+  // is later refused, and carry on.
+  const gateProof = await attestGateTrust(taskId, headSha);
+  if (!gateProof.recorded) {
+    for (const line of landProofWarningLines(taskId, headSha, gateProof.reason, { merged: false })) console.log(line);
+  }
 
   // Ensure exactly one PR for this branch. gh pr create is idempotent-ish: it
   // errors if a PR already exists, so check first and reuse it.
@@ -723,6 +806,12 @@ module.exports = {
   ciLand,
   classifyLandOutcome,
   formatPublishFailure,
+  // task 1004055: the land-proof half of attest-gate. attestGateTrust is exported
+  // so the LOCAL-merge path can record a proof it previously never recorded at all;
+  // the two pure halves so the truth table + the wording are pinned without a server.
+  attestGateTrust,
+  landProofRecorded,
+  landProofWarningLines,
   // task 1002572 (PART 2): the bail ids + the pure "can a PR still land this?"
   // decision, so the single-checkout fallback is opt-in per bail and unit-tested.
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,

package/scripts/gds/ship-merge.js

@@ -20,9 +20,11 @@ const { mainIsProtected, pushVia, readDeployConfigRaw, resolveDeployMode, resolv
 const {
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,
   LAND_BAIL_NO_TASK_BRANCH,
+  attestGateTrust,
   ciLand,
   landBailRecoverableByPr,
   landBailed,
+  landProofWarningLines,
   landed,
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
@@ -301,6 +303,32 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       return landBailed('could not push the merged main to origin', '/merge-mode');
     }
 
+    // task 1004055: RECORD THE LAND PROOF — the step this path never had.
+    //
+    // The two OTHER land paths each tell the server which commit is this task's:
+    // ciLandLocal posts attest-gate after its push, ciLandServer gets it from
+    // publish-branch. This path merges and pushes main ITSELF, so nothing ever did,
+    // and claims.published_head_sha stayed NULL. It also opens no PR and deletes the
+    // branch below, so getPublishStatus can find nothing by head ref either — which
+    // left deriveShipAssurance with neither of its two proofs and made the POST /ship
+    // three lines later refuse with ship_land_not_proven, EVERY time, with the work
+    // already merged. The task then parked at 'confirmed', gating its builder's whole
+    // queue, until someone ran the recovery by hand (five consecutive ships,
+    // 2026-09-19; twelve refusals in one day's audit log).
+    //
+    // The merge commit is the sha to record: the push above just put it on main, so
+    // the ancestry check cannot fail, and it is what the hand-recovery always used.
+    // It goes HERE, immediately after the push and BEFORE both the deploy step (which
+    // can bail) and the branch deletion (which destroys the only other evidence) —
+    // the proof must exist from the first moment the work is on main.
+    const mergeSha = gitOk('git rev-parse HEAD', { cwd: REPO_ROOT });
+    const proof = await attestGateTrust(taskId, mergeSha);
+    if (proof.recorded) {
+      console.log(`  auto-merge: land proof recorded (merge ${String(mergeSha).slice(0, 8)} on main).`);
+    } else {
+      for (const line of landProofWarningLines(taskId, mergeSha, proof.reason)) console.log(line);
+    }
+
     // Deploy step. The core carries NO deploy target of its own — under the
     // standalone model a core change reaches a live instance via package-core +
     // `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). So unless an

package/scripts/gds/ship.js

@@ -127,6 +127,8 @@ const {
   landPending,
   landPendingLines,
   landPollAfterAutoMerge,
+  landProofRecorded,
+  landProofWarningLines,
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
@@ -266,6 +268,12 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1004055: the land proof the LOCAL-merge path never recorded. landProofRecorded
+  // is the "did the tip actually land?" truth table (explicit tip_recorded wins; a
+  // pinned older core falls back to the route's before-the-credential-check contract);
+  // landProofWarningLines is the recovery the builder gets when it did not, in the
+  // tense of whichever path is speaking. Both pure — exported so they pin without a server.
+  landProofRecorded, landProofWarningLines,
   // task 1001916: the publish-branch failure formatter — exported pure so both
   // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
   // non-fast-forward remedy hint are pinned without a server.

package/src/bongos/serve-internal.js

@@ -3,7 +3,6 @@
 // Mounts every non-game surface the platform serves onto an Express app:
 //   * /healthz + /version          — liveness + deployed-build info
 //   * /api/bongos/*                    — the GDS API (buildGdsRouter)
-//   * /downloads/devbox/*           — Dev Box installer redirect surface (#904)
 //   * generic module web-surface   — each enabled module's contributes.webSurfaces
 //     hosts                          served on its Host prefix by ONE generic static
 //                                     loop (the status dashboard at status.<apex>,
@@ -28,9 +27,7 @@
 // import boundary (scripts/gds/fitness.js §1) — it imports nothing from the host
 // game runtime (no src/db.js, no src/rooms/, no src/world/, no Colyseus). It
 // serves only static files + the GDS router, so a non-game Cloud Bongos instance
-// runs it unchanged. (The /downloads/devbox/* surface is an instance feature that
-// R54's module system, task 1193, will gate per-instance; it is benign on a
-// vanilla boot — it only redirects to whatever config/devbox-app.json names.)
+// runs it unchanged.
 
 const path = require('path');
 const fs = require('fs');
@@ -44,7 +41,6 @@ const gdsAuth = require('./auth');
 const { loadIdpConfig } = require('./auth-config');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
-const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding, applyBrandConditionals } = require('../branding');
 const { prelaunchGate } = require('./prelaunch-gate');
@@ -59,7 +55,7 @@ const { API_PREFIX, LEGACY_API_PREFIXES, API_VERSION, VERSIONED_API_PREFIX, ALL_
 // is byte-identical for the live instance.
 const ROOT = resolveCoreRoot();
 
-// Instance-only RELEASE config (config/devbox-app.json, config/bongos-cli.json) is
+// Instance-only RELEASE config (config/bongos-cli.json) is
 // boundary-excluded from the portable core (publish-manifest INSTANCE_EXCLUDE), so it is
 // HOST content: it lives at the INSTANCE root, which on a vendored instance is NOT the
 // package dir this file sits under. A core-relative require therefore looked in
@@ -532,38 +528,6 @@ function isApexOnlyPath(p) {
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
 // 404 in platform-server.js).
-// The Dev Box download/manifest mini-router (#904, ADR 0045), extracted so the
-// ACTUAL route handlers are hermetically testable (tests/devbox_update_path.mjs
-// mounts them on a throwaway app — the docs_openapi_route pattern) instead of
-// only their pure builder. task 1002649: the manifest is served under BOTH
-// /latest.json and an extensionless /latest twin — a front proxy with a
-// file-matcher can eat *.json paths before Node (the live pre-ADR-0152 vhost
-// 404'd latest.json empty while extensionless siblings worked), so every
-// manifest consumer has a path that survives that class. Registration order
-// matters: the literal routes must precede the `:target` catch-all.
-function mountDevboxDownloads(app, devboxDownloads) {
-  const manifest = (_req, res) => {
-    // Short TTL: a release bump (config change + deploy) is visible within a
-    // minute, same posture as the hall's HTML.
-    res.set('Cache-Control', 'public, max-age=60');
-    res.json(devboxDownloads.latestJson());
-  };
-  app.get('/downloads/devbox/latest.json', manifest);
-  app.get('/downloads/devbox/latest', manifest);
-  // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
-  // /settings courtesy line reads.
-  app.get('/downloads/devbox/version', (_req, res) => {
-    res.set('Cache-Control', 'public, max-age=60');
-    res.json(devboxDownloads.versionJson());
-  });
-  app.get('/downloads/devbox/:target', (req, res) => {
-    const url = devboxDownloads.redirectFor(req.params.target);
-    if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
-    res.set('Cache-Control', 'public, max-age=60');
-    res.redirect(302, url);
-  });
-}
-
 function mountInternalSurfaces(app) {
   // Prometheus instrumentation (task #1680, V4.R28a). The counting middleware
   // mounts FIRST so it wraps every surface registered below (and, since
@@ -691,24 +655,14 @@ function mountInternalSurfaces(app) {
     app.use(prefix, gdsRouter);
   }
 
-  // Dev Box desktop app downloads (#904, ADR 0045). Branded redirect surface:
-  // the installers live as release assets on the public releases repo (they
-  // can't ride the git deploy — see src/devbox-downloads.js), and these routes
-  // keep every builder-facing URL on the apex. Mounted right after the API and
-  // BEFORE the host shims so the same paths work on the apex AND on
-  // builders.<apex> (the builders rewrite shim below only prefixes non-/api
-  // paths, so without this placement /downloads/* would be rewritten to
-  // /builders/downloads/* and 404).
-  const devboxCfg = tryLoadInstanceConfig('devbox-app.json');
-  if (devboxCfg) {
-    mountDevboxDownloads(app, buildDevboxDownloads(devboxCfg));
-  }
-
   // Standalone `bongos` CLI downloads + the one-line installer (task 1248,
-  // V4.R81). Same off-repo release pattern as the Dev Box block above: the
-  // compiled per-platform binaries live as release assets on the public releases
-  // repo (config/bongos-cli.json → src/bongos-downloads.js), and these routes keep
-  // every user-facing URL on the apex. The installer scripts are served with the
+  // V4.R81). Off-repo release pattern: the compiled per-platform binaries live
+  // as release assets on the public releases repo (config/bongos-cli.json →
+  // src/bongos-downloads.js), and these routes keep every user-facing URL on the
+  // apex. Mounted right after the API and BEFORE the host shims so the same
+  // paths work on the apex AND on builders.<apex> (the builders rewrite shim
+  // below only prefixes non-/api paths, so without this placement /downloads/*
+  // would be rewritten to /builders/downloads/* and 404). The installer scripts are served with the
   // server's PINNED origin substituted for __GDS_API_BASE__ — never a request
   // header, so a spoofed Host can't redirect a `curl | sh` (the box-connect.sh rule).
   const bongosCfg = tryLoadInstanceConfig('bongos-cli.json');
@@ -1357,4 +1311,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, mountDevboxDownloads, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.883'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.885'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -13,7 +13,6 @@
 //   * the builders' hall host    — modules/hall-ui/public/ (the hall-ui module's
 //                                  web surface, BV1.R85 — served by its dedicated
 //                                  block in serve-internal)
-//   * /downloads/devbox/*        — the Dev Box installer redirects
 //
 // WHAT IT DELIBERATELY DOES NOT CONSTRUCT — the host game runtime:
 //   * NO Colyseus server, NO WebSocketTransport

package/tests/host_topology_skips.mjs

@@ -37,7 +37,6 @@ const ALLOWED = {
   box_ship_permissions: '.claude/settings.json (package-excluded)',
   conductor: '.claude/hooks/conductor.js (package-excluded)',
   deploy_instance: 'scripts/deploy/deploy-instance.sh (host topology)',
-  devbox_downloads: 'config/devbox-app.json (instance content)',
   eviction_policy: '.claude/hooks/eviction-policy.js (package-excluded)',
   first_run_engine_check: '.claude/hooks/session-start.js (package-excluded)',
   hook_core_resolve: '.claude/hooks/_core-resolve.js (package-excluded)',

package/tests/instance_release_config.mjs

@@ -1,15 +1,16 @@
 // tests/instance_release_config.mjs
 //
-// serve-internal mounts /downloads/devbox/* and /downloads/bongos/* only when the
-// instance ships the matching RELEASE config (config/devbox-app.json,
-// config/bongos-cli.json). Those configs are boundary-EXCLUDED from the packaged core,
+// serve-internal mounts /downloads/bongos/* only when the instance ships the matching
+// RELEASE config (config/bongos-cli.json). That config is boundary-EXCLUDED from the packaged core,
 // so they live at the INSTANCE root — which on a vendored instance (@bongos/core in
 // node_modules, ADR 0108) is a DIFFERENT directory from the core package dir
 // serve-internal.js sits in. The old core-relative `require('../../config/…')` looked
-// only in node_modules/@bongos/core/config/, so a vendored instance's Dev Box download
-// routes never mounted (task 1002371; ADR 0145 papered over it by copying the config
-// into node_modules — lost on the next npm ci). Same class as ADR 0144's vendored
-// infra/ path bug.
+// only in node_modules/@bongos/core/config/, so a vendored instance's download routes
+// never mounted (task 1002371; ADR 0145 papered over it by copying the config into
+// node_modules — lost on the next npm ci). Same class as ADR 0144's vendored infra/
+// path bug. This test was written against the /downloads/devbox/* twin, which task
+// 1003891 deleted with the Dev Box app; it now proves the SAME ladder against
+// /downloads/bongos/*, the surviving surface that still depends on it.
 //
 // The first test is THE regression: a config present ONLY at the instance root must be
 // found. It fails against the old resolution (which could not see the instance root at
@@ -29,12 +30,12 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 
-// A minimal but VALID release config — buildDevboxDownloads rejects a bad
+// A minimal but VALID release config — buildBongosDownloads rejects a bad
 // releases_repo/version at boot, so the end-to-end mount below proves real parsing.
-const DEVBOX_CFG = {
-  releases_repo: 'example-owner/example-devbox',
+const CLI_CFG = {
+  releases_repo: 'example-owner/example-cli',
   version: '9.9.9',
-  assets: { 'mac-arm64': 'Example-Dev-Box-9.9.9-arm64.dmg' },
+  assets: { 'mac-arm64': 'bongos-9.9.9-macos-arm64' },
   aliases: { mac: 'mac-arm64' },
 };
 
@@ -50,23 +51,23 @@ function makeRoot(name, contents) {
 
 // Point the process at a temp INSTANCE root BEFORE serve-internal loads, so the default
 // (uninjected) resolution runs the vendored shape: config at the instance root, absent
-// from the core package dir. This checkout ships no config/devbox-app.json — it is
+// from the core package dir. This checkout ships no config/bongos-cli.json — it is
 // instance-only — so the core tier genuinely has nothing to find, exactly like a
 // freshly-vendored box.
-const INSTANCE_ROOT = makeRoot('devbox-app.json', JSON.stringify(DEVBOX_CFG));
+const INSTANCE_ROOT = makeRoot('bongos-cli.json', JSON.stringify(CLI_CFG));
 process.env.CLOUDBONGOS_INSTANCE_ROOT = INSTANCE_ROOT;
 const { tryLoadInstanceConfig, mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
 
 test('finds a release config that exists ONLY at the instance root (the vendored bug)', () => {
-  const instance = makeRoot('devbox-app.json', '{"version":"1.0.0"}');
+  const instance = makeRoot('bongos-cli.json', '{"version":"1.0.0"}');
   const core = makeRoot(null);
-  assert.deepEqual(tryLoadInstanceConfig('devbox-app.json', [instance, core]), { version: '1.0.0' });
+  assert.deepEqual(tryLoadInstanceConfig('bongos-cli.json', [instance, core]), { version: '1.0.0' });
 });
 
 test('the instance root wins over the core package dir when both carry a copy', () => {
-  const instance = makeRoot('devbox-app.json', '{"from":"instance"}');
-  const core = makeRoot('devbox-app.json', '{"from":"core"}');
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', [instance, core]).from, 'instance');
+  const instance = makeRoot('bongos-cli.json', '{"from":"instance"}');
+  const core = makeRoot('bongos-cli.json', '{"from":"core"}');
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', [instance, core]).from, 'instance');
 });
 
 test('falls back to the core package dir (single checkout + the copied-in workaround)', () => {
@@ -76,16 +77,16 @@ test('falls back to the core package dir (single checkout + the copied-in workar
 });
 
 test('absent from every root → null, so the download surface just does not mount', () => {
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', [makeRoot(null), makeRoot(null)]), null);
-  assert.equal(tryLoadInstanceConfig('devbox-app.json', []), null);
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', [makeRoot(null), makeRoot(null)]), null);
+  assert.equal(tryLoadInstanceConfig('bongos-cli.json', []), null);
 });
 
 test('a MALFORMED config still throws — only a MISSING file is tolerated', () => {
-  const bad = makeRoot('devbox-app.json', '{ this is not valid json ');
-  assert.throws(() => tryLoadInstanceConfig('devbox-app.json', [bad]), SyntaxError);
+  const bad = makeRoot('bongos-cli.json', '{ this is not valid json ');
+  assert.throws(() => tryLoadInstanceConfig('bongos-cli.json', [bad]), SyntaxError);
 });
 
-test('/downloads/devbox/version mounts from an INSTANCE-root config (end to end)', async () => {
+test('/downloads/bongos/version mounts from an INSTANCE-root config (end to end)', async () => {
   const express = require('express');
   const app = express();
   mountInternalSurfaces(app);
@@ -93,11 +94,11 @@ test('/downloads/devbox/version mounts from an INSTANCE-root config (end to end)
     const s = app.listen(0, () => resolve(s));
   });
   try {
-    const res = await fetch(`http://127.0.0.1:${server.address().port}/downloads/devbox/version`);
+    const res = await fetch(`http://127.0.0.1:${server.address().port}/downloads/bongos/version`);
     assert.equal(res.status, 200, 'the route must mount when only the INSTANCE root has the config');
     const body = await res.json();
-    assert.equal(body.version, DEVBOX_CFG.version);
-    assert.match(body.assets['mac-arm64'], /^https:\/\/github\.com\/example-owner\/example-devbox\//);
+    assert.equal(body.version, CLI_CFG.version);
+    assert.match(body.assets['mac-arm64'], /^https:\/\/github\.com\/example-owner\/example-cli\//);
   } finally {
     await new Promise((r) => server.close(r));
   }

package/tests/publish_branch_route.mjs

@@ -471,11 +471,11 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       const router = buildTasksRouter();
       const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
       const handler = layer.route.stack[layer.route.stack.length - 1].handle;
-      const out = { failCode: null, jsonBody: null };
+      const out = { failCode: null, failOpts: null, jsonBody: null };
       const res = {
         status() { return this; },
         json(b) { out.jsonBody = b; return this; },
-        fail(code) { out.failCode = code; return this; },
+        fail(code, opts) { out.failCode = code; out.failOpts = opts; return this; },
       };
       // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
       const req = { params: { id: '77' }, body: { head_sha: 'a'.repeat(40) }, builder: { id: 95, rank: 'archon' } };
@@ -483,9 +483,77 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       assert.equal(out.failCode, 'push_unconfigured', 'no credential → still the usual 503 to the caller');
       assert.deepEqual(recorded, [{ taskId: 77, builderId: 95, sha: 'a'.repeat(40) }],
         'the tip is recorded BEFORE the credential check — the wave-strand cure');
+      // task 1004055: and the 503 must SAY the tip landed. This exit is the one a
+      // caller is most likely to misread as total failure; ship.js decides whether
+      // to warn the builder off this flag, so it has to travel on the error too.
+      assert.equal(out.failOpts && out.failOpts.details && out.failOpts.details.tip_recorded, true,
+        'the 503 must carry tip_recorded:true — the write happened before it');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+  }
+});
+
+// task 1004055: the SILENT MISS. setClaimPublishedSha returns null when the UPDATE
+// matched no claim row, and the old route discarded that return value — so a caller
+// that had already merged to main was told nothing was wrong, and only found out one
+// call later as an opaque ship_land_not_proven 409, with the task parked at
+// 'confirmed' gating its builder's whole queue. `tip_recorded` is what makes that
+// answerable at the moment it happens.
+await t('POST /tasks/:id/attest-gate reports tip_recorded:false when no claim row matched', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  // null = "the UPDATE matched nothing", the shape db-ship.js really returns.
+  dbMod.setClaimPublishedSha = async () => null;
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    // A credential IS configured, so the handler reaches res.json; a below-Metic rank
+    // means postGateAuthorTrust declines on the pure rank check and never fetches.
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { failCode: null, jsonBody: null };
+      const res = {
+        status() { return this; },
+        json(b) { out.jsonBody = b; return this; },
+        fail(code) { out.failCode = code; return this; },
+      };
+      const req = { params: { id: '77' }, body: { head_sha: 'b'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.failCode, null, 'a below-Metic attest is a 200, not a failure');
+      assert.equal(out.jsonBody.ok, true);
+      assert.equal(out.jsonBody.attested, false, 'below Metic → no attestation, as before');
+      assert.equal(out.jsonBody.tip_recorded, false,
+        'nothing was recorded, and the response must say so rather than reading as success');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
+  }
+});
+
+await t('POST /tasks/:id/attest-gate reports tip_recorded:true on the happy path', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  dbMod.setClaimPublishedSha = async () => 4242; // a claim id = the UPDATE matched
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { jsonBody: null };
+      const res = { status() { return this; }, json(b) { out.jsonBody = b; return this; }, fail() { return this; } };
+      const req = { params: { id: '77' }, body: { head_sha: 'c'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.jsonBody.tip_recorded, true);
     });
   } finally {
     dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
   }
 });