@bongos/core 1.20.37 → 1.20.39

package/tests/autobongos_fence.mjs

@@ -260,3 +260,65 @@ test('no request means every allowlisted goal', () => {
   assert.deepEqual(allowedGoals(f, []).goals, [1, 2]);
   assert.deepEqual(allowedGoals(f).goals, [1, 2]);
 });
+
+// ── the priority goal (task 1004453) ────────────────────────────────────────────
+//
+// Owner ruling: whoever starts the runner names the goal it works FIRST, as well as
+// the set it may touch. The priority ORDERS the allowlist; it must never widen it.
+
+test('the priority goal is read off the fence and moved to the front', () => {
+  const f = open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 });
+  assert.equal(normaliseFence(f).priorityGoal, 3);
+  const d = decideRun({ fence: f, ...GRADER_OK });
+  assert.equal(d.go, true);
+  assert.deepEqual(d.goals, [3, 1, 2], 'the runner walks goals in this order, so the priority goes first');
+  assert.equal(d.priorityGoal, 3);
+});
+
+test('a priority that is not on the allowlist is ignored, never added', () => {
+  // The database refuses this with a foreign key; the pure half refuses it again,
+  // because a priority that could add a goal would be a second, unguarded allowlist.
+  const f = open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: 99 });
+  assert.equal(normaliseFence(f).priorityGoal, null);
+  const d = decideRun({ fence: f, ...GRADER_OK });
+  assert.deepEqual(d.goals, [1, 2]);
+  assert.equal(d.priorityGoal, null);
+});
+
+test('a malformed or missing priority reads as "no priority", not as a refusal', () => {
+  for (const p of [undefined, null, '', 0, -4, 'abc', 1.5, {}]) {
+    const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: p }), ...GRADER_OK });
+    assert.equal(d.go, true, `priority ${JSON.stringify(p)} must not stop the run`);
+    assert.deepEqual(d.goals, [1, 2], `priority ${JSON.stringify(p)} must not reorder`);
+    assert.equal(d.priorityGoal, null);
+  }
+});
+
+test('a stringified priority id (a bigint from the database) still counts', () => {
+  const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: '2' }), ...GRADER_OK });
+  assert.deepEqual(d.goals, [2, 1]);
+  assert.equal(d.priorityGoal, 2);
+});
+
+test('narrowing on the command line keeps the priority first, and can drop it', () => {
+  const f = normaliseFence(open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 }));
+  assert.deepEqual(allowedGoals(f, [1, 3]).goals, [3, 1]);
+  // An operator narrowing to goals that leave the priority out gets no priority —
+  // it is not quietly re-added behind their back.
+  assert.deepEqual(allowedGoals(f, [1, 2]).goals, [1, 2]);
+  const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 }), requestedGoals: [1, 2], ...GRADER_OK });
+  assert.equal(d.priorityGoal, null, 'a row must not claim a pick came from a priority this run excluded');
+});
+
+test('prioritise only reorders: same members, same count', () => {
+  assert.deepEqual(fence.prioritise([5, 6, 7], 6), [6, 5, 7]);
+  assert.deepEqual(fence.prioritise([5, 6, 7], 8), [5, 6, 7]);
+  assert.deepEqual(fence.prioritise([5, 6, 7], null), [5, 6, 7]);
+});
+
+test('a closed fence still refuses whatever the priority says', () => {
+  const d = decideRun({ fence: open({ enabled: false, priority_goal_id: 1000119 }), ...GRADER_OK });
+  assert.equal(d.go, false);
+  assert.equal(d.code, 'kill_switch');
+  assert.deepEqual(d.goals, []);
+});

package/tests/autobongos_loop.mjs

@@ -1303,3 +1303,79 @@ test('past the uptime floor, a drift still exits', async () => {
   });
   assert.equal(code, runner.UPGRADE_EXIT_CODE);
 });
+
+// ── the priority goal reaches the picker, the rows and the heartbeat (task 1004453) ──
+
+const twoGoalFence = (priority) => async () => ({
+  raw: { enabled: true, paused_reason: null, goals: [{ goal_id: 1000119 }, { goal_id: 1000090 }], priority_goal_id: priority },
+  graderBypassed: false,
+});
+
+test('the picker is handed the priority goal first', async () => {
+  let sawGoals = null;
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async (goals) => { sawGoals = goals; return { task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }; },
+  });
+  await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.deepEqual(sawGoals, [1000090, 1000119]);
+});
+
+test('a worked row says its pick came from the priority goal', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000090);
+  assert.equal(row.priority, true);
+});
+
+test('once the priority goal runs dry, a pick from the rest reads priority:false', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: aTask, goalId: 1000119, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000119);
+  assert.equal(row.priority, false);
+});
+
+test('with no priority set, no pick claims to be one', async () => {
+  const h = harness({ readFence: twoGoalFence(null) });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.priority, false);
+});
+
+test('a dry run and an empty queue both name the priority', async () => {
+  const dry = await runner.iteration({ ...opts, goals: [], dryRun: true }, harness({
+    readFence: twoGoalFence(1000119),
+  }).deps);
+  assert.equal(dry.event, 'dry_run');
+  assert.equal(dry.priority, true);
+  const none = await runner.iteration({ ...opts, goals: [] }, harness({
+    readFence: twoGoalFence(1000119),
+    pickTask: async () => ({ none: true, skipped: [] }),
+  }).deps);
+  assert.equal(none.event, 'nothing_claimable');
+  assert.equal(none.priority_goal, 1000119);
+});
+
+test('the server heartbeat carries the goal the current task came from', async () => {
+  const beats = [];
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 1 }, {
+    iteration: async () => ({ event: 'worked', task_id: 4242, goal_id: 1000090, priority: true }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields); return true; },
+    emit: () => {},
+    record: (r) => r,
+    codeDrifted: async () => false,
+  });
+  const b = beats.find((x) => x.working_task_id === 4242);
+  assert.ok(b, 'the beat after a worked row must name its task');
+  assert.equal(b.working_goal_id, 1000090);
+});

package/tests/autonomy_fence_priority.mjs

@@ -0,0 +1,211 @@
+// tests/autonomy_fence_priority.mjs — the fence's priority goal, server side
+// (task 1004453).
+//
+// Owner ruling, 2026-09-30: whoever starts the runner names the goal it works
+// FIRST, from the hall's /builders/gate page or the API, and the server refuses a
+// priority that is not on the allowlist. These drive REAL requests through the
+// assembled autonomy router with only the auth gates stubbed (the
+// routine_observability_api precedent), pin the SQL against a stubbed pool, and
+// hold the migration to the shape the route relies on. The pure ordering rule is
+// tests/autobongos_fence.mjs; the runner's use of it is tests/autobongos_loop.mjs.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_fence_priority.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+async function serve(router) {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() };
+}
+
+const post = (base, p, body) => fetch(`${base}${p}`, {
+  method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+});
+
+test('POST /autonomy/fence/priority sits behind the same owner-only atom as the allowlist', () => {
+  const router = autonomyRouter();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/autonomy/fence/priority');
+  assert.ok(layer, 'the route is registered');
+  assert.equal(layer.route.methods.post, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.fence.manage');
+});
+
+test('the route sets, clears, and refuses a goal that is not allowlisted', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.setPriorityGoal;
+  const seen = [];
+  let answer = { row: { priority_goal_id: 1000119, updated_at: '2026-09-30T00:00:00.000Z' } };
+  db.setPriorityGoal = async (args) => { seen.push(args); return answer; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 200);
+    assert.equal((await r.json()).priority_goal_id, 1000119);
+    assert.deepEqual(seen.pop(), { goalId: 1000119, builderId: 3 }, 'the writer is the SESSION, never the body');
+
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: '1000119' });
+    assert.equal(r.status, 200, 'a stringified id is accepted, as the allowlist route accepts one');
+    assert.equal(seen.pop().goalId, 1000119);
+
+    answer = { row: { priority_goal_id: null, updated_at: '2026-09-30T00:00:00.000Z' } };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: null });
+    assert.equal(r.status, 200);
+    assert.equal(seen.pop().goalId, null, 'null clears the priority');
+
+    answer = { notAllowed: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000090 });
+    assert.equal(r.status, 409, 'a priority must already be on the allowlist');
+    assert.equal((await r.json()).error.code, 'goal_not_allowlisted');
+
+    answer = { missing: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 503);
+
+    const before = seen.length;
+    for (const bad of [{}, { goal_id: 0 }, { goal_id: -1 }, { goal_id: 'abc' }, { goal_id: 1.5 }]) {
+      r = await post(s.base, '/autonomy/fence/priority', bad);
+      assert.equal(r.status, 400, `${JSON.stringify(bad)} is refused`);
+    }
+    assert.equal(seen.length, before, 'a malformed request never reaches the database');
+
+    db.setPriorityGoal = async () => { throw new Error('connection reset'); };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 500);
+    assert.ok(!JSON.stringify(await r.json()).includes('connection reset'), 'the database error stays in the log');
+  } finally {
+    s.close();
+    db.setPriorityGoal = saved;
+  }
+});
+
+test('setPriorityGoal: the WHERE refuses a goal that is not allowlisted, and says which refusal it was', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  let replies = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return replies.shift(); };
+  try {
+    replies = [{ rows: [{ priority_goal_id: '1000119', updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000119, builderId: 3 }), { row: { priority_goal_id: 1000119, updated_at: 't' } });
+    assert.match(calls[0].sql, /UPDATE autonomy_fence/);
+    assert.match(calls[0].sql, /EXISTS \(SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = \$1::bigint\)/);
+    assert.deepEqual(calls[0].params, [1000119, 3]);
+
+    replies = [{ rows: [] }, { rows: [{ '?column?': 1 }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { notAllowed: true });
+
+    replies = [{ rows: [] }, { rows: [] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { missing: true });
+
+    replies = [{ rows: [{ priority_goal_id: null, updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: null }), { row: { priority_goal_id: null, updated_at: 't' } });
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('readFence carries the priority as a number, and null when unset', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  let pri = '1000119';
+  api.pool.query = async (sql) => (/FROM autonomy_fence/.test(sql)
+    ? { rows: [{ enabled: true, paused_reason: null, priority_goal_id: pri, updated_at: 't', updated_by: '3' }] }
+    : { rows: [{ goal_id: '1000119', note: null, added_at: 't', added_by: '3' }] });
+  try {
+    assert.equal((await db.readFence()).priority_goal_id, 1000119, 'a bigint string would never equal a numeric goal id');
+    pri = null;
+    assert.equal((await db.readFence()).priority_goal_id, null);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the heartbeat stores and returns the goal the current task came from', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ working_task_id: 4242, working_goal_id: 1000090 }] }; };
+  try {
+    await db.recordRunnerHeartbeat({ builderId: 3, host: 'winbox', workingTaskId: 4242, workingGoalId: 1000090 });
+    assert.match(calls[0].sql, /working_goal_id = EXCLUDED\.working_goal_id/);
+    assert.equal(calls[0].params[8], 1000090);
+    const rows = await db.readRunnerHeartbeats(3);
+    assert.equal(rows[0].working_goal_id, '1000090');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the route accepts working_goal_id on a heartbeat and passes it through', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.recordRunnerHeartbeat;
+  const seen = [];
+  db.recordRunnerHeartbeat = async (args) => { seen.push(args); return {}; };
+  const s = await serve(autonomyRouter());
+  try {
+    const r = await post(s.base, '/autonomy/heartbeat', { host: 'winbox', working_task_id: 4242, working_goal_id: 1000090 });
+    assert.equal(r.status, 200);
+    assert.equal(seen[0].workingGoalId, 1000090);
+  } finally {
+    s.close();
+    db.recordRunnerHeartbeat = saved;
+  }
+});
+
+test('the migration ties the priority to the allowlist and clears it on revoke', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/autonomy/migrations/autonomy_003_priority_goal.sql'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS priority_goal_id bigint\s+REFERENCES autonomy_allowed_goals \(goal_id\) ON DELETE SET NULL/,
+    'revoking the priority goal must clear the priority, never leave a revoked goal "first"');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS working_goal_id bigint/);
+  assert.doesNotMatch(sql, /\bDROP\b/i, 'module migrations are additive');
+});
+
+test('the gate page renders the priority, lists it first, and posts to the priority route', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(src, /renderFenceGoals\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
+  assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
+  assert.match(src, /Make priority/);
+  assert.match(src, /Clear priority/);
+});

package/tests/bongos_cli.mjs

@@ -87,7 +87,13 @@ test('VERBS: selfHelp is only claimed by scripts that really print their own usa
   // `serve` is dev.js with --server pinned on, so it inherits dev's own usage()
   // printer — verified: `bongos serve --help` prints the card and exits 0.
   const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
-  assert.deepEqual(selfHelp, ['dev', 'module', 'serve', 'status', 'task', 'upgrade']);
+  assert.deepEqual(selfHelp, ['dev', 'feedback', 'module', 'serve', 'status', 'task', 'upgrade']);
+});
+
+test('bongos feedback --help prints its own usage and sends nothing', () => {
+  const r = run('feedback', '--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /bongos feedback "what went wrong"/);
 });
 
 // ---- spawned: the dispatcher answers --help without touching the script ----

package/tests/filing_abuse_matrix.mjs

@@ -405,10 +405,15 @@ await test('[F18] the vector fails CLOSED — forged, absent or unknown never op
       `vector ${JSON.stringify(vector)} must not route`
     );
   }
-  // The allowlist is exactly two members, and both are server-set at their call
+  // The allowlist is exactly three members, and all are server-set at their call
   // site — never read from a request body, which is what makes forging it a
   // non-move rather than a merely-hard one.
-  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs']);
+  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs', 'instance-feedback']);
+  // The hub's feedback relay (task 1004462) names its own vector and never a rank,
+  // so a relayed bug can only ever land at 'backlog'.
+  const feedbackSrc = read('modules/platform-identity/instance-feedback.js');
+  assert.match(feedbackSrc, /vector: 'instance-feedback'/, 'the relay hardcodes its own vector');
+  assert.match(feedbackSrc, /filerRank: null/, 'and files with no rank');
   const routeSrc = read('modules/ideas/routes/inbox.js');
   assert.match(routeSrc, /vector: 'api'/, 'the route hardcodes its own vector');
   assert.ok(!/vector:\s*body\.|vector:\s*req\.body/.test(routeSrc),

package/tests/idea_routing.mjs

@@ -172,7 +172,7 @@ await test('matrix: FAIL-CLOSED — an absent or unrecognised rank never hard-la
 // -------------------------------------------------------------------------
 
 await test('matrix: a homeless BUG from a trusted vector routes, and keeps the rank split', () => {
-  for (const vector of ['api', 'discord-bugs']) {
+  for (const vector of ['api', 'discord-bugs', 'instance-feedback']) {
     assert.deepEqual(
       decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon', vector }),
       { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' },