@bongos/core 1.21.104 → 1.21.105

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.104",
-  "core_contract": "1.21.104",
-  "source_commit": "cfc8c3651ea3f442385e6d0ba405c6a578b4d83a",
+  "core_version": "1.21.105",
+  "core_contract": "1.21.105",
+  "source_commit": "12969410e588a86536f6426de5dcd95390b3be6b",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T13:49:17.283Z",
+  "built_at": "2026-10-09T14:04:06.264Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 592,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3642,
-  "tree_sha256": "b23d12f504071337f2882e99100b69132448daa2e65560c851411b6a667c5f67",
+  "tree_sha256": "10dd1c422b8f42c90e7521862acb305b14d72053ddbe6c75511033ab149b694b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2872,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6e7ad3fddfaca1cfb1dfe79cbdb4a5588007b30eedd458df7212a971da96e324"
+      "sha256": "9e09c3f6c9d01b93d3a0857d2115578a4e2268491278f11656efcf499c20b766"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6832,7 +6832,7 @@
     {
       "path": "modules/lifecycle/check-rollup.js",
       "mode": "0000644",
-      "sha256": "3a69defc4e2157c104c9a95d2b67f4b68053c0a0e049683ddd9eb970d3f69871"
+      "sha256": "9109d29e5fc6739419c6584d4be2990516c2736c398ed8e3b916bb8b4627e0bb"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -6992,7 +6992,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "e52b3d90814272cacce172bccd24f437bac666dcb593b4604d435a5504c18ba7"
+      "sha256": "65386fff8736c1b55c1f105c595758161e718352077603d1ba9aa7dd05d6d1d6"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -10137,12 +10137,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7f4d097ca5d827a3fad698b3e3fbbedc38f7469e29b565cfed34489f4eaab008"
+      "sha256": "967618b349cf51650bbb10bb29c9304205ce8b84b0a61b0f26a84ff6b65751e8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a0fb2f62847ad58e78ec122f44bb7e97281f124bdfd0324c767a50bfe26b5a9e"
+      "sha256": "6312c6a7441ab5c39cb567c6272d4a753edf0e2896a53b6cbb83e8c0713866d9"
     },
     {
       "path": "public-docs/index.html",
@@ -10162,7 +10162,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f65d5a86053502037145a87a3e996ce4ff32c84651d4a8f8afe62c486172ef2d"
+      "sha256": "7a99e0dae60fe796637cc0190ef51e49b0ff707b1a193bdab8b7f9444b953134"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11672,7 +11672,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "e518039d82343b5ff3bb21e1a6e0a5a8e0b9368d05b791be4910d76ea075378e"
+      "sha256": "0b60f062ccf052a0eecb71fff3e0abf3c75cb2399786a286ab54df4091fff787"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -12437,7 +12437,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a00e2f13c266f639d3052f84844f2f38634759e57cfd81830667a9bf1e3e7be7"
+      "sha256": "9f15b0adaa8dea1358b3c6d154c7ff2b378ce4bb7c8ba23c21f611861836aa11"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14092,7 +14092,7 @@
     {
       "path": "tests/github_push_merge_driver.mjs",
       "mode": "0000644",
-      "sha256": "c4783b6e8171f96f4a83520cfc4335a313dbfce4702cccea6972e520d6f08deb"
+      "sha256": "5bf4d9ab391f0e457ec11b47197dd812487098d120f8fbba87dbddf7e23e92b9"
     },
     {
       "path": "tests/github_push_stderr_truncation.mjs",

package/docs/module-api-changelog.md

@@ -3045,5 +3045,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.102 with no explicit bump. run 37936846665. (task 1002620)
   1.21.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.103 with no explicit bump. run 37939497390. (task 1002620)
+  1.21.105 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.104 with no explicit bump. run 37941330141. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/check-rollup.js

@@ -39,4 +39,14 @@ function readCheckRollup(rollup) {
   };
 }
 
-module.exports = { readCheckRollup, UNIT_REPORT_CONTEXT };
+// The conclusions that mean a check really FAILED (task 1004666). One set for both
+// readers: the laptop's ship-land.js (task 1003764) and the server's mergeBlockReason.
+// readCheckRollup maps a status context's state into `conclusion`, so PENDING and
+// EXPECTED (posted but unfinished, or required but not yet reported) land there too —
+// those are waiting, not red. The server reader used to count anything outside
+// SUCCESS/NEUTRAL/SKIPPED as failing, which named a still-running check as the reason
+// a PR was red and sent the publish reconciler after a regen-heal it did not need.
+const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+const isRedCheck = (c) => !!c && RED_CONCLUSIONS.has(String(c.conclusion || '').toUpperCase());
+
+module.exports = { readCheckRollup, UNIT_REPORT_CONTEXT, RED_CONCLUSIONS, isRedCheck };

package/modules/lifecycle/github-push.js

@@ -40,7 +40,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { promisify } = require('node:util');
 const { repoInfo, userAgent } = require('../../src/module-api');
-const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('./check-rollup');
+const { readCheckRollup, UNIT_REPORT_CONTEXT, isRedCheck } = require('./check-rollup'); // isRedCheck: only a FAILED check is red, never a pending one (task 1004666)
 const { loadRepoInfo } = repoInfo;
 
 const execFileP = promisify(execFile);
@@ -951,10 +951,6 @@ async function getMergeState({ branch }, deps = {}) {
   };
 }
 
-// A non-passing check conclusion (everything that isn't a clean success/skip).
-const _BAD_CHECK = (c) =>
-  c.conclusion && !['SUCCESS', 'NEUTRAL', 'SKIPPED'].includes(String(c.conclusion).toUpperCase());
-
 // Human-readable reason a not-yet-merged PR isn't mergeable, surfaced to a
 // credential-less session so it reports the truth instead of guessing.
 function mergeBlockReason(s) {
@@ -967,7 +963,7 @@ function mergeBlockReason(s) {
   if (s.review_decision === 'CHANGES_REQUESTED') return 'changes_requested';
   if (s.review_decision === 'REVIEW_REQUIRED') return 'review_required';
   if (s.merge_state === 'BLOCKED') {
-    const bad = s.checks.filter(_BAD_CHECK);
+    const bad = s.checks.filter(isRedCheck);
     if (bad.length) return `failing_check:${bad[0].name}`;
     // Red, and the failing check is one of the nulled nodes: say the list is blind
     // rather than guess "review or pending", which sent a ship retrying (task 1003988).
@@ -975,7 +971,7 @@ function mergeBlockReason(s) {
     return 'blocked_required_review_or_pending_check';
   }
   if (s.merge_state === 'UNSTABLE') {
-    const bad = s.checks.filter(_BAD_CHECK);
+    const bad = s.checks.filter(isRedCheck);
     return bad.length ? `non_required_check_failing:${bad[0].name}` : 'non_required_check_pending';
   }
   if (s.mergeable === 'UNKNOWN' || s.merge_state === 'UNKNOWN' || s.merge_state == null) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.104",
+  "version": "1.21.105",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.104",
+      "version": "1.21.105",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.104",
+  "version": "1.21.105",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9470,5 +9470,11 @@
       "id": "1004665",
       "text": "When a builder re-runs a review and attaches a screenshot, the screenshot now actually gets attached to the task. Before, it was quietly thrown away, so reviewers asking for a picture never saw one unless someone added it by h"
     }
+  ],
+  "1.21.105": [
+    {
+      "id": "1004666",
+      "text": "A check that is still running is no longer reported as a failed one. Before, a project whose test service posts a \"still working\" status would see its change called broken and trigger a pointless repair attempt; now it is corr"
+    }
   ]
 }

package/scripts/gds/ship-land.js

@@ -18,7 +18,7 @@ const { normalizeApiError } = require('./ship-io.js');
 const { plainCardLines } = require('./plain-cards.js');
 // The server's own reader of a PR's check rollup (task 1003988), reused so the laptop
 // poll names a red PR exactly the way publish-status does (task 1003764). Dependency-free.
-const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('../../modules/lifecycle/check-rollup.js');
+const { readCheckRollup, UNIT_REPORT_CONTEXT, RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js');
 const { prMergeSentence } = require('../../modules/lifecycle/page-tweak-hold.js');
 
 // ---------- the land outcome (task 1002541, part 1) ----------
@@ -474,7 +474,7 @@ function redBlocksMerge(md) {
 // A check conclusion (CheckRun) or state (status context) that means FAILED. Pending and
 // expected are waiting, not red — reporting them as failures would be the mirror image of
 // the bug this names (a failure dressed as waiting).
-const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+// The set itself lives in check-rollup.js, shared with the server's mergeBlockReason (task 1004666).
 
 // localMergeDriver — task 1003764. The laptop path watches its PR with the builder's own
 // gh, and read only state + mergeCommit, so a red required check was invisible for the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.104'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.105'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_push_merge_driver.mjs

@@ -12,6 +12,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const gh = require('../modules/lifecycle/github-push.js');
@@ -169,6 +170,51 @@ test('mergeBlockReason maps the common blocker states', () => {
   assert.equal(gh.mergeBlockReason({ ...open, merged: true }), null);
 });
 
+// --- task 1004666: a check still running is waiting, not red --------------
+//
+// check-rollup maps a status context's state into `conclusion`, so PENDING and
+// EXPECTED (posted but unfinished, or required but not yet reported) reached
+// mergeBlockReason as conclusions. It counted anything outside SUCCESS/NEUTRAL/
+// SKIPPED as failing, so a BLOCKED PR waiting on a third-party status read
+// "failing_check:<context>" and the reconciler tried a regen-heal on it.
+
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, description: null });
+
+test('1004666 a PENDING or EXPECTED status context on a BLOCKED PR reads as waiting', async () => {
+  for (const state of ['PENDING', 'EXPECTED']) {
+    const { fetchImpl } = mkFetch({ node: prNode({ mergeStateStatus: 'BLOCKED', rollup: 'PENDING', checks: [TRUST, ctx('ci/external', state)] }) });
+    const r = await gh.mergeIfGreen({ branch: 'claude/wt' }, DEPS(fetchImpl));
+    assert.equal(r.reason, 'blocked_required_review_or_pending_check', `${state} is not a failure`);
+  }
+});
+
+test('1004666 on an UNSTABLE PR a pending optional check is pending, not failing', () => {
+  const open = { pr_state: 'open', merged: false };
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'PENDING' }] }), 'non_required_check_pending');
+  assert.equal(gh.mergeBlockReason({ ...open, merge_state: 'UNSTABLE', checks: [{ name: 'e2e', conclusion: 'TIMED_OUT' }] }), 'non_required_check_failing:e2e');
+});
+
+test('1004666 every red conclusion still names its check, past a pending one', () => {
+  for (const state of ['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']) {
+    const open = { pr_state: 'open', merged: false, merge_state: 'BLOCKED' };
+    assert.equal(gh.mergeBlockReason({ ...open, checks: [{ name: 'ci/external', conclusion: 'PENDING' }, { name: 'unit', conclusion: state }] }), 'failing_check:unit', state);
+  }
+});
+
+test('1004666 the server and the laptop read red from ONE set', () => {
+  const rollup = require('../modules/lifecycle/check-rollup.js');
+  const land = fs.readFileSync(new URL('../scripts/gds/ship-land.js', import.meta.url), 'utf8');
+  const push = fs.readFileSync(new URL('../modules/lifecycle/github-push.js', import.meta.url), 'utf8');
+  assert.ok(land.includes("RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js')"), 'ship-land imports the shared set');
+  assert.doesNotMatch(land, /const RED_CONCLUSIONS\s*=/, 'and no longer declares its own');
+  assert.doesNotMatch(push, /_BAD_CHECK|'SUCCESS', 'NEUTRAL', 'SKIPPED'/, 'the old allow-list reading is gone');
+  for (const c of ['PENDING', 'EXPECTED', 'SUCCESS', 'NEUTRAL', 'SKIPPED', 'STALE', null, undefined]) {
+    assert.equal(rollup.isRedCheck({ conclusion: c }), false, String(c));
+  }
+  assert.equal(rollup.isRedCheck({ conclusion: 'failure' }), true, 'case-insensitive like the old reader');
+  assert.equal(rollup.isRedCheck(null), false);
+});
+
 // --- task 1003988: a red PR names what failed, or says it cannot see -------
 //
 // Without Checks:read GitHub nulls every CheckRun node and keeps the rollup state,