@bongos/core 1.21.123 → 1.21.124

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.123",
-  "core_contract": "1.21.123",
-  "source_commit": "bfe95a4e390577d4579a3da16d81d5ada6bc8b9a",
+  "core_version": "1.21.124",
+  "core_contract": "1.21.124",
+  "source_commit": "695a6d5cad41a0d7a9e79cf58a7de3282b64daf3",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T19:30:01.919Z",
+  "built_at": "2026-10-14T19:49:05.130Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 605,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3122,
+    "functional_verbatim": 3124,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3756,
-  "tree_sha256": "c5becc4dfe0e822803424a46f1041b66adce70cbe65f85be941603de3db80cee",
+  "file_count": 3758,
+  "tree_sha256": "97c9a1a6dc5c913bdacb02a6bbef3bef853e5babbbd971cd4f097403aa754be9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f2b2bf656d2fa819a7bd0f10ceb966b5414c1c06f05f2e8ccaa9ed326a7227ed"
+      "sha256": "1ead6d6c8697d53d3f324f3d5c1523f5c590ebcce268abcb2b29a367d6c34f17"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7242,7 +7242,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "65386fff8736c1b55c1f105c595758161e718352077603d1ba9aa7dd05d6d1d6"
+      "sha256": "b15eb0c36f0acb41d11f52393ca9696de55b9326a483de02624b3a4d5e87250c"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -7349,6 +7349,11 @@
       "mode": "0000644",
       "sha256": "69e9bf495dfdbc324e7f5664e09a5ad30e6eac896c12656b7d6ecb38d6be81f9"
     },
+    {
+      "path": "modules/lifecycle/local-land-proof.js",
+      "mode": "0000644",
+      "sha256": "7698b11de1978c29c1744032da5b28831a1f6823b905d60c8be8ac469916d46a"
+    },
     {
       "path": "modules/lifecycle/matter-acts.js",
       "mode": "0000644",
@@ -7507,7 +7512,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "5d8bf02c3646f12debc411aa6291110c5bc4f1fe8917af9e17a4ecc5f6451e76"
+      "sha256": "d03c36a2b3e50bb2334db66d177514542185a7277873891ee6d3a99c5ad10464"
     },
     {
       "path": "modules/lifecycle/removal-derivation.js",
@@ -10467,12 +10472,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e92fbdef629a9283a773d94986531ae9d30412fe05dc3012dd918be8fb859030"
+      "sha256": "31a3c967bca985d1dc5007279f9ed7e9352b0466128af6edd9debbf4e7b592bb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cf96b6c94e06d4306f0b3e3c0626c051729a0498bd3e6760012ce86350286d16"
+      "sha256": "4714b7161307f36c4ae4322e72f3670f6d958b1ab3b19f728a3f05f880898771"
     },
     {
       "path": "public-docs/index.html",
@@ -10492,7 +10497,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "86c4edcb22bf8005ac7f4e479a9b4037d2bdad36618ed1e8f739a3a786952344"
+      "sha256": "aeb72646e01f775fe09e570e0f5e8dccf9733fc59cb79d5a67e6315f2195d88c"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12812,7 +12817,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "01bc6b541cf12105be05701170377582f537316fe3f70fdea2681bae07864bf7"
+      "sha256": "792dad669f6c0d0b86433d206c837ca7ffcbf6a8b5b7c02bda8707c3dd3f7099"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16109,6 +16114,11 @@
       "mode": "0000644",
       "sha256": "64f8bd94dc461ca9b4ef82fae929d49675231afa6a24d6d65ba2dbe8721efc89"
     },
+    {
+      "path": "tests/local_land_proof.mjs",
+      "mode": "0000644",
+      "sha256": "0a7825f1e35c7251c66ab986555b71728575d3dff8be95f8a017dd66190d186f"
+    },
     {
       "path": "tests/local_preview.mjs",
       "mode": "0000644",
@@ -17342,7 +17352,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fac182001ce8a53bafea2d59661d2879c2ccbac55600936d151d1fe86ca59b71"
+      "sha256": "882dfd49bebd89bed3c2bb20d0bf78e5f7b4da45e525492e8742b43f9c4e19a9"
     },
     {
       "path": "tests/publish_status_branch.mjs",

package/docs/module-api-changelog.md

@@ -3083,5 +3083,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.121 with no explicit bump. run 38620147259. (task 1002620)
   1.21.123 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.122 with no explicit bump. run 38624070870. (task 1002620)
+  1.21.124 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.123 with no explicit bump. run 38626749089. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/github-push.js

@@ -1194,7 +1194,8 @@ async function landProvenForTask({ taskId, publishedSha, status }, deps = {}) {
 async function isAncestorOfDefaultBranch({ sha, base = 'main' } = {}, deps = {}) {
   if (typeof sha !== 'string' || !SAFE_SHA_RE.test(sha)) return false;
   const token = await resolveToken(deps);
-  if (!token) throw err('PUSH_UNCONFIGURED');
+  // task 1004633: no credential (a laptop-mode instance) → ask the instance's own checkout.
+  if (!token) return (deps.localLandProof || require('./local-land-proof')).isOnOriginMain({ sha, base }, deps.local || {});
   const repoInfo = deps.repoInfo || loadRepoInfo();
   if (!repoInfo || repoInfo.error) throw err('NO_REPO_INFO');
   const { owner, repo } = repoInfo;

package/modules/lifecycle/local-land-proof.js

@@ -0,0 +1,126 @@
+'use strict';
+
+// local-land-proof — prove a land from the instance's OWN git checkout when the
+// server holds no GitHub credential (task 1004633).
+//
+// WHY. Every land proof the lifecycle had asked GitHub: isAncestorOfDefaultBranch
+// runs the compare API, and the publish reconciler returned early when
+// isConfigured() was false. A laptop-mode instance (the owner's mercury project)
+// merges a ship LOCALLY and pushes main itself — no PR, no server credential. So
+// POST /tasks/:id/ship refused `ship_land_not_proven` (the compare threw
+// PUSH_UNCONFIGURED, swallowed as "no proof"), the sweep never ran, and task 48
+// sat at 'confirmed' with its merge commit on origin/main.
+//
+// THE PROOF is the same one the GitHub path makes, asked of a different witness:
+// is the claim's recorded tip (claims.published_head_sha, written by attest-gate
+// before its own credential check) an ancestor of origin/<base>? The witness is
+// the remote-tracking ref after a fetch, never the local branch: a laptop ship
+// merges into local main BEFORE it pushes, and a merge whose push failed must not
+// count. A failed fetch (offline) falls back to the last fetched ref, which can
+// only be behind the truth, so it can delay a ship but never invent one.
+//
+// Pure w.r.t. an injected `git` runner, so it unit-tests with no repository.
+
+const { execFile } = require('node:child_process');
+const { promisify } = require('node:util');
+
+const execFileP = promisify(execFile);
+
+// A real commit sha only: `merge-base` resolves refs, so "HEAD" or a branch name
+// would answer about something other than the claim's tip.
+const SAFE_SHA_RE = /^[0-9a-f]{7,64}$/;
+const SAFE_BASE_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,100}$/;
+
+function defaultGit(root) {
+  return (args) => execFileP('git', args, { cwd: root, timeout: 60_000, windowsHide: true });
+}
+
+function resolveRoot(deps) {
+  if (deps.root) return deps.root;
+  return require('../../src/module-api').resolveInstanceRoot();
+}
+
+async function fetchOrigin(git, base) {
+  try {
+    await git(['fetch', '--quiet', 'origin', base]);
+  } catch (_) {
+    /* offline or no credential: the last fetched origin ref still answers, only later */
+  }
+}
+
+// true = the tip is in origin/<base>; false = it is not (or git does not know the
+// commit). Throws LOCAL_PROOF_UNAVAILABLE when there is no usable checkout (git
+// missing, not a repository) so a caller can tell "not landed" from "cannot say".
+async function isOnOriginMain({ sha, base = 'main' } = {}, deps = {}) {
+  if (typeof sha !== 'string' || !SAFE_SHA_RE.test(sha)) return false;
+  if (typeof base !== 'string' || !SAFE_BASE_RE.test(base) || base.includes('..')) return false;
+  const git = deps.git || defaultGit(resolveRoot(deps));
+  if (!deps.fetched) await fetchOrigin(git, base);
+  try {
+    await git(['merge-base', '--is-ancestor', sha, `refs/remotes/origin/${base}`]);
+    return true;
+  } catch (e) {
+    // 1 = not an ancestor; 128 = an unknown commit (never reached origin).
+    if (e && (e.code === 1 || e.code === 128)) return false;
+    const out = new Error('LOCAL_PROOF_UNAVAILABLE');
+    out.code = 'LOCAL_PROOF_UNAVAILABLE';
+    out.cause = e;
+    throw out;
+  }
+}
+
+// The reconciler's sweep for a host with no GitHub credential. Tip proof only: no
+// PR, branch or deploy probe exists to consult, and a row with no recorded tip
+// has nothing local to prove, so it waits (strand-watch reports it).
+// One root and one fetch per sweep, not per row: origin/main is the same ref for
+// every confirmed task the sweep reads.
+async function sweepByLocalProof(rows, { db, emit, log = console.log, error = console.error, proof } = {}) {
+  if (!proof) {
+    let shared = null;
+    proof = async ({ sha }) => {
+      if (!shared) {
+        shared = { git: defaultGit(resolveRoot({})), fetched: true };
+        await fetchOrigin(shared.git, 'main');
+      }
+      return isOnOriginMain({ sha }, shared);
+    };
+  }
+  let checked = 0;
+  let reconciled = 0;
+  let errors = 0;
+  for (const r of rows || []) {
+    const tip = r && r.published_head_sha;
+    if (!tip || !SAFE_SHA_RE.test(String(tip))) continue;
+    checked++;
+    let landed = false;
+    try {
+      landed = await proof({ sha: String(tip) });
+    } catch (e) {
+      errors++;
+      error(`[publish-reconciler] task ${r.task_id}: local land proof unavailable: ${e && e.message}`);
+      continue;
+    }
+    if (!landed) continue;
+    const reason = `published tip ${String(tip).slice(0, 8)} in origin/main (local checkout; no GitHub credential)`;
+    try {
+      const shipped = await db.shipTask({
+        taskId: r.task_id,
+        builderId: r.builder_id,
+        landAssurance: { kind: 'proof', reason },
+      });
+      reconciled++;
+      log(`[publish-reconciler] task ${r.task_id} (${reason}) landed → shipped`);
+      try { await emit('task.shipped', shipped); } catch (e) {
+        error(`[publish-reconciler] ship broadcast for task ${r.task_id} (non-blocking): ${e && e.message}`);
+      }
+    } catch (e) {
+      if (!e || e.code !== 'TASK_NOT_CONFIRMED') {
+        errors++;
+        error(`[publish-reconciler] shipTask ${r.task_id} failed: ${e && e.message}`);
+      }
+    }
+  }
+  return { checked, reconciled, errors };
+}
+
+module.exports = { isOnOriginMain, sweepByLocalProof, SAFE_SHA_RE };

package/modules/lifecycle/publish-reconciler.js

@@ -76,6 +76,7 @@
 const githubPush = require('./github-push');
 const seams = require('../../src/module-api');
 const conflictResolve = require('./conflict-resolve');
+const localLandProof = require('./local-land-proof'); // task 1004633
 // The claim gate's grace for a strand its builder may be unable to clear — imported
 // rather than restated so the sweep's escalation and the gate agree on one number
 // (task 1003294).
@@ -195,10 +196,22 @@ async function runSweep(deps = {}) {
     if (!warn.unconfigured) {
       warn.unconfigured = true;
       errFn(
-        `[publish-reconciler] WARN ${describeTarget({ configured: false, repo: resolveTarget(deps) })} — confirmed→shipped can NEVER land until a credential is set (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY — installation id is auto-discovered — or GITHUB_PUSH_TOKEN). Subsequent sweeps stay quiet until this changes.`
+        `[publish-reconciler] WARN ${describeTarget({ configured: false, repo: resolveTarget(deps) })} — no GitHub credential (GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY — installation id is auto-discovered — or GITHUB_PUSH_TOKEN): confirmed→shipped lands only on a recorded tip this instance's own checkout finds in origin/main. Subsequent sweeps stay quiet until this changes.`
       );
     }
-    return { skipped: 'unconfigured', checked: 0, reconciled: 0, merged: 0, resolvedConflicts: 0, errors: 0, strandsFlagged: 0 };
+    // task 1004633: a laptop-mode instance merges and pushes main itself, with no
+    // server credential. Returning here stranded its merged tasks at 'confirmed'
+    // forever (mercury task 48), so prove the recorded tip from the local checkout.
+    const local = deps.localLandProof || localLandProof;
+    let rows = [];
+    try {
+      rows = await db.listConfirmedTasksForReconcile({ limit: deps.limit || SWEEP_LIMIT });
+    } catch (e) {
+      errFn(`[publish-reconciler] could not list confirmed tasks: ${e && e.message}`);
+      return { skipped: 'unconfigured', checked: 0, reconciled: 0, merged: 0, resolvedConflicts: 0, errors: 1, strandsFlagged: 0 };
+    }
+    const swept = await local.sweepByLocalProof(rows, { db, emit, log: logFn, error: errFn });
+    return { skipped: 'unconfigured', checked: swept.checked, reconciled: swept.reconciled, merged: 0, resolvedConflicts: 0, errors: swept.errors, strandsFlagged: 0 };
   }
   warn.unconfigured = false; // re-arm: a later credential LOSS must warn again
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.123",
+  "version": "1.21.124",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.123",
+      "version": "1.21.124",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.123",
+  "version": "1.21.124",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9720,5 +9720,11 @@
       "id": "1004631",
       "text": "Found why the AI refused to ship on Windows projects: the core update failed on Windows, so projects never got the permission that lets the AI run a ship. That is fixed. New projects also tell the AI to ship on its own in Auto"
     }
+  ],
+  "1.21.124": [
+    {
+      "id": "1004633",
+      "text": "Found why a merged task on your own project stayed at 'confirmed': with no GitHub key set up on the project's server, Bongos could not prove the merge happened, and its background checker switched itself off. It now confirms t"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.123'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.124'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/local_land_proof.mjs

@@ -0,0 +1,173 @@
+// tests/local_land_proof.mjs
+//
+// task 1004633 — a merged task on an instance with no GitHub credential becomes
+// 'shipped'. The owner's mercury project merged task 48 locally and pushed main;
+// with no server credential the ship route refused (the compare API threw
+// PUSH_UNCONFIGURED) and the reconciler returned early, so the task sat at
+// 'confirmed' with its merge on origin/main. These pin the three halves of the fix:
+//   1. isOnOriginMain proves a tip against a REAL repository's origin ref, and a
+//      merge that never reached origin does not count;
+//   2. landProvenForTask falls back to it when there is no token;
+//   3. the unconfigured reconciler sweep ships a proven row, and only that row.
+//
+// Run:  node tests/local_land_proof.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const local = require('../modules/lifecycle/local-land-proof.js');
+const gh = require('../modules/lifecycle/github-push.js');
+const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try {
+    await fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}\n       ${err && err.stack}`);
+  }
+}
+
+const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+
+// A bare origin plus a clone, the shape of a laptop-mode instance checkout.
+function mkRepo() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'local-land-proof-'));
+  const origin = path.join(dir, 'origin.git');
+  const work = path.join(dir, 'work');
+  git(dir, 'init', '--quiet', '--bare', '-b', 'main', origin);
+  git(dir, 'clone', '--quiet', origin, work);
+  git(work, 'config', 'user.email', 't@example.com');
+  git(work, 'config', 'user.name', 't');
+  git(work, 'checkout', '--quiet', '-b', 'main');
+  fs.writeFileSync(path.join(work, 'a.txt'), 'a\n');
+  git(work, 'add', 'a.txt');
+  git(work, 'commit', '--quiet', '-m', 'base');
+  git(work, 'push', '--quiet', 'origin', 'main');
+  return { dir, work };
+}
+
+function commit(work, file) {
+  fs.writeFileSync(path.join(work, file), `${file}\n`);
+  git(work, 'add', file);
+  git(work, 'commit', '--quiet', '-m', file);
+  return git(work, 'rev-parse', 'HEAD');
+}
+
+await test('a tip merged and pushed to origin/main is proven', async () => {
+  const { dir, work } = mkRepo();
+  try {
+    git(work, 'checkout', '--quiet', '-b', 'task-48');
+    const tip = commit(work, 'b.txt');
+    git(work, 'checkout', '--quiet', 'main');
+    git(work, 'merge', '--quiet', '--no-ff', '-m', 'Merge task-48: (no value summary)', 'task-48');
+    git(work, 'push', '--quiet', 'origin', 'main');
+    assert.equal(await local.isOnOriginMain({ sha: tip }, { root: work }), true);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+await test('a merge into local main that never reached origin is NOT proven', async () => {
+  const { dir, work } = mkRepo();
+  try {
+    const tip = commit(work, 'c.txt'); // on local main, unpushed
+    assert.equal(await local.isOnOriginMain({ sha: tip }, { root: work }), false);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+await test('an unknown commit or a ref-shaped value is not proven', async () => {
+  const { dir, work } = mkRepo();
+  try {
+    assert.equal(await local.isOnOriginMain({ sha: 'c'.repeat(40) }, { root: work }), false);
+    assert.equal(await local.isOnOriginMain({ sha: 'HEAD' }, { root: work }), false, 'a ref must never resolve');
+    assert.equal(await local.isOnOriginMain({ sha: 'a'.repeat(40), base: '../x' }, { root: work }), false);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+await test('no usable checkout throws LOCAL_PROOF_UNAVAILABLE, never a silent false', async () => {
+  const broken = async () => { const e = new Error('spawn git ENOENT'); e.code = 'ENOENT'; throw e; };
+  await assert.rejects(
+    local.isOnOriginMain({ sha: 'a'.repeat(40) }, { git: broken }),
+    (e) => e.code === 'LOCAL_PROOF_UNAVAILABLE'
+  );
+});
+
+await test('a caller that already fetched (the sweep) is not made to fetch again per row', async () => {
+  const calls = [];
+  const fake = async (args) => { calls.push(args[0]); };
+  await local.isOnOriginMain({ sha: 'a'.repeat(40) }, { git: fake });
+  await local.isOnOriginMain({ sha: 'b'.repeat(40) }, { git: fake, fetched: true });
+  await local.isOnOriginMain({ sha: 'c'.repeat(40) }, { git: fake, fetched: true });
+  assert.deepEqual(calls, ['fetch', 'merge-base', 'merge-base', 'merge-base']);
+});
+
+await test('landProvenForTask with no credential proves the tip from the local checkout', async () => {
+  const saved = { t: process.env.GITHUB_PUSH_TOKEN, a: process.env.GITHUB_APP_ID, k: process.env.GITHUB_APP_PRIVATE_KEY };
+  delete process.env.GITHUB_PUSH_TOKEN; delete process.env.GITHUB_APP_ID; delete process.env.GITHUB_APP_PRIVATE_KEY;
+  try {
+    const asked = [];
+    const localLandProof = { isOnOriginMain: async ({ sha }) => { asked.push(sha); return sha === 'a'.repeat(40); } };
+    const yes = await gh.landProvenForTask({ taskId: 48, publishedSha: 'a'.repeat(40), status: null }, { localLandProof });
+    assert.equal(yes.proven, true);
+    const no = await gh.landProvenForTask({ taskId: 49, publishedSha: 'b'.repeat(40), status: null }, { localLandProof });
+    assert.equal(no.proven, false);
+    assert.deepEqual(asked, ['a'.repeat(40), 'b'.repeat(40)]);
+  } finally {
+    for (const [k, v] of [['GITHUB_PUSH_TOKEN', saved.t], ['GITHUB_APP_ID', saved.a], ['GITHUB_APP_PRIVATE_KEY', saved.k]]) {
+      if (v === undefined) delete process.env[k]; else process.env[k] = v;
+    }
+  }
+});
+
+await test('the unconfigured sweep ships a proven tip — and only that row', async () => {
+  const PROVEN = 'a'.repeat(40);
+  const shipped = [];
+  const events = [];
+  const rows = [
+    { task_id: 48, builder_id: 7, worktree_name: 'task-48', published_head_sha: PROVEN },
+    { task_id: 49, builder_id: 7, worktree_name: 'task-49', published_head_sha: 'b'.repeat(40) },
+    { task_id: 50, builder_id: 7, worktree_name: 'task-50', published_head_sha: null },
+  ];
+  const r = await reconciler.runSweep({
+    db: {
+      listConfirmedTasksForReconcile: async () => rows,
+      shipTask: async (a) => { shipped.push(a); return { id: a.taskId }; },
+    },
+    githubPush: { isConfigured: () => false },
+    localLandProof: {
+      sweepByLocalProof: (rs, o) => local.sweepByLocalProof(rs, { ...o, proof: async ({ sha }) => sha === PROVEN }),
+    },
+    emit: async (name, t) => { events.push([name, t.id]); },
+    log: () => {},
+    error: () => {},
+  });
+  assert.equal(r.skipped, 'unconfigured');
+  assert.equal(r.reconciled, 1);
+  assert.equal(r.checked, 2, 'the row with no tip has nothing local to prove');
+  assert.deepEqual(shipped.map((s) => s.taskId), [48]);
+  assert.equal(shipped[0].landAssurance.kind, 'proof');
+  assert.deepEqual(events, [['task.shipped', 48]]);
+});
+
+await test('a sweep racing another flip is not an error (TASK_NOT_CONFIRMED)', async () => {
+  const r = await local.sweepByLocalProof(
+    [{ task_id: 48, builder_id: 7, published_head_sha: 'a'.repeat(40) }],
+    {
+      db: { shipTask: async () => { const e = new Error('x'); e.code = 'TASK_NOT_CONFIRMED'; throw e; } },
+      emit: async () => {}, log: () => {}, error: () => {},
+      proof: async () => true,
+    }
+  );
+  assert.deepEqual(r, { checked: 1, reconciled: 0, errors: 0 });
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/publish_reconciler.mjs

@@ -205,7 +205,9 @@ function mkDeps({
 
 // ---------------------------------------------------------------------------
 
-test('no push credential → no-op (skipped: unconfigured), never touches the DB', async () => {
+// task 1004633: an unconfigured sweep now reads the confirmed rows (to prove a recorded tip
+// from the local checkout), but a row with no tip still ships nothing and GitHub is never asked.
+test('no push credential → skipped: unconfigured; a row with no tip ships nothing, GitHub never called', async () => {
   const deps = mkDeps({ configured: false, rows: [{ task_id: 1, builder_id: 9, worktree_name: 'wt' }] });
   const r = await reconciler.runSweep(deps);
   assert.equal(r.skipped, 'unconfigured');