@bongos/core 1.21.176 → 1.21.178

package/modules/lifecycle/routes/gate-approvals.js

@@ -1,299 +0,0 @@
-// src/bongos/routes/gate-approvals.js — Archon gate-surface PR approval from the hall
-// (task 1179, ADR 0058 amendment).
-//
-// WHY. The gate-review CI check (ADR 0058) clears an ESCALATE (hard floor) ONLY on
-// an owner approval, and a NEEDS_TRUST without a Metic+ author likewise blocks until
-// the owner approves. Historically that owner approval was a GitHub APPROVED review
-// by the repo owner on the head sha — i.e. the owner had to leave a GitHub/terminal review.
-// This router gives Archons a browser-only equivalent (feedback: auth flows must be
-// UI-first), trust-consistent with the existing server-set `gate-author-trust`
-// status: the server re-checks the caller's Archon rank server-side (ADR 0016) and
-// sets a `gate-owner-approved` commit status that the gate-review workflow honors as
-// owner approval. A PR author cannot forge it (only the server holds the credential).
-//
-//   GET  /gate-approvals               — open PRs whose gate-review check is red,
-//                                         with the verdict + per-file reasons (Archon)
-//   POST /gate-approvals/:pr/approve    — record owner approval + re-run the check (Archon)
-//
-// The list's "is this awaiting approval" signal is the LIVE gate-review check
-// conclusion (authoritative), not a re-derivation; classifyChanges() is reused only
-// to render WHY each PR escalated, so the hall shows exactly the CI reasoning.
-
-const express = require('express');
-// Intra-module + the published doorway — a module never requires a core internal.
-const api = require('../../../src/module-api');
-const auth = api;
-const githubPush = require('../github-push');
-// The page-tweak hold (task 1004323 / BV2.TW12, ADR 0341 D7): the approve below
-// re-arms auto-merge on the reopened PR, and a page tweak held for its artist must
-// never be armed from here. Called through the module object so tests can stub it.
-const pageTweakReads = require('../page-tweak-reads');
-
-// Would POST /gate-approvals/:pr/approve let this viewer through? The same two
-// checks it mounts, read for the list (task 1004829): the hall draws a held PR as
-// an ask card only on true, so a Metic who may read the gate never sees an Approve
-// the route would refuse. Fail-closed like requirePermission: no government port,
-// or one that throws, is false; an absent act-alone check passes, as the
-// requireActAlone gate does.
-async function viewerMayApprove(builderId) {
-  try {
-    const government = api.resolveOptional('government');
-    if (!government || typeof government.builderHasPermissions !== 'function') return false;
-    if (!(await government.builderHasPermissions(Number(builderId), ['gate_approval.decide']))) return false;
-    if (typeof government.checkActAlone !== 'function') return true;
-    const out = await government.checkActAlone('release', builderId);
-    return !!(out && out.ok === true);
-  } catch {
-    // authority that cannot be established is a denial (ADR 0016); the list still answers
-    return false;
-  }
-}
-const { HELD_NOT_ARMED } = require('../page-tweak-hold');
-const { parseId } = api;
-// The SAME pure classifier the CI gate runs — reused (never duplicated) so the hall
-// shows identical verdict + reasons. Safe to require: gate-review.js guards its CLI
-// entrypoint behind `require.main === module`, so importing it runs no side effects.
-const { classifyChanges, resolveAction } = require('../../../scripts/bongos/gate-review');
-
-// Pull a GDS task id out of a server-published PR's title ("task 1163: …") or body
-// ("… for task 1163."). Returns a number or null. Display-only.
-function taskIdFromPr(pr) {
-  const hay = `${pr.title || ''}\n${pr.body || ''}`;
-  const m = /\btask\s+(\d{1,7})\b/i.exec(hay);
-  return m ? Number(m[1]) : null;
-}
-
-// Find a named check/status in the head-commit rollup (CheckRun.name or
-// StatusContext.context — listOpenPullRequests flattens both to `name`).
-function findCheck(pr, name) {
-  return (pr.checks || []).find((c) => c.name === name) || null;
-}
-const isSuccess = (c) => c && String(c.conclusion || '').toUpperCase() === 'SUCCESS';
-const isFailure = (c) => c && String(c.conclusion || '').toUpperCase() === 'FAILURE';
-
-// Run the pure classifier over a PR's changed files to produce the display verdict +
-// reasons. blobAt returns null (no file content fetched): the path-level hard-floor /
-// sensitive-surface rules — which produce the human reasons — do not need content;
-// the content-only AUTO-narrowing certifications fail-closed to a stricter verdict,
-// which is the safe direction for a read-only "why is this stuck" view.
-function summarizeGate(files) {
-  const r = classifyChanges({ files, blobAt: () => null, diffBytes: 0 });
-  const reasons = [
-    ...(r.escalations || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: true })),
-    ...(r.needsTrust || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: false })),
-  ];
-  return { verdict: r.verdict, reasons, surfaces: r.surfaces || [] };
-}
-
-// The awaiting list itself: open, non-draft PRs whose gate-review check is
-// COMPLETED and red, each with its verdict and reasons. Shared by GET
-// /gate-approvals and the governor's docket (task 1004523), so the two can never
-// disagree about what is waiting. `withFiles: false` skips the per-PR file read
-// (the docket needs only the count and the titles, not the per-file reasons).
-async function listAwaitingGateApprovals({ withFiles = true } = {}) {
-  const prs = await githubPush.listOpenPullRequests({});
-  const awaiting = [];
-  let checking = 0;
-  for (const pr of prs) {
-    if (pr.is_draft) continue;
-    const gate = findCheck(pr, 'gate-review');
-    if (!gate) continue; // not a gate-reviewed PR (or it hasn't run yet)
-    if (String(gate.status || '').toUpperCase() !== 'COMPLETED') { checking += 1; continue; }
-    if (!isFailure(gate)) continue; // green/neutral → not awaiting
-    // gate-review is red → blocked awaiting trust/owner approval. Render WHY.
-    let summary = { verdict: 'unknown', reasons: [], surfaces: [], files: [] };
-    if (withFiles) {
-      try {
-        const files = await githubPush.getPullRequestFiles({ number: pr.number });
-        summary = summarizeGate(files);
-        summary.files = files.map((f) => ({ path: f.path, status: f.status }));
-      } catch (_) {
-        summary.files = [];
-      }
-    }
-    awaiting.push({
-      number: pr.number,
-      title: pr.title,
-      url: pr.url,
-      task: taskIdFromPr(pr),
-      author: pr.author,
-      head_sha: pr.head_sha,
-      verdict: summary.verdict,
-      reasons: summary.reasons,
-      files: summary.files,
-      author_trusted: isSuccess(findCheck(pr, 'gate-author-trust')),
-      already_approved: isSuccess(findCheck(pr, githubPush.GATE_OWNER_APPROVED_CONTEXT)),
-      gate_review_url: gate.url || null,
-    });
-  }
-  return { prs, awaiting, checking };
-}
-
-// The governor's docket (task 1004523): a PR held at the gate stands at Release,
-// shown only to a viewer holding `gate_approval.read` (this list route's own atom)
-// and needing only a viewer who may clear it (`gate_approval.decide`). An
-// unconfigured server credential is a read error, so the docket reports the
-// source `unavailable` rather than an empty, falsely calm Release.
-function contributeGateApprovalsToDocket() {
-  api.contribute('governor.docket', {
-    source: 'gate_approvals',
-    building: 'release',
-    gate: { permission: 'gate_approval.read' },
-    read: async (ctx) => {
-      if (!githubPush.isConfigured()) throw new Error('publish_unconfigured');
-      const { awaiting } = await listAwaitingGateApprovals({ withFiles: false });
-      const mayDecide = ctx.has('gate_approval.decide');
-      return awaiting.filter((pr) => !pr.already_approved).map((pr) => ({
-        id: pr.number,
-        rule: 'decide',
-        state: mayDecide ? 'needs' : 'moving',
-        title: pr.title || `Pull request ${pr.number}`,
-        short: 'held at the gate',
-        where: 'release · held at the gate',
-        opened_at: null,
-        deadline: null,
-        proposer: pr.author ? { login: pr.author } : null,
-        tally: null,
-        href: '/gate',
-        ref: { type: 'pull_request', id: pr.number },
-      }));
-    },
-  });
-}
-
-// The approval itself, shared by the route above and a passed Release matter
-// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
-// { ok: true, body } or { ok: false, code, status, message }; throws on an
-// unexpected failure (the caller says it). `login` is who approved, as the
-// status description names it.
-async function approveGatePr({ number, login }) {
-  if (!githubPush.isConfigured()) {
-    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
-  }
-  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-  // so a later commit's head carries no approval — red-team #2b protection).
-  const prs = await githubPush.listOpenPullRequests({});
-  const pr = prs.find((p) => p.number === number);
-  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
-  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
-
-  const gate = findCheck(pr, 'gate-review');
-  if (gate && isSuccess(gate)) {
-    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
-  }
-
-  // 1. Set the trustless owner-approval status on the head sha.
-  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
-  if (!set) {
-    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
-    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
-  }
-
-  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-  //    required check re-evaluates the new approval; re-arm auto-merge.
-  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-  //    1004323): clearing the gate check is the owner's act on the PR, and
-  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-  //    read that throws answers held, and an ordinary confirmed task left
-  //    un-armed still lands through the publish reconciler's sweep.
-  const prTask = taskIdFromPr(pr);
-  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-  let recheck = { reopened: false, auto_merge: false };
-  try {
-    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-  } catch (e) {
-    // The status IS set; if the re-trigger failed, the next push or a manual
-    // re-run still clears it, and the publish reconciler sweep merges once green.
-    console.error('[gds] gate-approval recheck failed', e);
-    return {
-      ok: true,
-      body: {
-        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-      },
-    };
-  }
-
-  return {
-    ok: true,
-    body: {
-      ok: true,
-      pr: number,
-      head_sha: pr.head_sha,
-      status_set: true,
-      recheck,
-      held_for_artist: held,
-      message: held
-        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-    },
-  };
-}
-
-module.exports = function buildGateApprovalsRouter() {
-  contributeGateApprovalsToDocket();
-  const router = express.Router();
-
-  // GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the
-  // verdict + per-file reasons + changed files + diff link. rank: metic+archon.
-  // BV1.R105 left this on requireRank because `gate_approval.decide` was declared over
-  // the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog
-  // with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now
-  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government`
-  // opens /gate to Metic, and without a Metic-readable data endpoint that page would
-  // render nothing but a 403. Approving a held PR stays archon (`.decide`, system).
-  router.get('/gate-approvals', auth.requireBuilder, auth.requirePermission('gate_approval.read'), async (req, res) => {
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot read pull requests.' });
-    }
-    try {
-      const { prs, awaiting, checking } = await listAwaitingGateApprovals();
-      // The PR check rollup is unreadable when the server credential lacks `Checks: read`
-      // (operator blocker): listOpenPullRequests then returns partialErrors and every PR's
-      // `checks` is empty, so the awaiting list is silently empty. Surface that so the hall
-      // can say "checks unreadable — grant the App Checks:read" rather than "nothing stuck".
-      const checksReadable = !(prs.partialErrors && prs.partialErrors.length);
-      res.json({
-        configured: true,
-        awaiting,
-        count: awaiting.length,
-        checking,
-        viewer_may_approve: await viewerMayApprove(req.builder.id),
-        checks_readable: checksReadable,
-        ...(checksReadable ? {} : {
-          note: 'PR check rollup is unreadable — the server GitHub App is missing the Checks:read permission, so gate-review-red PRs cannot be listed. Grant it and reinstall.',
-        }),
-      });
-    } catch (err) {
-      console.error('[gds] GET /gate-approvals', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, which swallows this JSON body. A 500 is passed through, so
-      // the structured error actually reaches the caller (the "never a bare 502" rule).
-      res.fail('gate_list_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  // POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and
-  // re-run the gate-review check so it clears. rank: archon (clears the hard floor —
-  // pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).
-  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), auth.requireActAlone('release'), async (req, res) => {
-    const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
-    if (number == null) return;
-    try {
-      const out = await approveGatePr({ number, login: req.builder.github_login });
-      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
-      res.json(out.body);
-    } catch (err) {
-      console.error('[gds] POST /gate-approvals/:pr/approve', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, swallowing this JSON. The reported symptom — a bare
-      // "error code: 502" interstitial instead of a structured error — was exactly this.
-      // A 500 is passed through, so the caller sees { error, message, detail }.
-      res.fail('gate_approve_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  return router;
-};
-
-module.exports.approveGatePr = approveGatePr;

package/scripts/bongos/artifact-staleness.js

@@ -1,267 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/artifact-staleness.js — are the gitignored generated artifacts on
-// THIS machine actually current with the commit it has checked out? (task 1001930,
-// ADR 0110 pt.5)
-//
-// WHY THIS EXISTS. ADR 0110 moved `docs/repo-map.md` and `docs/session-log-index.md`
-// off the git graph: they are 100%-generated, two parallel branches collided on them
-// constantly, so they became untracked files regenerated at deploy. That trade was
-// deliberate, and the ADR names the debt it took on in its own Consequences:
-//
-//   "A generator that breaks at deploy leaves a stale/absent file with no blocking
-//    backstop; the LOUD ::ERROR:: line is the alarm (mandatory, not optional)."
-//
-// That alarm is a line in the droplet's journald. Nobody reads journald. The per-PR
-// freshness gate cannot help either — the files are gitignored, so they never appear
-// in a diff for CI to check (`--check-whole`'s own comment says it plainly: "used by
-// nothing hard; deploy owns it"). So if the deploy regen step silently stops running,
-// every agent keeps reading a symbol map of a codebase that has moved on, and nothing
-// anywhere says so. This check is the backstop that posture depends on.
-//
-// WHAT IT COMPARES. For each registered artifact, its own generator's `--check-whole`
-// answers "would regenerating this file change it?" — run against the checkout that is
-// actually serving. A difference means the deploy generator did not run, or ran and
-// broke. Asking the generator rather than reimplementing the comparison is the point:
-// there is exactly one definition of "fresh" per artifact and it lives with the thing
-// that writes it, so this check cannot drift away from what deploy produces.
-//
-// ABSENT AND STALE ARE REPORTED SEPARATELY, and the split is operational, not cosmetic:
-// absent means the regen step never ran here at all (a deploy line was dropped, or a
-// fresh clone was never generated into), stale means it ran once and has not since.
-// Those send someone to two different places, so the report must not blur them.
-//
-// ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
-//
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
-// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
-// has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
-// — and this check would report it absent on every single run. A monitor that is red
-// every run teaches its reader to ignore it, which is the exact failure ADR 0110's
-// warn-only posture already has. That is why this ships as a scheduled routine on the
-// instance and NOT as a `.github/workflows/` job, unlike its sibling publish-watch.js
-// (which reads git and the registry, and so is true anywhere).
-//
-// THE MAIN GUARD. "Fresh" here means "matches what THIS commit generates". On a
-// deployed instance that commit is main, because deploy does `git reset --hard
-// origin/main` — so the question the caller actually wants ("does the served artifact
-// lag main's HEAD?") and the question `--check-whole` answers are the same question.
-// In a feature worktree they are NOT: the artifact would be compared against that
-// branch, and a pass or a fail would both be meaningless. So a checkout that is not at
-// origin/main is INCONCLUSIVE (exit 2), never a finding — a monitor that cannot tell
-// which question it just answered must say so rather than guess.
-'use strict';
-
-const { spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const GIT_TIMEOUT_MS = 15000;
-const CHECK_TIMEOUT_MS = 120000;
-
-// The gitignored, whole-file generated artifacts this check covers.
-//
-// MEMBERSHIP RULE — an artifact belongs here when all three hold: it is gitignored (so
-// no PR gate can see it), it is written by a deploy-time generator (so it can silently
-// stop being written), and its generator exposes `--check-whole` (so freshness has one
-// definition, owned by the writer). tests/artifact_staleness.mjs pins this list against
-// .gitignore and against the generators' real flags, so an artifact that gains a
-// `--check-whole` and is left out of here fails that test rather than going unwatched.
-//
-// DELIBERATELY NOT HERE, and each for a reason that is not "we forgot":
-//   • modules/hall-ui/public/atlas.json (gen-atlas.js, ADR 0094) — gitignored and
-//     deploy-generated, but its payload embeds `generatedAt: new Date()`, so a
-//     regenerate-and-compare differs on every run by construction. Checking it needs a
-//     comparison over `views` only, or a freshness-by-age test against the last deploy
-//     — a different mechanism, not this one. gen-atlas has no --check mode at all today.
-//   • docs/onboarding/diagrams/*.svg|png — rendering them needs a headless Chromium the
-//     droplet does not have (the reason ADR 0110 deferred the diagram half in the first
-//     place), so freshness cannot be evaluated where this runs. Their FACTS are already
-//     backstopped by the diagram-drift routine, which reads assertions.json instead.
-const ARTIFACTS = Object.freeze([
-  Object.freeze({
-    rel: 'docs/repo-map.md',
-    generator: 'gen-repo-map.js',
-    what: 'the symbol skeleton agents navigate the codebase by (ADR 0063)',
-  }),
-  Object.freeze({
-    rel: 'docs/session-log-index.md',
-    generator: 'gen-session-index.js',
-    what: 'the full session-log index the CLAUDE.md §13 snippet links out to (ADR 0062 §8)',
-  }),
-]);
-
-function git(args, run = spawnSync) {
-  const raw = gitRaw(args, run);
-  return raw === null ? null : raw.trim();
-}
-
-// Untrimmed, because `git status --porcelain` is column-significant: a line is
-// `XY<space>PATH` and an unstaged modification's X is a SPACE (" M path"). Trimming the
-// buffer eats that leading space on the FIRST line only, so a slice(3) then swallows the
-// path's first character — which is exactly how this printed "cripts/gds/…" until
-// tests/artifact_staleness.mjs caught it.
-function gitRaw(args, run = spawnSync) {
-  const r = run('git', args, { cwd: REPO_ROOT, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
-  if (!r || r.error || r.status !== 0) return null;
-  return String(r.stdout || '');
-}
-
-// The paths in a porcelain listing, status columns removed.
-function porcelainPaths(raw) {
-  return raw.split('\n').filter((l) => l.length > 3).map((l) => l.slice(3).trim()).filter(Boolean);
-}
-
-// Is this checkout a fair thing to compare the artifacts against — at origin/main AND
-// clean? Returns { ok } or { ok:false, reason }; git being unable to answer is equally
-// inconclusive.
-//
-// The CLEAN half is not belt-and-braces, and it was found by running this check against
-// its own uncommitted source file: a generator regenerates from the WORKING TREE, so one
-// uncommitted file that moves a symbol makes repo-map.md "stale" against a main it in
-// fact matches. On the droplet the tree is clean by construction (deploy does
-// `git reset --hard`), so requiring it costs a correct run nothing — while without it
-// every hand-run from a working checkout invents a finding, which is precisely how a
-// monitor teaches its reader to ignore it. Gitignored files (the artifacts themselves)
-// never appear in `--porcelain`, so they cannot trip this.
-function atMain(run = spawnSync) {
-  const head = git(['rev-parse', 'HEAD'], run);
-  const main = git(['rev-parse', 'origin/main'], run);
-  if (!head) return { ok: false, reason: 'could not read HEAD (not a git checkout?)' };
-  if (!main) return { ok: false, reason: 'could not read origin/main (no remote ref here?)' };
-  if (head !== main) {
-    const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], run) || '(detached)';
-    return { ok: false, reason: `checkout is at ${branch} ${head.slice(0, 8)}, not origin/main ${main.slice(0, 8)}` };
-  }
-  const dirty = gitRaw(['status', '--porcelain'], run);
-  if (dirty === null) return { ok: false, reason: 'could not read the working tree state' };
-  const paths = porcelainPaths(dirty);
-  if (paths.length) {
-    const shown = paths.slice(0, 3).join(', ');
-    const more = paths.length > 3 ? `, +${paths.length - 3} more` : '';
-    return { ok: false, reason: `working tree is not clean (${shown}${more}) — the generators would compare against those edits, not main` };
-  }
-  return { ok: true, sha: head };
-}
-
-// Ask ONE artifact's own generator whether it is current.
-//   fresh    exit 0 — regenerating would change nothing
-//   stale    exit 2 — it would (absent counts as stale; `present` says which)
-//   unknown  anything else — the generator itself could not answer, which is not a
-//            finding about the artifact and must never be reported as one.
-function checkArtifact(a, { root = REPO_ROOT, run = spawnSync, exists = fs.existsSync } = {}) {
-  const present = exists(path.join(root, a.rel));
-  const r = run(process.execPath, [path.join(root, 'scripts', 'bongos', a.generator), '--check-whole'],
-    { cwd: root, encoding: 'utf8', timeout: CHECK_TIMEOUT_MS });
-  if (!r || r.error) {
-    return { ...a, state: 'unknown', present, detail: r && r.error ? r.error.message : 'generator did not run' };
-  }
-  if (r.status === 0) return { ...a, state: 'fresh', present };
-  if (r.status === 2) return { ...a, state: present ? 'stale' : 'absent', present };
-  const said = String(r.stderr || r.stdout || '').trim().split('\n').pop() || `exit ${r.status}`;
-  return { ...a, state: 'unknown', present, detail: said };
-}
-
-function check({ root = REPO_ROOT, run = spawnSync, exists = fs.existsSync, artifacts = ARTIFACTS, requireMain = true } = {}) {
-  if (requireMain) {
-    const m = atMain(run);
-    if (!m.ok) { const e = new Error(m.reason); e.inconclusive = true; throw e; }
-  }
-  const results = artifacts.map((a) => checkArtifact(a, { root, run, exists }));
-  return {
-    results,
-    fresh: results.filter((r) => r.state === 'fresh'),
-    stale: results.filter((r) => r.state === 'stale'),
-    absent: results.filter((r) => r.state === 'absent'),
-    unknown: results.filter((r) => r.state === 'unknown'),
-  };
-}
-
-// Plain language: this lands in Discord #ship-news, where the audience is the owner,
-// not whoever wrote the generator.
-function report(r) {
-  const bad = [...r.absent, ...r.stale];
-  if (!bad.length && !r.unknown.length) {
-    return `Generated navigation docs are current — ${r.fresh.length} artifact(s) match this commit.`;
-  }
-  const lines = [];
-  if (bad.length) {
-    lines.push(`⚠ ${bad.length} generated file(s) on this instance no longer match the code being served.`);
-    lines.push('');
-    for (const a of r.absent) lines.push(`  • ${a.rel} — MISSING entirely. Nothing has generated it here. It is ${a.what}.`);
-    for (const a of r.stale) lines.push(`  • ${a.rel} — out of date: it no longer matches what this commit would produce. It is ${a.what}.`);
-    lines.push('');
-    lines.push('These are rebuilt by the deploy step, so this means that step stopped running or broke.');
-    lines.push('Nothing blocks on them, which is why it went unreported until now — anyone reading these');
-    lines.push('files is being given an out-of-date picture. Check the deploy log for its regen lines');
-    lines.push('(they print ::ERROR:: when a generator fails).');
-  }
-  if (r.unknown.length) {
-    if (bad.length) lines.push('');
-    lines.push(`Could not check ${r.unknown.length} artifact(s):`);
-    for (const a of r.unknown) lines.push(`  • ${a.rel} — ${a.detail}`);
-  }
-  return lines.join('\n');
-}
-
-// Deliver the finding here rather than through run-routine.js's `sink: discord`.
-// run-routine treats a non-zero step as a FAILED step and aborts BEFORE it routes
-// stdout, so exiting 1 on a finding would throw that finding away. publish-watch.js
-// and artifact-audit.js carry the same shape for the same reason; their routine steps
-// all stay `sink: none` and the script performs its own side effect.
-async function deliver(text) {
-  const { postWebhook } = require(path.join(__dirname, '..', 'discord', 'lib.js'));
-  await postWebhook('ship_news', text);
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const json = argv.includes('--json');
-
-  let r;
-  try {
-    r = check({ requireMain: !argv.includes('--any-ref') });
-  } catch (err) {
-    // Exit 2 = COULD NOT RUN, kept distinct from 1 (ran, found something) so a
-    // scheduler can go red on the former and merely report the latter.
-    console.error(`artifact-staleness could not complete: ${err && err.message ? err.message : err}`);
-    if (err && err.inconclusive) {
-      console.error('  Freshness is only meaningful against the commit being served. Re-run on the');
-      console.error('  deployed instance, or pass --any-ref to compare against whatever is checked out.');
-    }
-    process.exit(2);
-  }
-
-  const text = report(r);
-  const found = r.stale.length + r.absent.length;
-
-  if (json) { console.log(JSON.stringify(r, null, 2)); process.exit(found ? 1 : 0); }
-
-  // A healthy run is deliberately quiet — it tells a person who ran it by hand
-  // (stderr) and posts nothing. A daily "all fine" is how a channel becomes wallpaper.
-  if (!found) {
-    console.error(text);
-    // An artifact we could not check is not a finding, but it must not be silent
-    // either: a permanently-unknown artifact is unwatched without anyone deciding so.
-    process.exit(r.unknown.length ? 2 : 0);
-  }
-
-  console.log(text);
-  if (argv.includes('--no-post')) process.exit(1);
-
-  try {
-    await deliver(text);
-    console.error('posted the finding to Discord #ship-news.');
-    process.exit(1);
-  } catch (err) {
-    // Found something and could not say it — the original defect one layer down, so
-    // it is the LOUDEST outcome: exit 3 is >= 2, which turns the scheduled run red.
-    console.error(`\nFOUND STALE ARTIFACTS AND COULD NOT DELIVER THE FINDING: ${err && err.message ? err.message : err}`);
-    console.error('The finding is above. Set DISCORD_SHIP_NEWS_WEBHOOK so this reaches #ship-news.');
-    process.exit(3);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { ARTIFACTS, atMain, checkArtifact, check, report };

package/scripts/bongos/ci-grade.js

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/ci-grade.js — run the quality grader IN CI as a fail-closed PR
-// gate (#855, ADR 0042). This is the security KEYSTONE for the ci deploy mode.
-//
-// WHY it must run in CI (not "read the recorded grade"):
-//   POST /api/bongos/tasks/:id/grade records the grader scores FROM THE REQUEST
-//   BODY — the server does not independently recompute them. In laptop mode the
-//   grader runs on the OPERATOR's trusted machine, so that's fine. In ci mode the
-//   merge trigger moves to an UNTRUSTED builder machine; a tampered local ship.js
-//   could POST a fake passing grade, so a gate that merely READS the recorded
-//   grade is theater. The only tamper-proof gate runs the grader where the
-//   builder can't touch it: here, in GitHub Actions, against the PR diff.
-//
-// It reuses the EXACT production grading path (ship.js runSubagentGrader → the
-// adversarial worker panel / trivial-diff shot), so a CI pass means the same
-// thing a ship-time pass means. Exit 0 = pass, non-zero = fail (FAIL-CLOSED: any
-// grader error also exits non-zero).
-//
-// SKIP-SAFE until armed: if no grader auth is wired (CLAUDE_CODE_OAUTH_TOKEN /
-// ANTHROPIC_API_KEY), it prints SKIP and exits 0 — so merging this workflow
-// changes nothing until the operator (a) adds the auth secret and (b) marks this
-// a REQUIRED check in branch protection. Mirrors the inert-until-cutover pattern
-// of .github/workflows/deploy-prod.yml (#597). See ADR 0042 cutover precondition #1.
-//
-// Inputs (from the workflow env):
-//   GRADE_BASE_REF      base ref to diff against (default origin/main)
-//   GRADE_TASK_ID       the PR's task id (context only; grading is diff-based)
-//   GRADE_TASK_TITLE    the PR title (context for the grader prompt)
-//   GRADE_VALUE_SUMMARY the PR value summary (context for the grader prompt)
-
-const { execFileSync } = require('node:child_process');
-const ship = require('./ship.js');
-
-function git(args) {
-  return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-}
-
-(async () => {
-  // Auth presence — the grader spawns the `claude` CLI; without auth it cannot
-  // run. Until the operator wires it, stay green-but-not-gating (see header).
-  const hasAuth = !!(process.env.CLAUDE_CODE_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY);
-  if (!hasAuth) {
-    console.log(
-      'grade-gate: SKIP — no grader auth (CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY) configured. ' +
-        'This check is green-but-not-gating until the operator wires the secret AND marks it a required check ' +
-        '(ADR 0042 cutover precondition #1). It is NOT a real gate yet.'
-    );
-    process.exit(0);
-  }
-
-  const base = process.env.GRADE_BASE_REF || 'origin/main';
-  let baseline;
-  try {
-    baseline = git(['merge-base', base, 'HEAD']);
-  } catch (_) {
-    baseline = base; // shallow checkout / no common ancestor — diff against the ref directly
-  }
-
-  const changedFiles = ship.computeChangedFiles(baseline);
-  if (!changedFiles.length) {
-    console.log('grade-gate: no changes vs base — pass (nothing to grade).');
-    process.exit(0);
-  }
-
-  const task = {
-    id: process.env.GRADE_TASK_ID || null,
-    title: process.env.GRADE_TASK_TITLE || '(pull request)',
-  };
-  const valueSummary = process.env.GRADE_VALUE_SUMMARY || '';
-
-  console.log(`grade-gate: grading ${changedFiles.length} changed file(s) vs ${baseline.slice(0, 12)} ...`);
-  const result = await ship.runSubagentGrader({ task, valueSummary, baseline, changedFiles });
-
-  console.log(`grade-gate: verdict = ${result.passed ? 'PASS' : 'FAIL'}`);
-  if (result.notes_md) console.log(String(result.notes_md).slice(0, 6000));
-  // Fail-closed: only an explicit pass exits 0.
-  process.exit(result.passed ? 0 : 1);
-})().catch((err) => {
-  // FAIL-CLOSED: a grader error must block the merge, never wave it through.
-  console.error('grade-gate: FAIL (grader error — failing closed):', err && err.message ? err.message : err);
-  process.exit(1);
-});