@bongos/core 1.21.177 → 1.21.179

package/modules/lifecycle/routes/gate-approvals.js

@@ -1,299 +0,0 @@
-// src/bongos/routes/gate-approvals.js — Archon gate-surface PR approval from the hall
-// (task 1179, ADR 0058 amendment).
-//
-// WHY. The gate-review CI check (ADR 0058) clears an ESCALATE (hard floor) ONLY on
-// an owner approval, and a NEEDS_TRUST without a Metic+ author likewise blocks until
-// the owner approves. Historically that owner approval was a GitHub APPROVED review
-// by the repo owner on the head sha — i.e. the owner had to leave a GitHub/terminal review.
-// This router gives Archons a browser-only equivalent (feedback: auth flows must be
-// UI-first), trust-consistent with the existing server-set `gate-author-trust`
-// status: the server re-checks the caller's Archon rank server-side (ADR 0016) and
-// sets a `gate-owner-approved` commit status that the gate-review workflow honors as
-// owner approval. A PR author cannot forge it (only the server holds the credential).
-//
-//   GET  /gate-approvals               — open PRs whose gate-review check is red,
-//                                         with the verdict + per-file reasons (Archon)
-//   POST /gate-approvals/:pr/approve    — record owner approval + re-run the check (Archon)
-//
-// The list's "is this awaiting approval" signal is the LIVE gate-review check
-// conclusion (authoritative), not a re-derivation; classifyChanges() is reused only
-// to render WHY each PR escalated, so the hall shows exactly the CI reasoning.
-
-const express = require('express');
-// Intra-module + the published doorway — a module never requires a core internal.
-const api = require('../../../src/module-api');
-const auth = api;
-const githubPush = require('../github-push');
-// The page-tweak hold (task 1004323 / BV2.TW12, ADR 0341 D7): the approve below
-// re-arms auto-merge on the reopened PR, and a page tweak held for its artist must
-// never be armed from here. Called through the module object so tests can stub it.
-const pageTweakReads = require('../page-tweak-reads');
-
-// Would POST /gate-approvals/:pr/approve let this viewer through? The same two
-// checks it mounts, read for the list (task 1004829): the hall draws a held PR as
-// an ask card only on true, so a Metic who may read the gate never sees an Approve
-// the route would refuse. Fail-closed like requirePermission: no government port,
-// or one that throws, is false; an absent act-alone check passes, as the
-// requireActAlone gate does.
-async function viewerMayApprove(builderId) {
-  try {
-    const government = api.resolveOptional('government');
-    if (!government || typeof government.builderHasPermissions !== 'function') return false;
-    if (!(await government.builderHasPermissions(Number(builderId), ['gate_approval.decide']))) return false;
-    if (typeof government.checkActAlone !== 'function') return true;
-    const out = await government.checkActAlone('release', builderId);
-    return !!(out && out.ok === true);
-  } catch {
-    // authority that cannot be established is a denial (ADR 0016); the list still answers
-    return false;
-  }
-}
-const { HELD_NOT_ARMED } = require('../page-tweak-hold');
-const { parseId } = api;
-// The SAME pure classifier the CI gate runs — reused (never duplicated) so the hall
-// shows identical verdict + reasons. Safe to require: gate-review.js guards its CLI
-// entrypoint behind `require.main === module`, so importing it runs no side effects.
-const { classifyChanges, resolveAction } = require('../../../scripts/bongos/gate-review');
-
-// Pull a GDS task id out of a server-published PR's title ("task 1163: …") or body
-// ("… for task 1163."). Returns a number or null. Display-only.
-function taskIdFromPr(pr) {
-  const hay = `${pr.title || ''}\n${pr.body || ''}`;
-  const m = /\btask\s+(\d{1,7})\b/i.exec(hay);
-  return m ? Number(m[1]) : null;
-}
-
-// Find a named check/status in the head-commit rollup (CheckRun.name or
-// StatusContext.context — listOpenPullRequests flattens both to `name`).
-function findCheck(pr, name) {
-  return (pr.checks || []).find((c) => c.name === name) || null;
-}
-const isSuccess = (c) => c && String(c.conclusion || '').toUpperCase() === 'SUCCESS';
-const isFailure = (c) => c && String(c.conclusion || '').toUpperCase() === 'FAILURE';
-
-// Run the pure classifier over a PR's changed files to produce the display verdict +
-// reasons. blobAt returns null (no file content fetched): the path-level hard-floor /
-// sensitive-surface rules — which produce the human reasons — do not need content;
-// the content-only AUTO-narrowing certifications fail-closed to a stricter verdict,
-// which is the safe direction for a read-only "why is this stuck" view.
-function summarizeGate(files) {
-  const r = classifyChanges({ files, blobAt: () => null, diffBytes: 0 });
-  const reasons = [
-    ...(r.escalations || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: true })),
-    ...(r.needsTrust || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: false })),
-  ];
-  return { verdict: r.verdict, reasons, surfaces: r.surfaces || [] };
-}
-
-// The awaiting list itself: open, non-draft PRs whose gate-review check is
-// COMPLETED and red, each with its verdict and reasons. Shared by GET
-// /gate-approvals and the governor's docket (task 1004523), so the two can never
-// disagree about what is waiting. `withFiles: false` skips the per-PR file read
-// (the docket needs only the count and the titles, not the per-file reasons).
-async function listAwaitingGateApprovals({ withFiles = true } = {}) {
-  const prs = await githubPush.listOpenPullRequests({});
-  const awaiting = [];
-  let checking = 0;
-  for (const pr of prs) {
-    if (pr.is_draft) continue;
-    const gate = findCheck(pr, 'gate-review');
-    if (!gate) continue; // not a gate-reviewed PR (or it hasn't run yet)
-    if (String(gate.status || '').toUpperCase() !== 'COMPLETED') { checking += 1; continue; }
-    if (!isFailure(gate)) continue; // green/neutral → not awaiting
-    // gate-review is red → blocked awaiting trust/owner approval. Render WHY.
-    let summary = { verdict: 'unknown', reasons: [], surfaces: [], files: [] };
-    if (withFiles) {
-      try {
-        const files = await githubPush.getPullRequestFiles({ number: pr.number });
-        summary = summarizeGate(files);
-        summary.files = files.map((f) => ({ path: f.path, status: f.status }));
-      } catch (_) {
-        summary.files = [];
-      }
-    }
-    awaiting.push({
-      number: pr.number,
-      title: pr.title,
-      url: pr.url,
-      task: taskIdFromPr(pr),
-      author: pr.author,
-      head_sha: pr.head_sha,
-      verdict: summary.verdict,
-      reasons: summary.reasons,
-      files: summary.files,
-      author_trusted: isSuccess(findCheck(pr, 'gate-author-trust')),
-      already_approved: isSuccess(findCheck(pr, githubPush.GATE_OWNER_APPROVED_CONTEXT)),
-      gate_review_url: gate.url || null,
-    });
-  }
-  return { prs, awaiting, checking };
-}
-
-// The governor's docket (task 1004523): a PR held at the gate stands at Release,
-// shown only to a viewer holding `gate_approval.read` (this list route's own atom)
-// and needing only a viewer who may clear it (`gate_approval.decide`). An
-// unconfigured server credential is a read error, so the docket reports the
-// source `unavailable` rather than an empty, falsely calm Release.
-function contributeGateApprovalsToDocket() {
-  api.contribute('governor.docket', {
-    source: 'gate_approvals',
-    building: 'release',
-    gate: { permission: 'gate_approval.read' },
-    read: async (ctx) => {
-      if (!githubPush.isConfigured()) throw new Error('publish_unconfigured');
-      const { awaiting } = await listAwaitingGateApprovals({ withFiles: false });
-      const mayDecide = ctx.has('gate_approval.decide');
-      return awaiting.filter((pr) => !pr.already_approved).map((pr) => ({
-        id: pr.number,
-        rule: 'decide',
-        state: mayDecide ? 'needs' : 'moving',
-        title: pr.title || `Pull request ${pr.number}`,
-        short: 'held at the gate',
-        where: 'release · held at the gate',
-        opened_at: null,
-        deadline: null,
-        proposer: pr.author ? { login: pr.author } : null,
-        tally: null,
-        href: '/gate',
-        ref: { type: 'pull_request', id: pr.number },
-      }));
-    },
-  });
-}
-
-// The approval itself, shared by the route above and a passed Release matter
-// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
-// { ok: true, body } or { ok: false, code, status, message }; throws on an
-// unexpected failure (the caller says it). `login` is who approved, as the
-// status description names it.
-async function approveGatePr({ number, login }) {
-  if (!githubPush.isConfigured()) {
-    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
-  }
-  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-  // so a later commit's head carries no approval — red-team #2b protection).
-  const prs = await githubPush.listOpenPullRequests({});
-  const pr = prs.find((p) => p.number === number);
-  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
-  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
-
-  const gate = findCheck(pr, 'gate-review');
-  if (gate && isSuccess(gate)) {
-    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
-  }
-
-  // 1. Set the trustless owner-approval status on the head sha.
-  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
-  if (!set) {
-    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
-    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
-  }
-
-  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-  //    required check re-evaluates the new approval; re-arm auto-merge.
-  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-  //    1004323): clearing the gate check is the owner's act on the PR, and
-  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-  //    read that throws answers held, and an ordinary confirmed task left
-  //    un-armed still lands through the publish reconciler's sweep.
-  const prTask = taskIdFromPr(pr);
-  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-  let recheck = { reopened: false, auto_merge: false };
-  try {
-    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-  } catch (e) {
-    // The status IS set; if the re-trigger failed, the next push or a manual
-    // re-run still clears it, and the publish reconciler sweep merges once green.
-    console.error('[gds] gate-approval recheck failed', e);
-    return {
-      ok: true,
-      body: {
-        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-      },
-    };
-  }
-
-  return {
-    ok: true,
-    body: {
-      ok: true,
-      pr: number,
-      head_sha: pr.head_sha,
-      status_set: true,
-      recheck,
-      held_for_artist: held,
-      message: held
-        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-    },
-  };
-}
-
-module.exports = function buildGateApprovalsRouter() {
-  contributeGateApprovalsToDocket();
-  const router = express.Router();
-
-  // GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the
-  // verdict + per-file reasons + changed files + diff link. rank: metic+archon.
-  // BV1.R105 left this on requireRank because `gate_approval.decide` was declared over
-  // the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog
-  // with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now
-  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government`
-  // opens /gate to Metic, and without a Metic-readable data endpoint that page would
-  // render nothing but a 403. Approving a held PR stays archon (`.decide`, system).
-  router.get('/gate-approvals', auth.requireBuilder, auth.requirePermission('gate_approval.read'), async (req, res) => {
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot read pull requests.' });
-    }
-    try {
-      const { prs, awaiting, checking } = await listAwaitingGateApprovals();
-      // The PR check rollup is unreadable when the server credential lacks `Checks: read`
-      // (operator blocker): listOpenPullRequests then returns partialErrors and every PR's
-      // `checks` is empty, so the awaiting list is silently empty. Surface that so the hall
-      // can say "checks unreadable — grant the App Checks:read" rather than "nothing stuck".
-      const checksReadable = !(prs.partialErrors && prs.partialErrors.length);
-      res.json({
-        configured: true,
-        awaiting,
-        count: awaiting.length,
-        checking,
-        viewer_may_approve: await viewerMayApprove(req.builder.id),
-        checks_readable: checksReadable,
-        ...(checksReadable ? {} : {
-          note: 'PR check rollup is unreadable — the server GitHub App is missing the Checks:read permission, so gate-review-red PRs cannot be listed. Grant it and reinstall.',
-        }),
-      });
-    } catch (err) {
-      console.error('[gds] GET /gate-approvals', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, which swallows this JSON body. A 500 is passed through, so
-      // the structured error actually reaches the caller (the "never a bare 502" rule).
-      res.fail('gate_list_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  // POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and
-  // re-run the gate-review check so it clears. rank: archon (clears the hard floor —
-  // pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).
-  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), auth.requireActAlone('release'), async (req, res) => {
-    const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
-    if (number == null) return;
-    try {
-      const out = await approveGatePr({ number, login: req.builder.github_login });
-      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
-      res.json(out.body);
-    } catch (err) {
-      console.error('[gds] POST /gate-approvals/:pr/approve', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, swallowing this JSON. The reported symptom — a bare
-      // "error code: 502" interstitial instead of a structured error — was exactly this.
-      // A 500 is passed through, so the caller sees { error, message, detail }.
-      res.fail('gate_approve_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  return router;
-};
-
-module.exports.approveGatePr = approveGatePr;

package/scripts/bongos/ci-grade.js

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/ci-grade.js — run the quality grader IN CI as a fail-closed PR
-// gate (#855, ADR 0042). This is the security KEYSTONE for the ci deploy mode.
-//
-// WHY it must run in CI (not "read the recorded grade"):
-//   POST /api/bongos/tasks/:id/grade records the grader scores FROM THE REQUEST
-//   BODY — the server does not independently recompute them. In laptop mode the
-//   grader runs on the OPERATOR's trusted machine, so that's fine. In ci mode the
-//   merge trigger moves to an UNTRUSTED builder machine; a tampered local ship.js
-//   could POST a fake passing grade, so a gate that merely READS the recorded
-//   grade is theater. The only tamper-proof gate runs the grader where the
-//   builder can't touch it: here, in GitHub Actions, against the PR diff.
-//
-// It reuses the EXACT production grading path (ship.js runSubagentGrader → the
-// adversarial worker panel / trivial-diff shot), so a CI pass means the same
-// thing a ship-time pass means. Exit 0 = pass, non-zero = fail (FAIL-CLOSED: any
-// grader error also exits non-zero).
-//
-// SKIP-SAFE until armed: if no grader auth is wired (CLAUDE_CODE_OAUTH_TOKEN /
-// ANTHROPIC_API_KEY), it prints SKIP and exits 0 — so merging this workflow
-// changes nothing until the operator (a) adds the auth secret and (b) marks this
-// a REQUIRED check in branch protection. Mirrors the inert-until-cutover pattern
-// of .github/workflows/deploy-prod.yml (#597). See ADR 0042 cutover precondition #1.
-//
-// Inputs (from the workflow env):
-//   GRADE_BASE_REF      base ref to diff against (default origin/main)
-//   GRADE_TASK_ID       the PR's task id (context only; grading is diff-based)
-//   GRADE_TASK_TITLE    the PR title (context for the grader prompt)
-//   GRADE_VALUE_SUMMARY the PR value summary (context for the grader prompt)
-
-const { execFileSync } = require('node:child_process');
-const ship = require('./ship.js');
-
-function git(args) {
-  return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-}
-
-(async () => {
-  // Auth presence — the grader spawns the `claude` CLI; without auth it cannot
-  // run. Until the operator wires it, stay green-but-not-gating (see header).
-  const hasAuth = !!(process.env.CLAUDE_CODE_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY);
-  if (!hasAuth) {
-    console.log(
-      'grade-gate: SKIP — no grader auth (CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY) configured. ' +
-        'This check is green-but-not-gating until the operator wires the secret AND marks it a required check ' +
-        '(ADR 0042 cutover precondition #1). It is NOT a real gate yet.'
-    );
-    process.exit(0);
-  }
-
-  const base = process.env.GRADE_BASE_REF || 'origin/main';
-  let baseline;
-  try {
-    baseline = git(['merge-base', base, 'HEAD']);
-  } catch (_) {
-    baseline = base; // shallow checkout / no common ancestor — diff against the ref directly
-  }
-
-  const changedFiles = ship.computeChangedFiles(baseline);
-  if (!changedFiles.length) {
-    console.log('grade-gate: no changes vs base — pass (nothing to grade).');
-    process.exit(0);
-  }
-
-  const task = {
-    id: process.env.GRADE_TASK_ID || null,
-    title: process.env.GRADE_TASK_TITLE || '(pull request)',
-  };
-  const valueSummary = process.env.GRADE_VALUE_SUMMARY || '';
-
-  console.log(`grade-gate: grading ${changedFiles.length} changed file(s) vs ${baseline.slice(0, 12)} ...`);
-  const result = await ship.runSubagentGrader({ task, valueSummary, baseline, changedFiles });
-
-  console.log(`grade-gate: verdict = ${result.passed ? 'PASS' : 'FAIL'}`);
-  if (result.notes_md) console.log(String(result.notes_md).slice(0, 6000));
-  // Fail-closed: only an explicit pass exits 0.
-  process.exit(result.passed ? 0 : 1);
-})().catch((err) => {
-  // FAIL-CLOSED: a grader error must block the merge, never wave it through.
-  console.error('grade-gate: FAIL (grader error — failing closed):', err && err.message ? err.message : err);
-  process.exit(1);
-});