@nanobpm/nano-workforce 0.205.2 → 0.206.1

package/workers/merge/worker.test.ts

@@ -112,6 +112,13 @@ test("pr.merge short-circuits an already-merged PR without re-running the land p
 // would stay green if the verb regressed.
 type GithubCall = { url: string; method: string };
 
+// A handler whose review backstop sees a VERIFIED head-current review, so land-protocol tests
+// exercise the protocol dispatch (the backstop now fails CLOSED on an unreadable read, #927).
+const reviewedHandler = makeHandler({
+  readReview: async () => ({ body: "lgtm", commitId: "reviewedhead" }),
+  readHeadSha: async () => "reviewedhead",
+});
+
 function withGithub(
   routes: (url: string, init: RequestInit | undefined) => Response | null,
   run: (calls: GithubCall[]) => Promise<void>,
@@ -153,7 +160,7 @@ test("pr.merge routes a mergify-queue repo through the queued branch (enqueue co
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#7", repo: "acme/widgets", prNumber: 7 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -189,7 +196,7 @@ test("pr.merge routes a refused merge through the blocked branch (escalation pay
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#9", repo: "acme/widgets", prNumber: 9 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -229,7 +236,7 @@ test("pr.merge routes a transient base-moved race through the retry branch (no e
     },
     async (calls) => {
       const { app, stores } = fakeApp();
-      const out = (await handler(
+      const out = (await reviewedHandler(
         { variables: { prKey: "acme/widgets#11", repo: "acme/widgets", prNumber: 11 } } as any,
         app,
       )) as Record<string, unknown>;
@@ -383,33 +390,63 @@ test("pr.merge #923: a HEAD-CURRENT review lands normally (backstop control)", a
   );
 });
 
-test("pr.merge #923: an UNREADABLE review/head fails OPEN (a transport hiccup never wedges a merge)", async () => {
-  await withGithub(
-    (url) => {
-      if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
-      return backstopRoutes(url);
-    },
-    async (calls) => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => null, // no usable transport → unverifiable, NOT "no review"
-        readHeadSha: async () => {
-          throw new Error("boom");
-        },
-      });
-      const out = (await backstop(
-        { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
-        app,
-      )) as Record<string, unknown>;
+for (const [label, readReview, readHeadSha] of [
+  ["review read null", async () => null, async () => "h9"],
+  ["review read throws", async () => { throw new Error("boom"); }, async () => "h9"],
+  ["head read null", async () => ({ body: "lgtm", commitId: "h9" }), async () => null],
+  ["head read throws", async () => ({ body: "lgtm", commitId: "h9" }), async () => { throw new Error("boom"); }],
+  ["head read empty", async () => ({ body: "lgtm", commitId: "h9" }), async () => "  "],
+] as const) {
+  test(`pr.merge #927: an UNVERIFIABLE backstop read (${label}) fails CLOSED — no land, audited refusal`, async () => {
+    await withGithub(
+      (url) => {
+        if (/\/pulls\/\d+\/merge$/.test(url)) return new Response(JSON.stringify({ merged: true }), { status: 200 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#27", repo: "acme/widgets", prNumber: 27 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(out.status, "blocked");
+        assertEquals((out.question as string).includes("could not be read"), true);
+        assertEquals(stores.merges.length, 1);
+        assertEquals(stores.merges[0].outcome, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+      },
+    );
+  });
+}
 
-      assertEquals(out, { mergeStatus: "merged" });
-      assertEquals(
-        calls.some((c) => /\/pulls\/\d+\/merge$/.test(c.url) && c.method === "PUT"),
-        true,
-      );
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    },
-  );
+test("pr.merge #927: reproduces nano-bpm#1467 — review REQUESTED but not yet arrived on a mergify-queue repo → no `@mergifyio queue`", async () => {
+  const protocol =
+    "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+  for (const readReview of [async () => ({ body: "", commitId: null }), async () => null]) {
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        const backstop = makeHandler({ readReview, readHeadSha: async () => "e597b399" } as any);
+        const out = (await backstop(
+          { variables: { prKey: "acme/widgets#1467", repo: "acme/widgets", prNumber: 1467 } } as any,
+          app,
+        )) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "blocked");
+        assertEquals(stores.merges[0].method, "review-backstop");
+        assertEquals(calls.some((c) => /\/comments$/.test(c.url)), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false);
+      },
+    );
+  }
 });
 
 test("pr.merge #923: a head-current review whose summary reports OPEN findings blocks landing", async () => {
@@ -427,23 +464,6 @@ test("pr.merge #923: a head-current review whose summary reports OPEN findings b
   });
 });
 
-for (const [label, readHeadSha] of [
-  ["returns null", async () => null],
-  ["throws", async () => { throw new Error("transient"); }],
-] as const) {
-  test(`pr.merge #923: an unverifiable head (read ${label}) never blocks on a possibly-stale review's open findings`, async () => {
-    await withGithub(backstopRoutes, async () => {
-      const { app, stores } = fakeApp();
-      const backstop = makeHandler({
-        readReview: async () => ({ body: "### 🟡 Changes recommended\n<summary>2 open issues</summary>", commitId: "old" }),
-        readHeadSha,
-      });
-      await backstop({ variables: { prKey: "acme/widgets#29", repo: "acme/widgets", prNumber: 29 } } as any, app);
-      assertEquals(stores.merges.some((m) => m.method === "review-backstop"), false);
-    });
-  });
-}
-
 test("pr.merge #923: the direct merge pins the verified head SHA (no check-then-merge race)", async () => {
   let putBody = "";
   await withGithub(
@@ -485,3 +505,36 @@ test("pr.merge #923: a queue-comment repo whose head moved after the backstop re
     },
   );
 });
+
+for (const [label, finalRead] of [
+  ["null", async () => null],
+  ["throwing", async () => {
+    throw new Error("502");
+  }],
+  ["blank", async () => "  "],
+] as const) {
+  test(`pr.merge #927: a queue-comment repo whose FINAL head re-read is ${label} retries instead of enqueueing`, async () => {
+    const protocol =
+      "# repo\n\n```merge-protocol\n{ \"land\": { \"method\": \"mergify-queue\", \"comment\": \"@mergifyio queue\" } }\n```\n";
+    await withGithub(
+      (url) => {
+        if (/\/contents\/AGENTS\.md$/.test(url)) return new Response(protocol);
+        if (/\/issues\/\d+\/comments$/.test(url)) return new Response(JSON.stringify({ id: 1 }), { status: 201 });
+        return backstopRoutes(url);
+      },
+      async (calls) => {
+        const { app, stores } = fakeApp();
+        let n = 0;
+        const backstop = makeHandler({
+          readReview: async () => ({ body: "lgtm", commitId: "h3" }),
+          readHeadSha: async () => (n++ === 0 ? "h3" : finalRead()),
+        } as any);
+        const out = (await backstop({ variables: { prKey: "acme/widgets#34", repo: "acme/widgets", prNumber: 34 } } as any, app)) as Record<string, unknown>;
+        assertEquals(out.mergeStatus, "retry");
+        assertEquals(stores.merges.some((m) => m.outcome === "retry"), true, "retry audit row");
+        assertEquals(calls.some((c) => /\/issues\/\d+\/comments$/.test(c.url) && c.method === "POST"), false);
+        assertEquals(calls.some((c) => /\/merge$/.test(c.url)), false, "no merge call");
+      },
+    );
+  });
+}

package/workers/merge/worker.ts

@@ -15,10 +15,9 @@
 // it reviewed — a head that MOVED between convergence and landing, or a review that never existed
 // (the #1443 fail-open), must not slip through at land time. Before running ANY land protocol this
 // worker re-checks that a HEAD-CURRENT Copilot review exists; a missing/stale review blocks the
-// landing (escalating to a human) instead of enqueueing/merging unreviewed code. The check fails
-// OPEN only when the GitHub state is UNREADABLE (no transport / a hiccup) — the merge-stage
-// mergeability polling is the independent backstop there, and a hard block on a transient read
-// would wedge every merge on a network blip.
+// landing (escalating to a human) instead of enqueueing/merging unreviewed code. An UNREADABLE
+// review/head ALSO blocks (fails CLOSED, issue #927) — the old fail-open let nano-bpm#1467 land
+// 49 s before its first review.
 import type { AppJobHandler } from "@nanobpm/urban";
 import { matchTags, tag } from "@nanobpm/urban/effect";
 import { abandonTokenFromUrl } from "../../app/abandon.ts";
@@ -59,6 +58,9 @@ const defaultReadReview: MergeReviewReader = (repo, prNumber) =>
 // bind (#786/#799), so the backstop's staleness comparison sees the exact head the gate did.
 const defaultReadHead: HeadReader = makeDefaultReadHead({ fetchPrHead, fetchBranchHead });
 
+const BLOCK_UNVERIFIABLE_REVIEW =
+  "the PR's Copilot review state or current HEAD could not be read, so a head-current reviewer verdict cannot be verified (the backstop fails CLOSED on an unverifiable read)";
+
 const BLOCK_NO_HEAD_CURRENT_REVIEW =
   "no head-current Copilot review exists for the PR's current HEAD (the head moved after the last review, or no review was ever submitted). A head-current reviewer verdict is required before landing";
 
@@ -132,26 +134,31 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // existed at all (the nano-bpm#1443 fail-open: merged with ZERO reviews), must not slip through
   // at land time. Runs AFTER the merged/closed short-circuits (an already-terminal PR needs no
   // verdict) and BEFORE any land protocol (the `@mergifyio queue` comment is itself the landing
-  // for a queue repo). Fails OPEN only when the GitHub state is UNREADABLE (no transport / a
-  // hiccup → `null` review or head): a transient read failure must not wedge every merge — the
-  // merge-stage mergeability polling is the independent backstop there.
+  // for a queue repo). Fails CLOSED on an UNREADABLE review/head too (issue #927).
   const [backstopReview, backstopHead] = await Promise.all([
     readReview(repo, prNumber).catch(() => null),
     readHeadSha(repo, prNumber).catch(() => null),
   ]);
-  if (backstopReview !== null && isReviewMissingOrStale(backstopReview.commitId, backstopHead)) {
+  // FAIL CLOSED (issue #927): a gate whose job is "never land unreviewed" must not land on an
+  // UNVERIFIABLE read. nano-bpm#1467 merged 49 s before its first Copilot review because a `null`
+  // review/head read (or an empty head) skipped this check entirely. An unreadable review or head now
+  // blocks (escalating to a human, who replies to retry) exactly like a missing/stale review.
+  const headTrimmed = (backstopHead ?? "").trim();
+  const unverifiable = backstopReview === null || headTrimmed === "";
+  if (unverifiable || isReviewMissingOrStale(backstopReview.commitId, headTrimmed)) {
+    const detail = unverifiable ? BLOCK_UNVERIFIABLE_REVIEW : BLOCK_NO_HEAD_CURRENT_REVIEW;
     await app.data.table("merges", "id").insert({
       pr_key: prKey,
       outcome: "blocked",
       method: "review-backstop",
-      detail: BLOCK_NO_HEAD_CURRENT_REVIEW,
+      detail,
       at: now,
     });
     return {
       mergeStatus: "blocked",
       status: "blocked",
       question:
-        `Merge refused: ${BLOCK_NO_HEAD_CURRENT_REVIEW}. ` +
+        `Merge refused: ${detail}. ` +
         `Push no further commits, wait for the Copilot review of the current HEAD to land (or request one: ` +
         `gh api repos/${repo}/pulls/${prNumber}/requested_reviewers -X POST -f "reviewers[]=copilot-pull-request-reviewer[bot]"), ` +
         `let the convergence loop gate on it, then reply to retry.`,
@@ -161,12 +168,8 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   // A head-current review whose OWN summary still reports open findings (the same canonical
   // verdict parser the converge-gate uses) must block too: a summary-only "Changes recommended"
   // review that landed after convergence has no unresolved thread for mergeability polling to see.
-  // Only evaluate the verdict once head-currentness is VERIFIED (review read AND head read succeeded
-  // and match) — an unreadable head fails open here like the stale check above, never blocking on a
-  // possibly-stale review's body.
-  const reviewIsHeadCurrent =
-    backstopReview !== null && backstopHead !== null && backstopHead !== "" && backstopReview.commitId === backstopHead;
-  const openFindings = reviewIsHeadCurrent ? parseReviewOpenFindings(backstopReview.body) : [];
+  // Head-currentness is VERIFIED at this point (the fail-closed check above returned otherwise).
+  const openFindings = parseReviewOpenFindings(backstopReview.body);
   if (openFindings.length > 0) {
     const detail = `the head-current Copilot review reports open findings (${openFindings.join(", ")})`;
     await app.data.table("merges", "id").insert({
@@ -186,7 +189,7 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
   }
   // The head the backstop verified — pinned through the land call so a push between this check
   // and the merge can never land a later, unreviewed head.
-  const verifiedHead = backstopReview !== null && backstopHead ? backstopHead : undefined;
+  const verifiedHead: string | undefined = headTrimmed;
 
   // Dead-end-base guard (#60): never land a PR into a base branch that has itself already merged
   // to the default branch — the merge would land into a dead branch and never reach `main`.
@@ -227,10 +230,14 @@ export function makeHandler(deps: { readReview: MergeReviewReader; readHeadSha:
     const comment = protocol?.land.comment ?? "@mergifyio queue";
     // A comment can't pin a SHA, so re-read the head right before enqueueing: if it moved past the
     // verified head, re-enter via the bounded retry (which re-runs the backstop on the new head).
-    const headNow = verifiedHead ? await readHeadSha(repo, prNumber).catch(() => null) : null;
-    if (verifiedHead && headNow !== null && headNow !== verifiedHead) {
+    // Fail CLOSED (#927): an unreadable re-read retries rather than enqueueing an unverified head.
+    const headNow = await readHeadSha(repo, prNumber).catch(() => null);
+    if (headNow === null || headNow.trim() !== verifiedHead) {
       outcome = "retry";
-      detail = `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
+      detail =
+        headNow === null
+          ? `head could not be re-read after the review backstop; re-verifying before enqueue`
+          : `head moved from ${verifiedHead} to ${headNow} after the review backstop; re-verifying before enqueue`;
     } else {
       const ok = await enqueueViaComment(repo, prNumber, token, comment);
       outcome = ok ? "queued" : "blocked";