@bongos/core 1.17.3 → 1.18.3

package/tests/package_core.mjs

@@ -16,6 +16,9 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const m = require('../scripts/gds/package-core.js');
@@ -25,14 +28,22 @@ const {
   ARTIFACT_NAME, MANIFEST_SCHEMA, TAR_ROOT,
   // task 1824 — the consumer-core file-classification layer
   isDocPath, functionalSecretLeaks, processCoreFile,
+  // idea 1000543 — npm-never-installed files dropped from the pin
+  isNpmStripped,
   // task 2121 — agent-doc (CLAUDE.md/AGENTS.md) stub
   isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
   // task 2089 (ADR 0134) — private-by-default npm publish
   publishArgs,
+  // task 1002218 (audit H3) — build-time self-verify pin reproduction
+  reproducePinFromTree,
+  // task 1002220 (audit H6) — post-build leak scan
+  scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
+  // task 1002217 (audit H4) — the fixed neutral floor
+  PRIOR_INSTANCE_FLOOR,
 } = m;
-const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/gds/mirror-redact.js');
+const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/gds/mirror-redact.js');
 
 // A synthetic instance brand for the classification tests (never the real OTB literals).
 const TEST_BRANDING = {
@@ -485,5 +496,239 @@ t('prunePackageLock: on the real repo lockfile, drops the vast majority of packa
   assert.ok(keptCount > 0);
 });
 
+// ---- task 1002218 (audit H3): build-time self-verify pin reproduction ----
+// Build a tiny unpacked tree + a matching sidecar manifest (same hash fns the packager uses),
+// then prove reproducePinFromTree accepts a faithful reproduction and rejects each tamper.
+function makeTreeAndSidecar() {
+  const root = mkdtempSync(join(tmpdir(), 'pc-selfverify-'));
+  const files = [
+    { path: 'src/a.js', content: 'module.exports = 1\n', mode: '0000644' },
+    { path: 'sub/dir/b.json', content: '{"k":2}\n', mode: '0000644' },
+    { path: 'bin/run.sh', content: '#!/bin/sh\necho hi\n', mode: '0000755' },
+  ];
+  for (const f of files) {
+    const abs = join(root, ...f.path.split('/'));
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, f.content);
+  }
+  const meta = files
+    .map((f) => ({ path: f.path, mode: normalizeMode(f.mode), sha256: sha256hex(Buffer.from(f.content)) }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const sidecar = { core_version: '9.9.9', tree_sha256: canonicalTreeHash(meta), files: meta, tarball: { sha256: 'abc123', bytes: 0 } };
+  return { root, sidecar, files };
+}
+
+t('reproducePinFromTree: a faithful tree reproduces the pin (ok, no problems)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    const r = reproducePinFromTree({ treeRoot: root, sidecar }); // no tgzPath → skip the tarball-bytes check
+    assert.equal(r.ok, true, r.problems.join('; '));
+    assert.equal(r.fileCount, 3);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a tampered file content → not ok (content mismatch)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    writeFileSync(join(root, 'src', 'a.js'), 'module.exports = 666 // tampered\n');
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /content mismatch: src\/a\.js/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a missing file → not ok (missing in artifact)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    rmSync(join(root, 'sub', 'dir', 'b.json'));
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /missing in artifact: sub\/dir\/b\.json/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a manifest whose tree_sha256 lies → not ok (tree hash mismatch)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    const lying = { ...sidecar, tree_sha256: 'f'.repeat(64) }; // every file matches, but the recorded hash is wrong
+    const r = reproducePinFromTree({ treeRoot: root, sidecar: lying });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /recomputed tree_sha256/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a .tgz whose bytes differ from manifest.tarball.sha256 → not ok', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  const tgz = join(root, 'artifact.tgz');
+  try {
+    writeFileSync(tgz, Buffer.from('the actual tarball bytes'));
+    const withTb = { ...sidecar, tarball: { sha256: sha256hex(Buffer.from('DIFFERENT bytes')), bytes: 24 } };
+    const r = reproducePinFromTree({ treeRoot: root, sidecar: withTb, tgzPath: tgz });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /\.tgz sha256/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+// ---- task 1002220 (audit H6): post-build leak scan ----
+t('scanArtifactForLeaks: flags a prior-instance literal in any shipped file', () => {
+  const files = [
+    { path: 'src/x.js', content: 'const base = "https://amazonprimea.com";\n' },
+    { path: 'docs/readme.md', content: 'Owned by lars589.\n' },
+    { path: 'src/clean.js', content: 'export const ok = true;\n' },
+  ];
+  const r = scanArtifactForLeaks(files);
+  const hitPaths = r.literalHits.map((h) => h.path);
+  assert.ok(hitPaths.includes('src/x.js'), 'amazonprimea in a functional file must be flagged');
+  assert.ok(hitPaths.includes('docs/readme.md'), 'owner login in a doc must be flagged too (literal scan spans all files)');
+  assert.ok(!hitPaths.includes('src/clean.js'), 'a clean file must not be flagged');
+});
+
+t('scanArtifactForLeaks: flags a public IP but not a private/localhost one', () => {
+  const r = scanArtifactForLeaks([
+    { path: 'a.js', content: 'host = 104.236.254.243\n' },   // public → flagged
+    { path: 'b.js', content: 'host = 127.0.0.1; lan = 10.0.0.5\n' }, // localhost + private → not
+  ]);
+  const byPath = Object.fromEntries(r.literalHits.map((h) => [h.path, h.label]));
+  assert.ok(byPath['a.js'] === 'public-ip', `expected a public-ip hit on a.js, got ${JSON.stringify(r.literalHits)}`);
+  assert.ok(!('b.js' in byPath), 'localhost/private IPs must not be flagged');
+});
+
+t('scanArtifactForLeaks: credential SHAPE warning fires on functional files, not docs', () => {
+  const key = `sk-ant-${'A1b2C3d4E5f6G7h8'}`; // a fake Anthropic-shaped token
+  const r = scanArtifactForLeaks([
+    { path: 'src/leak.js', content: `const k = "${key}";\n` },
+    { path: 'docs/guide.md', content: `example key: ${key}\n` }, // docs are redacted+gated elsewhere → not a shape warning here
+  ]);
+  const warnPaths = r.secretWarnings.map((w) => w.path);
+  assert.ok(warnPaths.includes('src/leak.js'), 'a credential shape in a functional file must warn');
+  assert.ok(!warnPaths.includes('docs/guide.md'), 'docs are out of scope for the credential-shape warning');
+  const w = r.secretWarnings.find((x) => x.path === 'src/leak.js');
+  assert.ok(w.shapes.includes('anthropic-key'), `expected anthropic-key shape, got ${JSON.stringify(w.shapes)}`);
+});
+
+t('scanArtifactForLeaks: ordinary long identifiers / base64 hashes do NOT warn (low false-positive)', () => {
+  const r = scanArtifactForLeaks([
+    { path: 'src/normal.js', content: 'const integrityHash = "sha512-Abc123Def456Ghi789Jkl012Mno345Pqr678";\nfunction reallyLongDescriptiveFunctionName() {}\n' },
+    { path: 'data.json', content: JSON.stringify({ sha256: 'a'.repeat(64), token: 'short' }) },
+  ]);
+  assert.equal(r.secretWarnings.length, 0, `no credential shapes expected, got ${JSON.stringify(r.secretWarnings)}`);
+});
+
+t('PRIOR_INSTANCE_LITERALS: carries the customer-zero tokens the neutral trunk must not ship', () => {
+  assert.ok(Array.isArray(PRIOR_INSTANCE_LITERALS) && PRIOR_INSTANCE_LITERALS.length >= 3);
+  // Case-insensitive: the floor tokens are lowercased for the redaction rules + findLeaks
+  // (both case-insensitive), so assert coverage, not exact case.
+  const lower = PRIOR_INSTANCE_LITERALS.map((s) => s.toLowerCase());
+  for (const lit of ['amazonprimea', 'off the boats', 'lars589']) {
+    assert.ok(lower.includes(lit), `floor list should cover ${lit}`);
+  }
+});
+
+// ---- task 1002217 (audit H4): the neutral floor gate (fails closed with no branding.json) ----
+t('neutral floor: with EMPTY branding + the floor as extra, docs de-brand and the gate covers the floor', () => {
+  // The F2 gap: with no branding.json, buildRedactionRules({})/collectSensitiveLiterals({}) are
+  // empty, so a doc keeps its prior-instance identity. Injecting PRIOR_INSTANCE_FLOOR as `extra`
+  // (exactly what package-core's main() now does) closes it.
+  const rules = buildRedactionRules({}, PRIOR_INSTANCE_FLOOR);
+  const lits = collectSensitiveLiterals({}, PRIOR_INSTANCE_FLOOR);
+  const doc = 'See https://amazonprimea.com, owned by lars589 — the Off the Boats world.';
+  const red = redactText(doc, rules);
+  assert.ok(!/amazonprimea/i.test(red), `amazonprimea survived: ${red}`);
+  assert.ok(!/lars589/i.test(red), `owner login survived: ${red}`);
+  assert.ok(!/off the boats/i.test(red), `product name survived: ${red}`);
+  assert.deepEqual(findLeaks(red, lits), [], `gate still sees a floor leak after redaction: ${JSON.stringify(findLeaks(red, lits))}`);
+});
+
+t('neutral floor: the fail-closed gate WOULD catch an un-redacted survivor (empty branding)', () => {
+  const lits = collectSensitiveLiterals({}, PRIOR_INSTANCE_FLOOR);
+  // If a doc reached the gate still carrying a floor literal, findLeaks (the fail-closed detector)
+  // flags it — which aborts the build in package-core (atomic, produces nothing).
+  assert.ok(findLeaks('leftover amazonprimea reference', lits).length > 0, 'floor token must be gated');
+  assert.ok(findLeaks('signed off by lars589', lits).length > 0, 'floor owner must be gated');
+});
+
+t('neutral floor: WITHOUT the floor, empty branding leaks (proves the floor is what closes F2)', () => {
+  // The counterfactual — the pre-H4 neutral-trunk behavior: empty branding + no floor = no rules,
+  // no gate literals, so the doc ships its prior-instance identity verbatim.
+  const rules = buildRedactionRules({});
+  const lits = collectSensitiveLiterals({});
+  const doc = 'amazonprimea + lars589';
+  assert.equal(redactText(doc, rules).includes('amazonprimea'), true, 'no-floor redaction is a no-op (the F2 gap)');
+  assert.equal(findLeaks(doc, lits).length, 0, 'no-floor gate sees nothing (the F2 gap)');
+});
+
+// ---- idea 1000543: npm-never-installed files are dropped from the pin ----
+// npm strips .gitignore/.npmignore/.npmrc from an installed package, so a pin that
+// LISTS one fails when a consumer recomputes the tree hash over node_modules/@bongos/core
+// (verifyInstalledPin, upgrade.js) -> the vendored `bongos upgrade` auto-rolls-back.
+t('isNpmStripped: matches .gitignore/.npmignore/.npmrc at root and any depth', () => {
+  assert.equal(isNpmStripped('.gitignore'), true);
+  assert.equal(isNpmStripped('.npmignore'), true);
+  assert.equal(isNpmStripped('.npmrc'), true);
+  assert.equal(isNpmStripped('modules/economy/.gitignore'), true); // npm strips nested ones too
+  assert.equal(isNpmStripped('a/b/c/.npmrc'), true);
+});
+
+t('isNpmStripped: does NOT match ordinary files or basename lookalikes', () => {
+  assert.equal(isNpmStripped('src/index.js'), false);
+  assert.equal(isNpmStripped('package.json'), false);
+  assert.equal(isNpmStripped('docs/.gitignore.md'), false); // .gitignore is not the basename here
+  assert.equal(isNpmStripped('gitignore'), false);          // no leading dot
+  assert.equal(isNpmStripped('src/.gitignoreignore'), false);
+  assert.equal(isNpmStripped(''), false);
+  assert.equal(isNpmStripped(null), false);
+});
+
+t('the packager selection drops the stripped files from the pinned set (models main())', () => {
+  const treePaths = ['.gitignore', 'src/a.js', 'migrations/001.sql', 'modules/x/.npmrc', 'README.md'];
+  const kept = treePaths.filter((p) => !isNpmStripped(p)); // exactly main()'s `publishable` filter
+  assert.deepEqual(kept, ['src/a.js', 'migrations/001.sql', 'README.md']);
+});
+
+// End-to-end proof against the consume-side recompute. reproducePinFromTree and upgrade.js's
+// verifyInstalledPin both iterate manifest.files[] and rebuild canonicalTreeHash, so a manifest
+// that LISTS .gitignore fails when npm has stripped it (the bug); a manifest built through the
+// isNpmStripped filter does not list it and reproduces cleanly (the fix).
+function buildManifestAndNpmInstalledTree({ includeGitignore }) {
+  const root = mkdtempSync(join(tmpdir(), 'pc-npmstrip-'));
+  const treeFiles = [ // the FULL git tree the packager enumerates, incl. a tracked .gitignore
+    { path: '.gitignore', content: 'dist/\nnode_modules/\n' },
+    { path: 'src/a.js', content: 'module.exports = 1\n' },
+    { path: 'package.json', content: '{"name":"@bongos/core"}\n' },
+  ];
+  // What the packager PINS: pre-fix keeps everything; post-fix drops the npm-stripped files.
+  const pinned = treeFiles.filter((f) => (includeGitignore ? true : !isNpmStripped(f.path)));
+  const files = pinned
+    .map((f) => ({ path: f.path, mode: normalizeMode('100644'), sha256: sha256hex(Buffer.from(f.content)) }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const sidecar = { core_version: '9.9.9', tree_sha256: canonicalTreeHash(files), files };
+  // What `npm install` ACTUALLY materializes: everything EXCEPT the files npm strips.
+  for (const f of treeFiles) {
+    if (isNpmStripped(f.path)) continue; // npm never writes .gitignore into the installed package
+    const abs = join(root, ...f.path.split('/'));
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, f.content);
+  }
+  return { root, sidecar };
+}
+
+t('idea 1000543 (the bug): a manifest that PINS .gitignore FAILS against an npm-installed tree', () => {
+  const { root, sidecar } = buildManifestAndNpmInstalledTree({ includeGitignore: true });
+  try {
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false, 'pinning .gitignore must fail once npm has stripped it');
+    assert.ok(r.problems.some((p) => /\.gitignore/.test(p)), `expected a .gitignore problem, got: ${r.problems.join('; ')}`);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('idea 1000543 (the fix): the isNpmStripped filter makes the pin reproduce against the npm-installed tree', () => {
+  const { root, sidecar } = buildManifestAndNpmInstalledTree({ includeGitignore: false });
+  try {
+    assert.ok(!sidecar.files.some((f) => f.path === '.gitignore'), 'the fixed manifest must not list .gitignore');
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, true, `the fixed manifest must reproduce; problems: ${r.problems.join('; ')}`);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provision.mjs

@@ -100,6 +100,35 @@ t('standalone step generators: root under standaloneBase + pull / npm-ci / insta
   assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@bongos\/core\/scripts\/migrate\.sh/);
 });
 
+// ── nightly DB backup units (task 2213 — productizes the manual 2210 fix) ──────
+t('backup units: per-instance names + the DB set on the unit (fixes the task-2210 unset GDS_BACKUP_DB)', () => {
+  assert.equal(P.backupUnitName(coTenant), 'mercury-db-backup');
+  assert.equal(P.backupServicePath(coTenant), '/etc/systemd/system/mercury-db-backup.service');
+  assert.equal(P.backupTimerPath(coTenant), '/etc/systemd/system/mercury-db-backup.timer');
+  const svc = P.backupService(coTenant);
+  // the DB is pinned on the unit → no fallback to the nonexistent amazonprimea default
+  assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
+  assert.match(svc, /Environment=GDS_BACKUP_DIR=\/var\/backups\/gds/);
+  assert.match(svc, new RegExp(`User=${reEsc('lars')}`), 'runs as the app user (mirrors serviceUnit)');
+  assert.match(svc, /ReadWritePaths=\/var\/backups\/gds/, 'the only writable path is the backup dir');
+  const timer = P.backupTimer(coTenant);
+  assert.match(timer, /OnCalendar=\*-\*-\* 04:00:00 UTC/);
+  assert.match(timer, /Unit=mercury-db-backup\.service/, 'the timer drives the per-instance service');
+});
+
+t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/amazonprimea monorepo path', () => {
+  // standalone → the script inside the instance's OWN pinned @bongos/core
+  const standalone = { ...coTenant, hosting_shape: 'standalone' };
+  const sPath = P.backupScriptPath(standalone);
+  assert.ok(sPath.startsWith(P.standaloneRoot(standalone) + '/'), 'under the instance root');
+  assert.match(sPath, /node_modules\/@bongos\/core\/scripts\/gds\/db-backup-nightly\.sh$/);
+  // co-tenant → this control-plane checkout's scripts/gds (mirrors serviceUnit's REPO_ROOT split)
+  assert.match(P.backupScriptPath(coTenant), /\/scripts\/gds\/db-backup-nightly\.sh$/);
+  // the regression this whole task fixes: NEVER the hardcoded old monorepo path
+  assert.doesNotMatch(P.backupService(standalone), /\/home\/lars\/amazonprimea/);
+  assert.doesNotMatch(P.backupService(coTenant), /\/home\/lars\/amazonprimea/);
+});
+
 t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + brand/port/db', () => {
   const b = P.webEnvBody(coTenant); // coTenant.domain === null
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
@@ -280,6 +309,27 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   assert.ok(writes.some((w) => /\/mercury\/web\.env$/.test(w)), 'wrote web.env');
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote systemd unit');
   assert.ok(writes.some((w) => /\/mercury\.caddy$/.test(w)), 'wrote per-instance Caddy snippet');
+  // task 2213: EVERY instance is born with backups — dir + per-instance timer/service
+  assert.match(joined, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
+  assert.match(joined, /systemctl enable --now mercury-db-backup\.timer/, 'enables the per-instance backup timer');
+  assert.ok(writes.some((w) => /\/mercury-db-backup\.service$/.test(w)), 'wrote backup service unit');
+  assert.ok(writes.some((w) => /\/mercury-db-backup\.timer$/.test(w)), 'wrote backup timer unit');
+  // the backup timer is enabled AFTER the dir exists (else the first run exits 2)
+  assert.ok(idx(/install -d .*\/var\/backups\/gds/) < idx(/enable --now mercury-db-backup\.timer/), 'dir before timer enable');
+});
+
+await ta('provisionInstance(standalone): the backup unit ExecStart points at the instance\'s OWN pinned core (consumer layout)', async () => {
+  const { deps, writes } = recorder();
+  // capture the unit BODIES, not just paths, so we can assert the ExecStart path
+  const bodies = {};
+  deps.writeFile = (p, body) => { writes.push(p); bodies[p] = body; return { ok: true }; };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' };
+  await P.provisionInstance(inst, deps);
+  const svc = bodies[P.backupServicePath(inst)];
+  assert.ok(svc, 'wrote the backup service unit');
+  const root = P.standaloneRoot(inst);
+  assert.match(svc, new RegExp('ExecStart=/bin/bash ' + reEsc(root) + '/node_modules/@bongos/core/scripts/gds/db-backup-nightly\\.sh'));
+  assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
@@ -427,6 +477,22 @@ await ta('provisionInstance(dedicated) does NOT run local createdb/migrate/seed
   assert.ok(!cmds.some((c) => /INSERT INTO versions/.test(c)), 'dedicated does not run the version seed locally (it rides cloud-init)');
 });
 
+await ta('dedicatedUserData bakes the nightly backup: unit files (b64) + dir + timer enable (task 2213)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'dedicated' };
+  const cloudInit = P.dedicatedUserData(inst);
+  // the two unit files land via write_files (base64, so no YAML block-scalar escaping)
+  assert.match(cloudInit, /write_files:/);
+  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupServicePath(inst))));
+  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupTimerPath(inst))));
+  assert.match(cloudInit, /encoding: b64/);
+  // the base64 content round-trips to a real unit carrying the right DB
+  const b64 = cloudInit.match(/content: ([A-Za-z0-9+/=]+)/)[1];
+  assert.match(Buffer.from(b64, 'base64').toString('utf8'), /Environment=GDS_BACKUP_DB=mercury/);
+  // and the dir is created + the timer enabled on first boot
+  assert.match(cloudInit, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/);
+  assert.match(cloudInit, /enable --now mercury mercury-db-backup\.timer/);
+});
+
 console.log('\nDNS UPSERT composition (P4, CONFIG override):');
 
 // A recorder that also captures each exec's env (so we can assert the DNS hook env).
@@ -739,6 +805,9 @@ await ta('teardownInstance(privileged): systemctl + rm-under-/etc are sudo-prefi
   assert.match(joined, /sudo systemctl disable --now mercury/);
   assert.match(joined, /sudo rm -f \/etc\/systemd\/system\/mercury\.service/);
   assert.match(joined, /sudo systemctl daemon-reload/);
+  // task 2213: the backup units come down too (the dumps + dir are left in place)
+  assert.match(joined, /sudo systemctl disable --now mercury-db-backup\.timer/);
+  assert.match(joined, /sudo rm -f \/etc\/systemd\/system\/mercury-db-backup\.service \/etc\/systemd\/system\/mercury-db-backup\.timer/);
 });
 
 await ta('teardownInstance(default): NO sudo (bare, unchanged)', async () => {
@@ -900,5 +969,162 @@ await ta('teardownInstance(standalone, remote): tears down on the CONTROL PLANE
   assert.equal(box.length, 0, 'nothing crosses to the co-hosting box for a standalone teardown');
 });
 
+console.log('\ncross-site identity federation (ADR 0141 §4, task #1002109):');
+
+// Fakes for the hub-side module handles provisioning is injected. hubKeysOn = a
+// hub-configured control plane; hubKeysOff = signing key unset. fakePI records every
+// registerClient call so we can assert the (security-critical) origin binding.
+const hubKeysOn = { hubSigningConfigured: () => true, hubPublicKeyB64: () => 'HUBPUBKEYB64==' };
+const hubKeysOff = { hubSigningConfigured: () => false, hubPublicKeyB64: () => null };
+function fakePI() { const calls = []; return { calls, registerClient: async (a) => { calls.push(a); return { client_id: a.clientId }; } }; }
+function withEnv(vars, fn) {
+  const saved = {};
+  for (const k of Object.keys(vars)) { saved[k] = process.env[k]; if (vars[k] === undefined) delete process.env[k]; else process.env[k] = vars[k]; }
+  const restore = () => { for (const k of Object.keys(saved)) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]; } };
+  // Promise-aware: for an async fn, restore only AFTER it settles (a plain try/finally
+  // would restore synchronously, before the awaited body ever reads the env).
+  let result;
+  try { result = fn(); } catch (e) { restore(); throw e; }
+  if (result && typeof result.then === 'function') return result.then((v) => { restore(); return v; }, (e) => { restore(); throw e; });
+  restore();
+  return result;
+}
+const HUB_ENV = { PROVISION_HUB_ORIGIN: 'https://cloudbongos.com', [`${NEUTRAL_PREFIX}_PUBLIC_ORIGIN`]: undefined };
+const coTenantWithDomain = { ...coTenant, domain: 'mercury.example.com' };
+
+t('federationHubOrigin: explicit PROVISION_HUB_ORIGIN wins; falls back to <PREFIX>_PUBLIC_ORIGIN; strips trailing slash; null when neither', () => {
+  withEnv({ PROVISION_HUB_ORIGIN: 'https://hub.example/', [`${NEUTRAL_PREFIX}_PUBLIC_ORIGIN`]: 'https://own.example' }, () => {
+    assert.equal(P.federationHubOrigin(), 'https://hub.example', 'explicit wins + trailing slash stripped');
+  });
+  withEnv({ PROVISION_HUB_ORIGIN: undefined, [`${NEUTRAL_PREFIX}_PUBLIC_ORIGIN`]: 'https://own.example/' }, () => {
+    assert.equal(P.federationHubOrigin(), 'https://own.example', 'falls back to the control plane\'s own public origin');
+  });
+  withEnv({ PROVISION_HUB_ORIGIN: undefined, [`${NEUTRAL_PREFIX}_PUBLIC_ORIGIN`]: undefined }, () => {
+    assert.equal(P.federationHubOrigin(), null, 'null when nothing is configured (→ not hub-configured)');
+  });
+});
+
+t('shouldFederate: dormant unless hub-configured AND co-tenant AND a domain is set', () => {
+  withEnv(HUB_ENV, () => {
+    // the happy path
+    assert.equal(P.shouldFederate(coTenantWithDomain, { platformIdentity: fakePI(), hubKeys: hubKeysOn }).federate, true, 'co-tenant + hub-configured + domain → federate');
+    // each guard, in turn
+    assert.equal(P.shouldFederate(coTenantWithDomain, { platformIdentity: null, hubKeys: hubKeysOn }).federate, false, 'module absent (not the hub) → skip');
+    assert.equal(P.shouldFederate(coTenantWithDomain, { platformIdentity: fakePI(), hubKeys: hubKeysOff }).federate, false, 'no signing key → skip');
+    assert.equal(P.shouldFederate({ ...coTenantWithDomain, domain: null }, { platformIdentity: fakePI(), hubKeys: hubKeysOn }).federate, false, 'no domain → skip');
+    // a standalone (owner-hosted) keeps its own GitHub app; a dedicated droplet has no local web.env bake yet
+    assert.equal(P.shouldFederate({ ...coTenantWithDomain, hosting_shape: 'standalone' }, { platformIdentity: fakePI(), hubKeys: hubKeysOn }).federate, false, 'standalone = self-hosted → skip');
+    assert.equal(P.shouldFederate({ ...coTenantWithDomain, hosting_shape: 'dedicated' }, { platformIdentity: fakePI(), hubKeys: hubKeysOn }).federate, false, 'dedicated → skip (no local web.env yet)');
+  });
+  // no hub origin resolvable (even with a signing key) → skip
+  withEnv({ PROVISION_HUB_ORIGIN: undefined, [`${NEUTRAL_PREFIX}_PUBLIC_ORIGIN`]: undefined }, () => {
+    assert.equal(P.shouldFederate(coTenantWithDomain, { platformIdentity: fakePI(), hubKeys: hubKeysOn }).federate, false, 'no hub origin → skip');
+  });
+});
+
+t('webEnvBody(federation): flips <PREFIX>_AUTH_IDP + writes the HUB_* block; GitHub creds stay blank; NO block without federation', () => {
+  const federation = { hubOrigin: 'https://cloudbongos.com', clientId: 'mercury', clientSecret: 'S'.repeat(43), hubPublicKey: 'PUB==' };
+  const b = P.webEnvBody(coTenantWithDomain, { federation });
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_AUTH_IDP=true`), 'flips the federation switch auth.js idpEnabled() reads');
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_HUB_ORIGIN=https://cloudbongos\\.com`));
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_HUB_CLIENT_ID=mercury`));
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_HUB_CLIENT_SECRET=S{43}`));
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_HUB_PUBLIC_KEY=PUB==`));
+  // a federated instance needs no GitHub app of its own → those creds stay blank
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=\\n`), 'GitHub id blank (federated)');
+  // regression: a non-federated write carries NO hub block + NO AUTH_IDP flip
+  const plain = P.webEnvBody(coTenantWithDomain);
+  assert.doesNotMatch(plain, /_AUTH_IDP=/, 'default (unset) never flips federation on');
+  assert.doesNotMatch(plain, /_HUB_ORIGIN=/, 'default write carries no hub block');
+});
+
+t('branding: <PREFIX>_AUTH_IDP env override flips auth.idp to a real boolean (idpEnabled reads === true)', () => {
+  const requireB = createRequire(import.meta.url);
+  const branding = requireB('../src/branding.js');
+  const neutral = { envPrefix: NEUTRAL_PREFIX, llmProjectName: 'x', identity: { productName: 'x', worldName: 'w' }, domains: { publicOrigin: 'https://x', buildersOrigin: 'https://x', statusOrigin: 'https://x', oauthOrigin: 'https://x' }, auth: { idp: false } };
+  const off = branding.resolveBranding({ neutral, instance: {}, env: {} });
+  assert.equal(off.auth.idp, false, 'unset → stays false (dormant default)');
+  const on = branding.resolveBranding({ neutral, instance: {}, env: { [`${NEUTRAL_PREFIX}_AUTH_IDP`]: 'true' } });
+  assert.equal(on.auth.idp, true, 'the string "true" coerces to boolean true (not the string, which would fail === true)');
+  assert.strictEqual(typeof on.auth.idp, 'boolean', 'coerced to a real boolean');
+});
+
+await ta('federateInstance(--apply): registers the client on the hub bound to the EXACT origin (the #1002108 takeover fix), returns the env block', async () => {
+  await withEnv(HUB_ENV, async () => {
+    const pi = fakePI();
+    const deps = { apply: true, log: () => {}, platformIdentity: pi, hubKeys: hubKeysOn, db: { query: async () => ({ rows: [{ github_id: 'gh-owner-1' }] }) } };
+    const block = await P.federateInstance(coTenantWithDomain, deps);
+    assert.equal(pi.calls.length, 1, 'registered exactly once');
+    const reg = pi.calls[0];
+    assert.equal(reg.origin, 'https://mercury.example.com', 'origin is the instance EXACT public origin (hub binds the mint audience to it)');
+    assert.equal(reg.clientId, 'mercury', 'client_id is the stable slug (re-provision rotates the same row)');
+    assert.ok(reg.redirectUris.includes('https://mercury.example.com/api/gds/auth/web/callback'), 'registers the exact browser callback the instance sends');
+    assert.equal(reg.ownerGithubId, 'gh-owner-1', 'threads the owner github_id for the catalog');
+    assert.ok(typeof reg.secret === 'string' && reg.secret.length >= 32, 'a strong per-client secret was generated');
+    // the block webEnvBody bakes in
+    assert.equal(block.hubOrigin, 'https://cloudbongos.com');
+    assert.equal(block.clientId, 'mercury');
+    assert.equal(block.clientSecret, reg.secret, 'the secret written to the instance is the one registered on the hub');
+    assert.equal(block.hubPublicKey, 'HUBPUBKEYB64==', 'the hub PUBLIC key (for offline assertion verify) rides along');
+  });
+});
+
+await ta('federateInstance(dry-run): registers NOTHING, returns a placeholder block (so webEnvBody can still compose)', async () => {
+  await withEnv(HUB_ENV, async () => {
+    const pi = fakePI();
+    const block = await P.federateInstance(coTenantWithDomain, { apply: false, log: () => {}, platformIdentity: pi, hubKeys: hubKeysOn, db: { query: async () => ({ rows: [] }) } });
+    assert.equal(pi.calls.length, 0, 'dry-run performs no hub write');
+    assert.equal(block.clientId, 'mercury');
+    assert.equal(block.hubPublicKey, 'HUBPUBKEYB64==');
+  });
+});
+
+await ta('provisionInstance(co-tenant, hub-configured): bakes the HUB block into web.env, records a "federated" event, registers the client', async () => {
+  await withEnv(HUB_ENV, async () => {
+    const { deps } = recorder({ apply: true });
+    const bodies = {}; const events = []; const pi = fakePI();
+    deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+    deps.provisioning.recordEvent = async (_db, e) => { events.push(e.event); };
+    deps.platformIdentity = pi; deps.hubKeys = hubKeysOn;
+    await P.provisionInstance(coTenantWithDomain, deps);
+    const env = bodies[P.webEnvPath(coTenantWithDomain)];
+    assert.ok(env, 'wrote the per-instance web.env');
+    assert.match(env, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_AUTH_IDP=true`), 'the co-tenant comes up already federated');
+    assert.match(env, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_HUB_CLIENT_SECRET=`), 'hub creds baked into web.env');
+    assert.ok(events.includes('federated'), 'records the federation event for the audit trail');
+    assert.equal(pi.calls.length, 1, 'registered the client on the hub');
+    assert.equal(pi.calls[0].origin, 'https://mercury.example.com');
+  });
+});
+
+await ta('provisionInstance: a NON-hub control plane (no module/key) does NOT federate — the instance owns its auth (unchanged)', async () => {
+  await withEnv(HUB_ENV, async () => {
+    const { deps } = recorder({ apply: true });
+    const bodies = {};
+    deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+    // default recorder has no platformIdentity/hubKeys → shouldFederate skips
+    await P.provisionInstance(coTenantWithDomain, deps);
+    const env = bodies[P.webEnvPath(coTenantWithDomain)];
+    assert.ok(env, 'wrote web.env');
+    assert.doesNotMatch(env, /_AUTH_IDP=/, 'no federation flip on a non-hub control plane');
+    assert.doesNotMatch(env, /_HUB_ORIGIN=/, 'no hub block — the direct-GitHub path, byte-identical to today');
+  });
+});
+
+await ta('provisionInstance(standalone, hub-configured): still NOT federated — owner-hosted keeps its own GitHub app', async () => {
+  await withEnv(HUB_ENV, async () => {
+    const { deps } = recorder({ apply: true });
+    const bodies = {}; const pi = fakePI();
+    deps.controlWriteFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+    deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+    deps.platformIdentity = pi; deps.hubKeys = hubKeysOn;
+    await P.provisionInstance({ ...coTenantWithDomain, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
+    const env = bodies[P.webEnvPath({ ...coTenantWithDomain, hosting_shape: 'standalone' })];
+    assert.ok(env, 'wrote web.env');
+    assert.doesNotMatch(env, /_AUTH_IDP=/, 'standalone is the self-hosted path — no federation');
+    assert.equal(pi.calls.length, 0, 'no hub registration for a standalone');
+  });
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/pruned_lockfile_integrity.mjs

@@ -0,0 +1,79 @@
+// tests/pruned_lockfile_integrity.mjs
+//
+// task 1002221 / audit H2 (finding F5, the R88 failure class) — a STANDING guard on the exact
+// thing that broke in R88: the original packager redacted the lockfile and BLANKED the npm
+// integrity hashes (base64 → "looks like a secret" → replaced), so `npm ci` from the shipped
+// pruned lockfile could no longer verify its packages. The fix (docs-redacted / functional-verbatim,
+// task 1824) keeps lockfiles verbatim. This test proves it stays fixed WITHOUT a network or a DB:
+// build the pruned lockfile package-core ships and assert every registry-resolved package keeps a
+// well-formed Subresource-Integrity hash. A regression that blanks/garbles integrity RED-flags here,
+// in the fast unit gate, on every PR — long before a consumer's `npm ci` fails in the field.
+//
+// Complements tests/consumer_layout_boot.mjs (the live install+boot proof, run via
+// `run-unit-tests.js --integration`): this is the network-free half of "PROVE PUBLISH".
+//
+// Run:  node tests/pruned_lockfile_integrity.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { prunePackageLock, CORE_DEP_NAMES } = require('../scripts/gds/package-core.js');
+const realLock = require('../package-lock.json');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// A well-formed Subresource Integrity string: <algo>-<base64>. This is exactly what R88 destroyed
+// (the base64 payload got redacted to a placeholder), so an intact match here IS the regression guard.
+const SRI_RE = /^sha(?:512|384|256|1)-[A-Za-z0-9+/]+={0,2}$/;
+const isRegistryResolved = (v) => typeof v.resolved === 'string' && /^https?:\/\//.test(v.resolved);
+
+const pruned = prunePackageLock(realLock, {
+  name: '@bongos/core', version: '0.0.0-test',
+  rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+});
+
+t('pruned lockfile: non-trivial and closes over the core deps (express + pg present)', () => {
+  const keys = Object.keys(pruned.packages || {});
+  assert.ok(keys.length > 2, `pruned lockfile is suspiciously empty (${keys.length} entries)`);
+  assert.ok(pruned.packages['node_modules/express'], 'express missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/pg'], 'pg missing from the pruned closure');
+});
+
+t('pruned lockfile: EVERY registry-resolved package keeps a well-formed integrity hash (R88 guard)', () => {
+  const bad = [];
+  let checked = 0;
+  for (const [name, v] of Object.entries(pruned.packages || {})) {
+    if (!v || typeof v !== 'object' || !isRegistryResolved(v)) continue; // skip root / link: / file: entries
+    checked++;
+    if (typeof v.integrity !== 'string' || !SRI_RE.test(v.integrity)) {
+      bad.push(`${name} → integrity=${JSON.stringify(v.integrity)}`);
+    }
+  }
+  assert.ok(checked > 0, 'no registry-resolved packages found to check — closure computed wrong?');
+  assert.equal(bad.length, 0,
+    `${bad.length}/${checked} registry package(s) have a blanked/garbled integrity (the R88 break):\n        ${bad.slice(0, 10).join('\n        ')}`);
+});
+
+t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rewritten)', () => {
+  // Stronger than "well-formed": each kept entry's integrity must be BYTE-IDENTICAL to the source
+  // lockfile's — proving the pruning copies verbatim and never transforms the hash.
+  const mismatched = [];
+  for (const [name, v] of Object.entries(pruned.packages || {})) {
+    if (!v || !isRegistryResolved(v)) continue;
+    const src = realLock.packages[name];
+    if (src && src.integrity && src.integrity !== v.integrity) mismatched.push(name);
+  }
+  assert.equal(mismatched.length, 0, `integrity rewritten for: ${mismatched.slice(0, 10).join(', ')}`);
+});
+
+t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg)', () => {
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg'));
+});
+
+console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);