@bongos/core 1.19.1035 → 1.19.1036

package/modules/provisioning/core-upgrade-authz.js

@@ -0,0 +1,85 @@
+'use strict';
+
+// modules/provisioning/core-upgrade-authz.js — who may move ONE hosted project's core
+// pin: its owner, or a holder of `core.pin.move` (task 1004174, ADR 0339).
+//
+// THE OWNER'S RULING, 2026-09-26: only a project's owner upgrades it — "owners and
+// archons are the same" for the platform operator, because the operator owns the
+// platform. Until this file the deploy door was `core.pin.move` alone: archon-floor
+// and system:true, so the owner of a hosted project below Archon could see that they
+// were behind and could never act on it. The door stays on the control plane (ADR
+// 0293 D1): a hosted project hands its owner off to this hub's /deploy?project=<slug>
+// and gains no capability of its own.
+//
+// THE SHAPE IS THE ONE THE MODULE ALREADY USES FOR "OWNER OR OPERATOR" (ADR 0328
+// Decision 2, and platform-identity's requireScoutingReader, ADR 0210). Ownership is
+// asked FIRST; on any "no" — not the owner, no such row, an unreadable id, a database
+// blip — the request falls through to the UNMODIFIED permission gate. So a caller who
+// is neither gets byte-for-byte the refusal the door has always given, whether or not
+// the id exists, and the widening can only ever admit. The atom is still spelled in
+// the route's middleware list, where route-rank-check.js and gen-api-docs.js read it.
+//
+// THE PLATFORM'S OWN ROW IS NOT A PROJECT AN OWNER MAY MOVE HERE. Moving the control
+// plane changes the code every hosted project is driven by, so it stays on the atom:
+// OWNER_SHAPES admits the two tenant shapes and nothing else, and a shape added later
+// is excluded by omission.
+
+// The tenant shapes the runner can actually reach (UPGRADE_SHAPES minus the platform).
+const OWNER_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host']));
+
+// An id as the route names it: a positive integer and nothing else. Anything else is
+// not looked up at all — it falls to the permission gate, and the handler's own
+// parseId gives the 400 an admitted caller would get.
+const ID_RE = /^[1-9][0-9]{0,15}$/;
+
+/**
+ * Does this builder own this instance in a way that lets them move its core? PURE.
+ * Fail-closed on every missing piece: no row, no builder, no recorded owner, or a
+ * shape that is not a tenant.
+ */
+function ownsUpgradableProject(inst, builder) {
+  return !!inst && !!builder && builder.id != null
+    && OWNER_SHAPES.has(inst.hosting_shape)
+    && inst.owner_builder_id != null
+    && String(inst.owner_builder_id) === String(builder.id);
+}
+
+/**
+ * The OR gate, as one middleware mounted after requireBuilder. `pinGate` is the
+ * ALREADY-BUILT `requirePermission('core.pin.move')` middleware.
+ *
+ * It records WHICH door admitted the caller on `req.coreUpgradeAuthority`, because
+ * the intent's actor has to say so truthfully (coreUpgradeActor below).
+ */
+function requireOwnProjectOrPin({ pinGate, provisioning, pool, log }) {
+  return async function ownProjectOrPinGate(req, res, next) {
+    const raw = req.params ? req.params.id : undefined;
+    if (typeof raw === 'string' && ID_RE.test(raw)) {
+      try {
+        const inst = await provisioning.getInstanceById(pool, Number(raw));
+        if (ownsUpgradableProject(inst, req.builder)) {
+          req.coreUpgradeAuthority = 'owner';
+          return next();
+        }
+      } catch (err) {
+        // Message only: a query error can carry row data. The permission gate below
+        // then decides, so a blip here can deny an owner but never admit anyone.
+        if (log && log.error) log.error(`core-upgrade owner check failed, falling back to core.pin.move: ${err && err.message}`);
+      }
+    }
+    req.coreUpgradeAuthority = 'pin';
+    return pinGate(req, res, next);
+  };
+}
+
+/**
+ * The actor recorded on the intent and the event. Both forms carry the builder id,
+ * because the runner hands it to the core_upgrades ledger as `--requested-by` and
+ * ADR 0293 D5 refuses an unattributed row for a move an HTTP request started.
+ */
+function coreUpgradeActor(req) {
+  const door = req.coreUpgradeAuthority === 'owner' ? 'owner' : 'archon';
+  return `api:${door}:${req.builder.id}`;
+}
+
+module.exports = { OWNER_SHAPES, ownsUpgradableProject, requireOwnProjectOrPin, coreUpgradeActor };

package/modules/provisioning/core-upgrade.js

@@ -177,7 +177,8 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       // The actor rides the intent, and the runner carries it through to the
       // core_upgrades ledger (ADR 0293 D5): a privileged action with an
       // unattributed row is not acceptable here.
-      const actor = `api:archon:${req.builder.id}`;
+      // `api:owner:<id>` when the project's owner pressed it (task 1004174), else `api:archon:<id>`.
+      const actor = require('./core-upgrade-authz').coreUpgradeActor(req);
       // `dry_run: true` asks what the move WOULD do and moves nothing (task 1004121).
       // Queued the same way as the move, through the same single-open-intent slot, so a
       // preview cannot be requested on top of a move that is already running — and, just

package/modules/provisioning/provisioning.js

@@ -1158,9 +1158,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 // delete hostage would repeat 1002691. A pending 'restart' or 'repo-private' (task 1004193) joins them for the same
 // reason (task 1003238) — and more sharply, since the owner reaches for Restart
 // precisely when a project looks broken, which is also when they give up and delete
-// it. A RUNNING intent is mid-flight and never yanked —
-// the caller gets { conflict: 'open_intent' } with the blocking intent so the route
-// can answer truthfully. Each statement is atomic and the index stays the arbiter:
+// it. A RUNNING intent is mid-flight and never yanked — the caller gets { conflict: 'open_intent' } with the blocking intent so the route
+// can answer truthfully. The control-plane row is never superseded, in the same statement (task 1004286): enqueueIntent's guard refuses its
+// teardown, and a refused teardown must cancel nothing (it used to cancel a pending restart). Each statement is atomic, the index the arbiter:
 // any interleaving with the runner or a concurrent enqueue lands on one of these
 // truthful outcomes.
 async function enqueueTeardown(db, instanceId, requestedBy) {
@@ -1169,7 +1169,7 @@ async function enqueueTeardown(db, instanceId, requestedBy) {
         SET state = 'error', last_error = 'superseded: teardown requested',
             updated_at = now(), resolved_at = now()
       WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
-      RETURNING id`,
+        AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
   const { intent, created } = await enqueueIntent(db, instanceId, 'teardown', requestedBy);

package/modules/provisioning/routes/core-upgrade.js

@@ -26,6 +26,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
 const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler } = require('../core-upgrade');
+const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
@@ -40,6 +41,11 @@ module.exports = function buildCoreUpgradeRouter() {
   // and not `requireRank`: tests/government_require_permission.mjs fails the build
   // on a new requireRank in a modules/*/routes gate.
   //
+  // OR THE PROJECT'S OWN OWNER (task 1004174, ADR 0339 — the owner's ruling that only
+  // a project's owner upgrades it). Ownership of a TENANT row is asked first; any other
+  // caller meets the unmodified `core.pin.move` gate and its unchanged refusal. The
+  // platform's own row is not an owner's to move here — it stays on the atom.
+  //
   // Body: { to: "1.19.757" } — and requiring it IS the second step of the two-step
   // the owner asked for (ADR 0293 D4). A request that cannot fire without naming
   // its target cannot fire from a stray click, and "move to whatever is newest",
@@ -55,7 +61,7 @@ module.exports = function buildCoreUpgradeRouter() {
   router.post(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradeHandler({
       provisioning,
       pool: api.pool,
@@ -71,19 +77,19 @@ module.exports = function buildCoreUpgradeRouter() {
   // core version and how far behind it is, which is a vulnerability-window disclosure —
   // precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview
   // anyone could read would also let an attacker time a request against a known-stale
-  // window. The read being no cheaper than the write costs the owner nothing: they hold
-  // the atom by construction, because they are the only one who can press the button.
+  // window. The read being no cheaper than the write costs the owner nothing: whoever
+  // may press the button may read what it would do — the same two doors as the POST.
   router.get(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
   );
 
   // GET /provisioning/control-plane — "which row is this platform, and where does it
   // stand?" The deploy page's first call: the self row is created once by hand at
-  // install time, so its id is per-install and nobody's to memorise. Same atom again,
-  // so the entrance is no wider than the door it leads to.
+  // install time, so its id is per-install and nobody's to memorise. The atom ALONE
+  // here, with no owner door: this is the platform's own row (ADR 0339).
   router.get(
     '/provisioning/control-plane',
     api.requireBuilder,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1035",
+  "version": "1.19.1036",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1035",
+      "version": "1.19.1036",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1035",
+  "version": "1.19.1036",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7487,5 +7487,15 @@
       "id": "1002669",
       "text": "The owner can now check from their own laptop what the automatic background jobs decided and when the project's core software was last upgraded, instead of logging into the server to find out."
     }
+  ],
+  "1.19.1036": [
+    {
+      "id": "1004286",
+      "text": "Pressing delete on the platform's own server is still refused, and now it no longer quietly cancels a restart you had already asked for."
+    },
+    {
+      "id": "1004174",
+      "text": "The owner of a hosted project can now upgrade it themselves: the \"you're behind\" banner on their project links to the Deploy page on the hub, which lets a project's owner move their own project, and only their own."
+    }
   ]
 }

package/scripts/gds/provision-core-upgrade.js

@@ -140,6 +140,16 @@ function targetFault(to, available, installed, channel, channelAllows) {
   return null;
 }
 
+// The builder id a queued move is attributed to, from the actor the web tier recorded.
+// PURE. Two doors reach the move (ADR 0339): an Archon (`api:archon:<id>`) and, since
+// task 1004174, the project's own owner (`api:owner:<id>`). Both carry the id, because
+// it becomes `--requested-by` on the core_upgrades ledger (ADR 0293 D5). Anything else
+// yields '' — the id is interpolated into a shell command, so only digits ever pass.
+function requestedByOf(intent) {
+  const m = intent && typeof intent.requested_by === 'string' && /^api:(?:archon|owner):(\d+)$/.exec(intent.requested_by);
+  return m ? m[1] : '';
+}
+
 /**
  * Perform a queued core-pin move. Returns { ok } — NEVER throws for an expected refusal.
  *
@@ -224,9 +234,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // it the pin lives only in the working tree, and the next pull-deploy resets it away —
   // the silent thirteen-release revert upgrade.js's own header records.
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
-  const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
-    ? intent.requested_by.replace(/^api:archon:/, '')
-    : '';
+  const requestedBy = requestedByOf(intent);
   // Built by the SAME function the preview uses, so "what you were shown" and "what runs"
   // cannot drift apart into two hand-maintained flag lists (task 1004121).
   // The preview probes; the move must probe identically or the two commands diverge on
@@ -982,4 +990,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/src/bongos/auth.js

@@ -461,7 +461,13 @@ const PAGE_GATES = Object.freeze({
   // preview discloses the exact core version the box serves and how far behind it is
   // — a vulnerability window, and exactly the kind of topology ADR 0043 keeps off
   // unauthenticated surfaces.
-  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders' }),
+  //
+  // SINCE ADR 0339 (task 1004174) its routes admit a SECOND audience — a hosted
+  // project's own owner, for that project only — so the shell follows through the same
+  // `alsoAdmits` door /people uses (ADR 0210). It admits the SHELL for an owner of any
+  // live project; which project they may read or move is still the routes' question,
+  // asked per request against that project's row.
+  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders', alsoAdmits: 'isProjectOwner' }),
   // The /fleet cost page (task 1001949) — on `provisioning.fleet.manage`, the SAME atom
   // its one read (GET /provisioning/fleet/cost-ledger) checks: every owner's projects
   // and what they cost, so the page reaches exactly as far as the data does.
@@ -469,7 +475,7 @@ const PAGE_GATES = Object.freeze({
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
-// the module that owns the answer, only for the one gate that declares one.
+// the module that owns the answer, only for a gate that declares one.
 //
 // FAIL-CLOSED, EVERY WAY IT CAN FAIL: a gate with no `alsoAdmits`, a hub module
 // that is off (every non-hub instance), a port that never grew the function, or a

package/src/bongos/routes/core-update.js

@@ -22,6 +22,25 @@ const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
 const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
+const { loadIdpConfig } = require('../auth-config');
+
+// WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
+// own deploy door, scoped to this project — `<hub>/deploy?project=<slug>`. The act stays
+// on the control plane (ADR 0293 D1); this instance only names the address, so it gains
+// no capability. Both halves are already here on a federated project: provisioning
+// writes the hub origin and this project's hub client id, which IS its slug (ADR 0246),
+// into web.env. null when this instance is not federated with a hub — a self-hosted
+// instance, or the hub itself — so the hall offers no link rather than a wrong one.
+// Only the origin and the client id are read; the client secret never leaves auth-config.
+function hubDeployUrl(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
+}
+
+function safeIdpConfig() {
+  try { return loadIdpConfig(); } catch { return null; }
+}
 
 // ?limit for GET /core-upgrades: an integer 1..100, else 20.
 function upgradesLimit(raw) {
@@ -30,7 +49,7 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
-module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
+function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
   const router = express.Router();
 
   router.get(
@@ -48,7 +67,7 @@ module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades }
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+      res.json({ ok: true, update: await readCoreUpdate({ running }), deploy_url: hubDeployUrl(safeIdpConfig()) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -71,4 +90,7 @@ module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades }
   );
 
   return router;
-};
+}
+
+module.exports = buildCoreUpdateRouter;
+module.exports.hubDeployUrl = hubDeployUrl;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1035'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1036'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');