@bongos/core 1.19.205 → 1.19.207

package/modules/provisioning/tests/provisioning.mjs

@@ -165,7 +165,7 @@ t('githubAppName falls back to brand-qualified project when there is no usable d
   assert.ok(long.length <= 34 && long.startsWith('Cloud Bongos - '), `capped + brand kept: ${long}`);
 });
 
-t('buildGithubAppManifest points redirect at the MOTHERSHIP, callbacks at the INSTANCE, minimal perms, public, domain-named', () => {
+t('buildGithubAppManifest points redirect at the MOTHERSHIP, callbacks at the INSTANCE, ADR 0055 publish scopes, public, domain-named', () => {
   const m = P.buildGithubAppManifest({
     instanceName: 'mercury', slug: 'mercury', brand: 'Cloud Bongos',
     instanceDomain: 'mercury.example.com', mothershipOrigin: 'https://cloudbongos.com',
@@ -179,8 +179,10 @@ t('buildGithubAppManifest points redirect at the MOTHERSHIP, callbacks at the IN
     'https://mercury.example.com/api/gds/auth/web/callback',
     'https://mercury.example.com/api/bongos/auth/web/callback',
   ]);
-  // sign-in needs no repo/account permissions; no active webhook
-  assert.deepEqual(m.default_permissions, {});
+  // The App doubles as the ADR 0055 publish credential (task 1003049): exactly the
+  // three publish scopes — Contents rw (push branches), PR rw (open/merge), Actions
+  // read (deploy probe) — and nothing more. No active webhook.
+  assert.deepEqual(m.default_permissions, { contents: 'write', pull_requests: 'write', actions: 'read' });
   assert.equal(m.hook_attributes.active, false);
   // public: a PRIVATE App answers the web authorize URL for any non-owner with a bare
   // GitHub 404, making the project single-builder on the web (gap-list W6, task 1003048)
@@ -258,5 +260,43 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
   assert.doesNotMatch(sql, /status\s*=|updated_at/, 'releasing the latch must not touch the lifecycle');
 });
 
+console.log('\nPer-project settings (task 1003040):');
+
+t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(
+    P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
+    { platform_visibility: 'gated', joinability: 'apply' },
+    'a stored key overlays only itself'
+  );
+  assert.deepEqual(
+    P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x' } }),
+    { platform_visibility: 'public', joinability: 'invite_only' },
+    'off-vocabulary values fall back to the default; unknown keys never leak out'
+  );
+  assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
+    { platform_visibility: 'public', joinability: 'apply' }, 'a non-object settings value reads as defaults');
+});
+
+t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {
+  for (const [key, dflt] of Object.entries(P.DEFAULT_SETTINGS)) {
+    assert.ok(P.SETTINGS_VOCAB[key], `default key '${key}' has a vocabulary`);
+    assert.ok(P.SETTINGS_VOCAB[key].includes(dflt), `default '${dflt}' is a legal '${key}' value`);
+  }
+  assert.deepEqual(Object.keys(P.SETTINGS_VOCAB).sort(), Object.keys(P.DEFAULT_SETTINGS).sort(),
+    'every known key has a default (an undefaulted key would read as undefined)');
+});
+
+await ta('updateInstanceSettings: jsonb MERGE (||) + updated_at, parameterized, returns the row', async () => {
+  let sql = '', params = null;
+  const db = { query: async (q, p) => { sql = q; params = p; return { rows: [{ id: 18, settings: { joinability: 'open' } }] }; } };
+  const row = await P.updateInstanceSettings(db, 18, { joinability: 'open' });
+  assert.equal(row.settings.joinability, 'open');
+  assert.match(sql, /SET settings = settings \|\| \$2::jsonb, updated_at = now\(\)/, 'merges — never clobbers other keys');
+  assert.deepEqual(params, [18, JSON.stringify({ joinability: 'open' })]);
+});
+
 console.log(`\nprovisioning module: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.205",
+  "version": "1.19.207",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.205",
+      "version": "1.19.207",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.205",
+  "version": "1.19.207",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -2768,7 +2768,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
 
     var instanceId = null;             /* set when a create lands / a resumed watch starts */
-    var live = { instStatus: null, manifest: null, manifestMsg: '' };
+    var live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
@@ -2861,6 +2861,21 @@ h1[tabindex="-1"]:focus{outline:none;}
         '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
     }
 
+    /* app-install — the ADR 0055 publish credential (task 1003049): the sign-in App
+       doubles as it, but only an INSTALLED App can mint push tokens; without this
+       one click every finished task waits at confirmed for a manual merge. */
+    function renderStepAppInstall() {
+      if (live.manifest !== 'done') {
+        return '<li class="slocked" data-onboard-step="app-install"><b>Install the GitHub App on your repo</b><p>Unlocks once GitHub sign-in above is wired — the same app, installed on your repo, is what lets finished work merge and ship itself.</p></li>';
+      }
+      var installUrl = live.appSlug ? 'https://github.com/apps/' + esc(live.appSlug) + '/installations/new' : null;
+      return '<li data-onboard-step="app-install"><b>Install the GitHub App on your repo</b><p>One click: install the app you just approved on this project’s repo. Without it, finished work waits for a manual merge instead of shipping itself.</p>' +
+        (installUrl
+          ? '<a class="ghbtn" href="' + installUrl + '" target="_blank" rel="noopener">' + GH_ICON + 'Install the app on your repo</a>'
+          : '<p>GitHub → Settings → Developer settings → GitHub Apps → your app → <strong>Install App</strong> → pick this project’s repo.</p>') +
+        '</li>';
+    }
+
     function renderStepFirstSignIn() {
       var domain = resolvedDomain();
       if (!domain) {
@@ -2879,6 +2894,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var STEP_RENDERERS = {
       'github-repo': renderStepGithubRepo,
       'oauth-app': renderStepOauthApp,
+      'app-install': renderStepAppInstall,
       'first-sign-in': renderStepFirstSignIn,
       'enter-hall': renderStepEnterHall
     };
@@ -3007,6 +3023,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
           .then(function (d) {
             if (myGen !== manifestGen) return;
+            if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; renderSteps(); }
             var next = d.ready ? 'done' : (d.status || 'pending');
             if (next !== live.manifest) { live.manifest = next; renderSteps(); }
             if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
@@ -3187,7 +3204,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         stopManifestPoll();
         instanceId = null;
         watchPending = false; manifestPending = false; manifestState = null;
-        live = { instStatus: null, manifest: null, manifestMsg: '' };
+        live = { instStatus: null, manifest: null, manifestMsg: '', appSlug: null };
         lastStepsHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
         state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };

package/scripts/gds/onboard.js

@@ -9,9 +9,9 @@
 // provision → OAuth → verify → brand legs. Standalone model only (ADR 0108).
 //
 // It automates what it can (DNS token preflight, OAuth-cred validation, /healthz
-// verify) and renders the four irreducibly-human steps (create the GitHub repo, the
-// OAuth app + secret, own the domain, first sign-in) as precise, copy-paste-safe
-// prompts. It does NOT hold cloud tokens: the actual provision runs on the control
+// verify) and renders the irreducibly-human steps (create the GitHub repo, the
+// OAuth app + secret, install the App on the repo, own the domain, first sign-in)
+// as precise, copy-paste-safe prompts. It does NOT hold cloud tokens: the actual provision runs on the control
 // plane (it prints the exact `provision.js` command), preserving the trust boundary.
 
 const readline = require('node:readline');
@@ -189,6 +189,14 @@ async function run() {
       log('   (validates + rewrites web.env via Node + restarts + probes /healthz auth_configured — never hand-edit web.env.)');
       await ask(rl, 'Press Enter once oauth-secret reports auth_configured=true…');
 
+      // The publish credential (task 1003049, ADR 0055): the one-click App carries the
+      // repo scopes, but only an INSTALLED App can mint push tokens — skip this click
+      // and every ship strands at 'confirmed' behind a manual merge.
+      log('\n   Install the GitHub App on the repo — the publish credential that lets shipped work land itself:');
+      log('   github.com → Settings → Developer settings → GitHub Apps → your app → Install App → pick this project’s repo.');
+      log('   (On the manual OAuth-app path instead? Set a fine-grained GITHUB_PUSH_TOKEN in web.env — ADR 0055.)');
+      await ask(rl, 'Press Enter once the App is installed on the repo…');
+
       // Step 8/9 — first sign-in + verify
       log('\n⑦ First sign-in (seats the founding Archon):');
       log(`   Open ${oauthAppInstructions(a.domain).homepageUrl} and sign in with GitHub once.`);

package/scripts/gds/provision.js

@@ -1021,7 +1021,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', federation = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
   const prefix = provisionedEnvPrefix();
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -1077,6 +1077,19 @@ ${prefix}_HUB_ORIGIN=${federation.hubOrigin}
 ${prefix}_HUB_CLIENT_ID=${federation.clientId}
 ${prefix}_HUB_CLIENT_SECRET=${federation.clientSecret}
 ${prefix}_HUB_PUBLIC_KEY=${federation.hubPublicKey}
+`
+    : '';
+  // The publish credential (task 1003049, ADR 0055): the manifest-born App's id +
+  // private key, read BARE (no prefix) by modules/lifecycle/github-push.js. The
+  // pem is env-file-flattened to a single line with literal \n (the ADR 0055
+  // rotation convention; normalizePem restores it). The installation id is NOT
+  // written — the server discovers it from the repo once the owner installs the
+  // App (the onboarding app-install step).
+  const appLines = appId && appPem
+    ? `# Publish credential (ADR 0055): the sign-in GitHub App doubles as it. The server
+# mints short-lived installation tokens once the App is INSTALLED on the repo.
+GITHUB_APP_ID=${appId}
+GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
 `
     : '';
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
@@ -1084,7 +1097,7 @@ ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
-${originLines}PORT=${inst.port}
+${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
 ${fedLines}`;
 }
@@ -1948,6 +1961,10 @@ async function convertManifestCode(code, { fetchImpl = globalThis.fetch, userAge
     clientSecret: String(data.client_secret),
     appId: data.id != null ? Number(data.id) : null,
     appSlug: data.slug || null,
+    // The App private key (task 1003049): with the manifest now requesting the
+    // ADR 0055 repo scopes, this pem + the app id ARE the instance's publish
+    // credential — placed into web.env alongside the OAuth creds, never logged.
+    appPem: data.pem ? String(data.pem) : null,
   };
 }
 
@@ -1973,7 +1990,7 @@ async function placeManifestCreds(inst, mrow, deps) {
     creds = await (deps.convertManifestCode || convertManifestCode)(mrow.github_code, {});
   } else {
     log(`  [oauth-manifest] would POST api.github.com/app-manifests/<code>/conversions for ${inst.slug}`);
-    creds = { clientId: '0'.repeat(20), clientSecret: '0'.repeat(40), appId: null, appSlug: null };
+    creds = { clientId: '0'.repeat(20), clientSecret: '0'.repeat(40), appId: null, appSlug: null, appPem: null };
   }
 
   // 2) validate the returned creds BEFORE writing (catch a malformed GitHub response —
@@ -1991,7 +2008,13 @@ async function placeManifestCreds(inst, mrow, deps) {
   // 3) rewrite web.env with the creds + restart the unit (never logs the secret — the
   //    writeFile logs only a byte count; the value is base64/temp-file placed).
   log(`  [oauth-manifest] place creds in ${webEnvPath(inst)} + restart ${inst.slug}`);
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { clientId: creds.clientId, clientSecret: creds.clientSecret }), { mode: 0o600, sudo: true });
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
+    clientId: creds.clientId, clientSecret: creds.clientSecret,
+    // The App id + private key double as the ADR 0055 publish credential (task
+    // 1003049); older Apps (pre-permission manifests) return a pem too — placing
+    // it is harmless and heals once the owner grants the permissions + installs.
+    appId: creds.appId, appPem: creds.appPem,
+  }), { mode: 0o600, sudo: true });
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
   // 4) verify /healthz reports auth_configured=true (only meaningful under --apply).

package/src/module-api.js

@@ -837,8 +837,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.203 with no explicit bump. run 32060607072. (task 1002620)
 //   1.19.205 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.204 with no explicit bump. run 32061149280. (task 1002620)
+//   1.19.206 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.205 with no explicit bump. run 32064728346. (task 1002620)
+//   1.19.207 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.206 with no explicit bump. run 32065995444. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.205'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.207'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -15,12 +15,16 @@ test('onboardPlan is the canonical sequence: name+address first, the builders ha
   assert.equal(keys[keys.length - 2], 'brand');
   // the irreducibly-human steps (must be UI-first prompts)
   const human = plan.filter((s) => s.kind === 'human').map((s) => s.key);
-  assert.deepEqual(human, ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall']);
+  assert.deepEqual(human, ['github-repo', 'oauth-app', 'app-install', 'first-sign-in', 'enter-hall']);
   // the DNS preflight comes BEFORE provision (task 1980: before the address step)
   assert.ok(keys.indexOf('dns-preflight') < keys.indexOf('provision'), 'dns preflight precedes provision');
   // OAuth secret placement comes after the OAuth app + before first sign-in
   assert.ok(keys.indexOf('oauth-app') < keys.indexOf('oauth-place'), 'app before place');
   assert.ok(keys.indexOf('oauth-place') < keys.indexOf('first-sign-in'), 'place before sign-in');
+  // The publish-credential install (task 1003049) needs the App to exist first and
+  // must be prompted before the owner walks away into the hall.
+  assert.ok(keys.indexOf('oauth-place') < keys.indexOf('app-install'), 'the App exists before it can be installed');
+  assert.ok(keys.indexOf('app-install') < keys.indexOf('first-sign-in'), 'install prompted before sign-in');
 });
 
 test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labels branch (task 2046)', () => {

package/tests/provision.mjs

@@ -1044,11 +1044,27 @@ t('webEnvBody fills the OAuth cred lines when creds are given; blank placeholder
   const inst = { ...coTenant, domain: 'mercury.example.com' };
   const blank = P.webEnvBody(inst);
   assert.match(blank, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=\\n`), 'blank id line by default');
+  assert.doesNotMatch(blank, /GITHUB_APP_ID=/, 'no App credential lines without an App');
   const filled = P.webEnvBody(inst, { clientId: 'Iv1.abc123def456ghi7', clientSecret: 's'.repeat(40) });
   assert.match(filled, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=Iv1\\.abc123def456ghi7`));
   assert.match(filled, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_SECRET=s{40}`));
 });
 
+t('webEnvBody writes the BARE publish-credential vars, pem flattened to one env line (task 1003049)', () => {
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const body = P.webEnvBody(inst, {
+    clientId: 'Iv1.abc123def456ghi7', clientSecret: 's'.repeat(40),
+    appId: 42, appPem: '-----BEGIN KEY-----\nAAA\nBBB\n-----END KEY-----\n',
+  });
+  // BARE names (github-push.js reads process.env.GITHUB_APP_ID, no instance prefix)
+  assert.match(body, /^GITHUB_APP_ID=42$/m);
+  assert.match(body, /^GITHUB_APP_PRIVATE_KEY=-----BEGIN KEY-----\\nAAA\\nBBB\\n-----END KEY-----\\n$/m);
+  assert.doesNotMatch(body, /GITHUB_APP_INSTALLATION_ID/, 'installation id is discovered at runtime, never placed');
+  // pem missing (older Apps) → no half-written credential
+  const noPem = P.webEnvBody(inst, { clientId: 'Iv1.abc123def456ghi7', clientSecret: 's'.repeat(40), appId: 42, appPem: null });
+  assert.doesNotMatch(noPem, /GITHUB_APP_ID=/);
+});
+
 await ta('convertManifestCode POSTs the unauthenticated conversion endpoint + maps the response', async () => {
   let calledUrl = '', calledInit = null;
   const fetchImpl = async (url, init) => {
@@ -1060,7 +1076,16 @@ await ta('convertManifestCode POSTs the unauthenticated conversion endpoint + ma
   assert.equal(calledInit.method, 'POST');
   assert.ok(calledInit.headers['User-Agent'], 'stamps a User-Agent (GitHub requires one)');
   assert.ok(!('Authorization' in calledInit.headers), 'unauthenticated — the code IS the auth');
-  assert.deepEqual(creds, { clientId: 'Iv1.abcdef0123456789', clientSecret: 'x'.repeat(40), appId: 42, appSlug: 'mercury-signin' });
+  assert.deepEqual(creds, { clientId: 'Iv1.abcdef0123456789', clientSecret: 'x'.repeat(40), appId: 42, appSlug: 'mercury-signin', appPem: null });
+});
+
+await ta('convertManifestCode maps the App private key (pem) — the ADR 0055 publish credential (task 1003049)', async () => {
+  const pem = '-----BEGIN RSA PRIVATE KEY-----\nMIIkey\n-----END RSA PRIVATE KEY-----\n';
+  const fetchImpl = async () => ({ ok: true, text: async () => JSON.stringify({
+    id: 7, slug: 's', client_id: 'Iv1.abcdef0123456789', client_secret: 'x'.repeat(40), pem,
+  }) });
+  const creds = await P.convertManifestCode('C', { fetchImpl });
+  assert.equal(creds.appPem, pem, 'the pem rides the creds to web.env placement');
 });
 
 await ta('convertManifestCode throws on a non-2xx or a creds-less response', async () => {
@@ -1075,7 +1100,7 @@ await ta('placeManifestCreds (--apply): converts, rewrites web.env with the cred
   const writes = []; const cmds = [];
   const deps = {
     apply: true, privileged: false, log: () => {},
-    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 9, appSlug: 'm-signin' }),
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 9, appSlug: 'm-signin', appPem: '-----BEGIN KEY-----\nAAA\n-----END KEY-----\n' }),
     exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '{"ok":true,"auth_configured":true}' }; },
     writeFile: (p, body) => { writes.push({ p, body }); return { ok: true }; },
   };
@@ -1086,6 +1111,9 @@ await ta('placeManifestCreds (--apply): converts, rewrites web.env with the cred
   const env = writes.find((w) => /web\.env$/.test(w.p));
   assert.ok(env, 'web.env was written');
   assert.match(env.body, /_GITHUB_CLIENT_SECRET=z{40}/);
+  // …and the publish credential (task 1003049): App id + one-line pem, bare names
+  assert.match(env.body, /^GITHUB_APP_ID=9$/m, 'the App id is placed as the publish credential');
+  assert.match(env.body, /^GITHUB_APP_PRIVATE_KEY=-----BEGIN KEY-----\\nAAA\\n-----END KEY-----\\n$/m, 'the pem is placed env-flattened');
   // the unit was restarted, and /healthz was probed
   assert.ok(cmds.some((c) => /systemctl restart mercury/.test(c)), 'restarts the unit');
   assert.ok(cmds.some((c) => /\/healthz/.test(c)), 'probes healthz');

package/tests/provisioning_settings.mjs

@@ -0,0 +1,200 @@
+// tests/provisioning_settings.mjs
+//
+// Per-project settings foundation (task 1003040, goal 1000058) — the surface the
+// manage-page wave hangs off:
+//   • GET  /provisioning/instances/:id/settings  — effective settings + options
+//   • PATCH /provisioning/instances/:id/settings — validated, own-scoped change
+//
+// The load-bearing assertions:
+//   • the OWN-SCOPE WALL: another builder's GET/PATCH answers 404 and the write
+//     path is NEVER reached (no existence leak, no cross-owner mutation)
+//   • the Archon override works and is audited as api:archon
+//   • strict validation: off-vocabulary values and unknown keys are 400s
+//   • defaults = today's behavior (public / apply) for rows that predate the column
+//
+// DB-free: data-access fns are stubbed on the cached module object (the
+// provisioning_domain_attach.mjs pattern). No network beyond localhost.
+//
+// Run:  node tests/provisioning_settings.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── stubbed data access on the cached module object ──────────────────────────
+let instance = null;            // the row getInstanceById answers with
+let updateCalls = [];           // recorded updateInstanceSettings calls
+let events = [];                // recorded provisioning_events
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.updateInstanceSettings = async (_db, id, patch) => {
+  updateCalls.push({ id, patch });
+  instance = { ...instance, settings: { ...(instance.settings || {}), ...patch } };
+  return { ...instance, id };
+};
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+provisioning.getOpenIntent = async () => null;
+
+const api = require('../src/module-api.js');
+let builder = { id: 7, github_login: 'owner', rank: 'thetes' };
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+api.branding = () => ({
+  domains: { publicOrigin: 'https://cb.test' },
+  identity: { productName: 'Cloud Bongos' },
+});
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method,
+      headers: payload
+        ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
+        : {},
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload || undefined);
+  });
+}
+const get = (p) => call('GET', p);
+const patch = (p, b) => call('PATCH', p, b);
+
+function reset({ inst, as } = {}) {
+  instance = inst !== undefined ? inst
+    : { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', settings: {} };
+  builder = as || { id: 7, github_login: 'owner', rank: 'thetes' };
+  updateCalls = [];
+  events = [];
+}
+
+console.log('GET /provisioning/instances/:id/settings:');
+
+await ta('owner reads DEFAULTS (public / apply) on a row with empty settings — today\'s behavior', async () => {
+  reset();
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply' });
+  assert.deepEqual(r.body.options, { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] });
+});
+
+await ta('stored keys overlay the defaults', async () => {
+  reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only' });
+});
+
+await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+await ta('an Archon may read ANY instance (the override)', async () => {
+  reset({ as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await get('/provisioning/instances/18/settings');
+  assert.equal(r.status, 200, r.raw);
+});
+
+await ta('unknown instance id → 404 for everyone', async () => {
+  reset({ inst: null });
+  const r = await get('/provisioning/instances/999/settings');
+  assert.equal(r.status, 404, r.raw);
+});
+
+console.log('\nPATCH /provisioning/instances/:id/settings:');
+
+await ta('owner changes one key — merged, returned effective, audited api:self', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'open' });
+  assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'settings');
+  assert.equal(events[0].actor, 'api:self');
+  assert.match(events[0].detail, /joinability=open/);
+});
+
+await ta('owner changes both keys in one call', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.settings, { platform_visibility: 'gated', joinability: 'invite_only' });
+});
+
+await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+  assert.equal(updateCalls.length, 0, 'no cross-owner mutation');
+  assert.equal(events.length, 0, 'no event for a refused write');
+});
+
+await ta('an Archon may change ANY instance — audited api:archon', async () => {
+  reset({ as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(events[0].actor, 'api:archon', 'the override is distinguishable in the audit ledger');
+  assert.equal(events[0].ownerBuilderId, 7, 'the event still belongs to the instance owner');
+});
+
+await ta('an off-vocabulary value → 400 validation_failed (nothing written)', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { joinability: 'closed' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(r.body.error.code, 'validation_failed');
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('an unknown key → 400 (strict: a typo fails loudly, never silently dropped)', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', { joinabilty: 'open' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(r.body.error.code, 'validation_failed');
+  assert.equal(updateCalls.length, 0);
+});
+
+await ta('an empty body → 400 bad_settings with a plain sentence naming the keys', async () => {
+  reset();
+  const r = await patch('/provisioning/instances/18/settings', {});
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(r.body.error.code, 'bad_settings');
+  assert.match(r.body.error.message, /platform_visibility, joinability/);
+});
+
+server.close();
+console.log(`\nprovisioning_settings: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);