@bongos/core 1.19.354 → 1.19.356

package/tests/projects_hub_pre_uat.mjs

@@ -498,3 +498,17 @@ test('the done panel re-learns the GitHub-App leg from the instance read, yieldi
   assert.ok(seedAt > 0 && seedAt < statusAt, 'the manifest seed lands before the status re-render, so one renderSteps() paints both');
   assert.match(fn('enter'), /if \(created\.manifest\) \{ live\.manifest = created\.manifest; live\.appSlug = created\.app_slug \|\| null; \}/, 'the sessionStorage bridge stays as the pre-first-tick seed');
 });
+
+/* ── a settings push is named on both surfaces, by state, with no duration promise (task 1003140) ── */
+test('a queued or running settings push is named on the card strip AND the done panel — by state, no "briefly"', () => {
+  assert.equal((SCRIPT.match(/settings: \{ names: \['Change saved', 'Restarting to apply it', 'Applied'\], cls: '' \}/g) || []).length, 2,
+    'FLOWS (card) and PROG_FLOWS (done panel) both carry the settings flow');
+  const strip = fn('stripFor');
+  assert.match(strip, /a === 'settings-apply'/, 'the card strip names the intent');
+  assert.match(strip, /A settings change is queued — this card updates when it starts\./, 'pending: queued, not "restarting"');
+  assert.match(strip, /Applying a settings change — the project restarts to pick it up\./, 'running: the restart is said plainly');
+  const prog = fn('renderProgress');
+  assert.match(prog, /oi\.action === 'settings-apply'/, 'the done panel has the same branch — a restarting project is not read as "isn’t answering"');
+  assert.match(prog, /A settings change is queued — this panel updates when it starts\./);
+  assert.doesNotMatch(strip + prog, /briefly|shortly|soon\b|minute|second/i, 'no wall-clock or duration promise (F16)');
+});

package/tests/provision_settings_apply.mjs

@@ -0,0 +1,464 @@
+// tests/provision_settings_apply.mjs
+//
+// The runner half of the live settings push (task 1003140, goal 1000058):
+// scripts/gds/provision.js settingsApplyInstance + the in-place env patch it
+// rides on (provision-units.js upsertEnvVars), the read-back (settingsConsumed),
+// and the run-intents dispatch. Hermetic — exec / writeFile / db are recording
+// fakes; no shell, no DB, no network (the tests/provision.mjs pattern).
+//
+// The load-bearing assertions:
+//   • the file is PATCHED, never regenerated — creds, origins, the federation
+//     block and comments survive; only the two settings lines change
+//   • an unreadable/empty web.env is REFUSED under --apply (never overwritten);
+//     dry-run PLANS the patch and writes nothing
+//   • a write or restart that THROWS returns ok:false — the drain loop re-pends
+//     the intent and never flips a healthy ACTIVE instance to 'error' (ADR 0190)
+//   • the verify asks the instance's own manifest whether it READ the values, and
+//     records only what it earned (true / false / unknown)
+//   • the state gate is a clean no-op; dedicated is refused with guidance
+//   • cmdRunIntents routes 'settings-apply' to this leg
+//
+// Run:  node tests/provision_settings_apply.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { MANIFEST_VERIFY_TRIES } = require('../scripts/gds/provision-config.js');
+
+const NEUTRAL_PREFIX =
+  JSON.parse(readFileSync(new URL('../config/branding.neutral.json', import.meta.url), 'utf8')).envPrefix || 'CLOUDBONGOS';
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('upsertEnvVars — the in-place patch:');
+
+const LIVE_ENV = `# /etc/spike/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
+# Provisioned by scripts/gds/provision.js (ADR 0111). OAuth app creds placed via the
+# GitHub App Manifest flow (ADR 0133) — the owner clicked one link; no secret was pasted.
+${NEUTRAL_PREFIX}_GITHUB_CLIENT_ID=Iv1.0123456789abcdef
+${NEUTRAL_PREFIX}_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567
+${NEUTRAL_PREFIX}_FIRST_ADMIN=jaxri
+GDS_BRANDING_FILE=config/branding.neutral.json
+${NEUTRAL_PREFIX}_PUBLIC_ORIGIN=https://spike.cloudbongos.com
+GITHUB_APP_ID=12345
+GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\\nabc\\n-----END RSA PRIVATE KEY-----
+PORT=3010
+PGDATABASE=spike
+# Per-project policy the platform decides and this instance obeys (task
+# 1003139). Written at standup from the platform's provisioning_instances.settings;
+${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
+${NEUTRAL_PREFIX}_JOINABILITY=apply
+`;
+
+t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
+  const out = P.upsertEnvVars(LIVE_ENV, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'invite_only' });
+  const before = LIVE_ENV.split('\n'), after = out.split('\n');
+  assert.equal(after.length, before.length, 'no line added or lost');
+  for (let i = 0; i < before.length; i++) {
+    if (/_PLATFORM_VISIBILITY=|_JOINABILITY=/.test(before[i])) continue;
+    assert.equal(after[i], before[i], `line ${i + 1} untouched`);
+  }
+  assert.match(out, new RegExp(`^${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=gated$`, 'm'));
+  assert.match(out, new RegExp(`^${NEUTRAL_PREFIX}_JOINABILITY=invite_only$`, 'm'));
+  assert.match(out, /_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567/, 'the placed creds are NOT blanked');
+  assert.match(out, /GITHUB_APP_PRIVATE_KEY=-----BEGIN RSA/, 'the publish credential survives');
+});
+
+t('appends a MISSING key at the end (an instance provisioned before task 1003139 has no settings lines)', () => {
+  const pre1003139 = LIVE_ENV.split('\n').filter((l) => !/_PLATFORM_VISIBILITY=|_JOINABILITY=|task$|provisioning_instances\.settings;$/.test(l)).join('\n');
+  assert.doesNotMatch(pre1003139, /_PLATFORM_VISIBILITY=/);
+  const out = P.upsertEnvVars(pre1003139, { X_PLATFORM_VISIBILITY: 'gated', X_JOINABILITY: 'apply' });
+  assert.ok(out.startsWith(pre1003139.replace(/\n$/, '')), 'existing content is a prefix of the result');
+  assert.ok(out.endsWith('X_PLATFORM_VISIBILITY=gated\nX_JOINABILITY=apply\n'), 'both appended, newline-terminated');
+});
+
+t('mixes replace + append; a body with no trailing newline gets one before the append', () => {
+  const out = P.upsertEnvVars('PORT=1\nX_A=old', { X_A: 'new', X_B: 'b' });
+  assert.equal(out, 'PORT=1\nX_A=new\nX_B=b\n');
+});
+
+t('matches the key at line start, exactly — a key that is a PREFIX of another never collides', () => {
+  const out = P.upsertEnvVars('X_JOINABILITY_NOTE=keep\nX_JOINABILITY=apply\n', { X_JOINABILITY: 'open' });
+  assert.equal(out, 'X_JOINABILITY_NOTE=keep\nX_JOINABILITY=open\n');
+  const out2 = P.upsertEnvVars('# X_A=commented\nX_A=1\n', { X_A: '2' });
+  assert.equal(out2, '# X_A=commented\nX_A=2\n', 'a commented-out line is not the key');
+});
+
+t('the two defenses are pinned: a $-bearing value is not re-interpreted, and a CRLF body keeps its endings', () => {
+  assert.equal(P.upsertEnvVars('K=old\n', { K: 'a$&b' }), 'K=a$&b\n', 'function-form replacer: $& is literal');
+  assert.equal(P.upsertEnvVars('K=old\n', { K: 'a$1b' }), 'K=a$1b\n');
+  assert.equal(P.upsertEnvVars('A=1\r\nX_J=apply\r\n', { X_J: 'open' }), 'A=1\r\nX_J=open\r\n', 'CRLF: replaced in place, \\r\\n kept');
+  assert.equal(P.upsertEnvVars('A.B=1\nAXB=2\n', { 'A.B': '3' }), 'A.B=3\nAXB=2\n', 'a regex metacharacter in the key is escaped, never a wildcard');
+});
+
+t('is PURE: same input, same output; empty body yields just the lines', () => {
+  assert.equal(P.upsertEnvVars('', { A: '1' }), 'A=1\n');
+  assert.equal(P.upsertEnvVars(null, {}), '');
+  assert.equal(P.upsertEnvVars(LIVE_ENV, {}), LIVE_ENV, 'nothing asked → nothing changed');
+});
+
+t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
+  const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
+  const vars = P.settingsEnvVarsFor(inst);
+  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply' });
+  const body = P.webEnvBody(inst, {});
+  for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
+});
+
+console.log('\nsettingsConsumed — did the instance READ it? (the manifest read-back):');
+
+const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_only' } };
+const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
+
+t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' }), GATED), true);
+});
+t('false when the instance still reports a different value', () => {
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
+});
+t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
+  assert.equal(P.settingsConsumed(manifestWith(undefined), GATED), null);
+  assert.equal(P.settingsConsumed('<html>502</html>', GATED), null);
+  assert.equal(P.settingsConsumed('', GATED), null);
+  assert.equal(P.settingsConsumed(JSON.stringify({ brand: { project: 'nope' } }), GATED), null);
+});
+t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
+  assert.equal(P.instanceManifestCmd({ port: 3010 }), 'curl -sS --max-time 5 http://127.0.0.1:3010/api/gds/instance');
+});
+
+// ── the handler ──────────────────────────────────────────────────────────────
+// manifest: 'match' | 'mismatch' | 'none' | 'garbage'
+function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
+  manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
+  const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only' })
+    : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply' })
+    : manifest === 'none' ? manifestWith(undefined) : 'nope';
+  const exec = (cmd, opts = {}) => {
+    cmds.push(cmd);
+    if (/\bcat /.test(cmd)) return readFails ? { ok: true, stdout: '', softFailed: true } : { ok: true, stdout: envBody };
+    if (/healthz/.test(cmd)) return healthzFails ? { ok: true, stdout: '', softFailed: true } : { ok: true, stdout: '{"ok":true}' };
+    if (/api\/gds\/instance/.test(cmd)) return { ok: true, stdout: manifestOut };
+    if (/systemctl restart/.test(cmd) && restartThrows && apply) throw new Error(`Command failed: ${cmd}`);
+    return { ok: true, stdout: '' };
+  };
+  const writer = (via) => (p, body, opts) => {
+    if (writeThrows && apply) throw new Error(`Command failed: sudo install -D -m 600 /tmp/x ${p}`);
+    writes.push({ via, path: p, body, opts }); return { ok: true };
+  };
+  const deps = {
+    apply, privileged, log: (l) => logs.push(String(l)), sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      recordEvent: async (_db, e) => { events.push(e); },
+      recordLivenessProbe: async (_db, id, up) => { probes.push({ id, up }); },
+      clearErrorNote: async (_db, id) => { cleared.push(id); },
+    },
+    exec,
+    // a standalone must land on the CONTROL-PLANE writer (task 2074 routing) —
+    // both writers record, tagged, so the choice is asserted, not assumed
+    writeFile: writer('box'), controlWriteFile: writer('control'),
+    doApi: null,
+  };
+  return { deps, cmds, writes, events, probes, cleared, logs };
+}
+
+const activeStandalone = {
+  id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7,
+  port: 3010, db_name: 'spike', domain: 'spike.cloudbongos.com', target_ref: 'jaxri/spike-harbor',
+  settings: { platform_visibility: 'gated', joinability: 'invite_only' },
+};
+
+console.log('\nsettingsApplyInstance — the leg:');
+
+await ta('--apply, active standalone: read web.env → patch ONLY the settings lines (control-plane writer) → restart → healthz → manifest; creds survive', async () => {
+  const { deps, cmds, writes } = recorder({ apply: true });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true, JSON.stringify(r));
+  const idx = (re) => cmds.findIndex((c) => re.test(c));
+  assert.ok(idx(/cat \/etc\/spike\/web\.env/) >= 0, 'reads the live file first');
+  assert.equal(writes.length, 1, 'exactly one file write');
+  assert.equal(writes[0].via, 'control', 'a standalone lives on the control plane — its file is written THERE');
+  assert.equal(writes[0].path, '/etc/spike/web.env');
+  assert.equal(writes[0].opts.mode, 0o600, 'stays chmod 600');
+  assert.equal(writes[0].opts.sudo, true, 'placed through the privileged path like every /etc write');
+  assert.match(writes[0].body, new RegExp(`^${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=gated$`, 'm'));
+  assert.match(writes[0].body, new RegExp(`^${NEUTRAL_PREFIX}_JOINABILITY=invite_only$`, 'm'));
+  assert.match(writes[0].body, /_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567/, 'the placed creds are NOT blanked (the webEnvBody hazard)');
+  assert.match(writes[0].body, /_PUBLIC_ORIGIN=https:\/\/spike\.cloudbongos\.com/, 'origins untouched');
+  assert.equal(writes[0].body.split('\n').length, LIVE_ENV.split('\n').length, 'no line added or lost');
+  assert.ok(idx(/systemctl restart spike/) >= 0, 'RESTART (not reload) so the process re-reads its env');
+  assert.ok(idx(/cat /) < idx(/restart spike/), 'read before restart');
+  assert.ok(idx(/restart spike/) < idx(/healthz/), 'healthz after the restart');
+  assert.ok(idx(/healthz/) < idx(/api\/gds\/instance/), 'the read-back only after it answers');
+  assert.ok(!cmds.some((c) => /systemctl (stop|disable)|caddy|box-dns/.test(c)), 'no teardown / DNS / caddy legs — settings only');
+});
+
+await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthetic two-line body), shows the restart', async () => {
+  const { deps, cmds, writes, logs } = recorder({ apply: false, envBody: '' });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, null, 'nothing ran, nothing observed');
+  assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
+  assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
+});
+
+await ta('privileged: the read and the restart escalate via sudo (the /etc file is root:root 0600)', async () => {
+  const { deps, cmds } = recorder({ apply: true, privileged: true });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.ok(cmds.some((c) => /^sudo cat \/etc\/spike\/web\.env$/.test(c)), cmds.join(' | '));
+  assert.ok(cmds.some((c) => /^sudo systemctl restart spike$/.test(c)));
+});
+
+await ta('co-tenant rides the BOX executor + writer; standalone rides the control-plane pair (task 2074 routing)', async () => {
+  const seen = { box: [], control: [] };
+  const mk = (bucket) => (cmd) => { seen[bucket].push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : { ok: true, stdout: '' }; };
+  for (const [shape, want] of [['co-tenant', 'box'], ['standalone', 'control']]) {
+    seen.box = []; seen.control = [];
+    const { deps, writes } = recorder({ apply: true });
+    deps.exec = mk('box'); deps.controlExec = mk('control');
+    const r = await P.settingsApplyInstance({ ...activeStandalone, hosting_shape: shape }, deps);
+    assert.equal(r.ok, true, shape);
+    assert.ok(seen[want].some((c) => /restart spike/.test(c)), `${shape}: restart on ${want}`);
+    assert.ok(!seen[want === 'box' ? 'control' : 'box'].some((c) => /restart/.test(c)), `${shape}: not on the other`);
+    assert.deepEqual(writes.map((w) => w.via), [want], `${shape}: web.env written via the ${want} writer`);
+  }
+});
+
+await ta('--apply: an unreadable or EMPTY web.env is refused — ok:false, nothing written, no restart (never overwrite PORT/PGDATABASE)', async () => {
+  for (const opts of [{ readFails: true }, { envBody: '' }, { envBody: '   \n' }]) {
+    const { deps, cmds, writes } = recorder({ apply: true, ...opts });
+    const r = await P.settingsApplyInstance(activeStandalone, deps);
+    assert.equal(r.ok, false, JSON.stringify(opts));
+    assert.match(r.error, /cannot read/);
+    assert.equal(writes.length, 0, `${JSON.stringify(opts)}: nothing written`);
+    assert.ok(!cmds.some((c) => /restart/.test(c)), `${JSON.stringify(opts)}: no restart`);
+  }
+});
+
+await ta('--apply: a write that THROWS returns ok:false naming the failure — never a throw (ADR 0190)', async () => {
+  const { deps, cmds } = recorder({ apply: true, writeThrows: true });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /could not apply the settings on spike/);
+  assert.match(r.error, /sudo install/, 'carries the underlying reason');
+  assert.ok(!cmds.some((c) => /restart/.test(c)), 'no restart after a failed write');
+});
+
+await ta('--apply: a restart that exits non-zero returns ok:false — the file is patched, the retry re-reads + restarts again', async () => {
+  const { deps, writes, events } = recorder({ apply: true, restartThrows: true });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /could not apply the settings on spike/);
+  assert.match(r.error, /systemctl restart spike/);
+  assert.equal(writes.length, 1, 'the write had already landed');
+  assert.equal(events.length, 0, 'no success event for a failed push');
+});
+
+await ta('the state gate: any non-active status is a clean no-op — ok:true noop:true, box untouched (never burns the retry budget)', async () => {
+  for (const status of ['requested', 'provisioning', 'tearing_down', 'torn_down', 'error']) {
+    const { deps, cmds, writes } = recorder({ apply: true });
+    const r = await P.settingsApplyInstance({ ...activeStandalone, status }, deps);
+    assert.equal(r.ok, true, status);
+    assert.equal(r.noop, true, status);
+    assert.equal(cmds.length, 0, `${status}: nothing ran`);
+    assert.equal(writes.length, 0);
+  }
+});
+
+await ta('the shape refusal: dedicated → ok:false with guidance naming the values + file; box untouched', async () => {
+  const { deps, cmds, writes } = recorder({ apply: true });
+  const r = await P.settingsApplyInstance({ ...activeStandalone, hosting_shape: 'dedicated' }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /dedicated/);
+  assert.match(r.error, new RegExp(`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=gated`), 'the operator is told exactly what to set');
+  assert.match(r.error, /\/etc\/spike\/web\.env/);
+  assert.equal(cmds.length, 0);
+  assert.equal(writes.length, 0);
+});
+
+console.log('\nthe verdict — recorded only when earned:');
+
+await ta('--apply success, manifest matches: consumed=true, event says it reads the new values, F19 latch released, domain-bearing PASS records no liveness verdict', async () => {
+  const { deps, events, cleared, probes, logs } = recorder({ apply: true, manifest: 'match' });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, true);
+  assert.equal(r.consumed, true);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'settings-applied');
+  assert.equal(events[0].actor, 'runner');
+  assert.match(events[0].detail, new RegExp(`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=gated`));
+  assert.match(events[0].detail, /reads the new values/);
+  assert.deepEqual(cleared, [18], 'a successful push must not leave "we stopped trying" on the card');
+  assert.deepEqual(probes, [], 'loopback-up proves the process, not the address — the sweep earns "Answering at"');
+  assert.ok(logs.some((l) => /✓ spike restarted and reads the new values/.test(l)));
+});
+
+await ta('--apply, manifest still reports the OLD values: consumed=false, the event and the log say so — no success it did not earn', async () => {
+  const { deps, events, logs } = recorder({ apply: true, manifest: 'mismatch' });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true, 'the push itself ran — the intent must not retry forever');
+  assert.equal(r.consumed, false);
+  assert.match(events[0].detail, /still reports the OLD values/);
+  assert.ok(logs.some((l) => /⚠ spike .*OLD values/.test(l)), logs.join('\n'));
+});
+
+await ta('--apply, manifest carries no project block (a core predating task 1003139): consumed=null and the event says "unknown", not "applied"', async () => {
+  for (const manifest of ['none', 'garbage']) {
+    const { deps, events } = recorder({ apply: true, manifest });
+    const r = await P.settingsApplyInstance(activeStandalone, deps);
+    assert.equal(r.ok, true, manifest);
+    assert.equal(r.consumed, null, manifest);
+    assert.match(events[0].detail, /does not publish its settings yet/, manifest);
+    assert.doesNotMatch(events[0].detail, /reads the new values/, manifest);
+  }
+});
+
+await ta('--apply: a restart that never answers /healthz is a VERDICT after the WHOLE F23 budget — recorded as down, event says so, still ok:true', async () => {
+  const { deps, events, probes, cmds } = recorder({ apply: true, healthzFails: true });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true);
+  assert.equal(r.healthy, false);
+  assert.equal(r.consumed, null, 'no read-back attempted on a silent instance');
+  assert.deepEqual(probes, [{ id: 18, up: false }]);
+  assert.match(events[0].detail, /not answering \/healthz yet/);
+  assert.equal(cmds.filter((c) => /healthz/.test(c)).length, MANIFEST_VERIFY_TRIES, 'the same patience as the manifest probe (F23) — a slow boot is not slandered');
+  assert.ok(!cmds.some((c) => /api\/gds\/instance/.test(c)), 'no manifest probe when it never answered');
+});
+
+await ta('--apply: a domainless instance that answers records up=true immediately (provisionInstance step-7 rule)', async () => {
+  const { deps, probes } = recorder({ apply: true });
+  const r = await P.settingsApplyInstance({ ...activeStandalone, domain: null }, deps);
+  assert.equal(r.ok, true);
+  assert.deepEqual(probes, [{ id: 18, up: true }]);
+});
+
+console.log('\nmakeExec / makeWriteFile — the secret never reaches the journal:');
+
+await ta('a remote web.env placement logs "write <path> (N bytes)", never the base64 body (task 1003140)', async () => {
+  const logs = [];
+  const exec = P.makeExec({ apply: false, log: (l) => logs.push(String(l)), remoteHost: 'lars@box', remoteCwd: '/home/lars/cb' });
+  const writeFile = P.makeWriteFile({ apply: false, privileged: true, exec, log: (l) => logs.push(String(l)), remoteHost: 'lars@box' });
+  const SECRET = 'CLOUDBONGOS_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567\n';
+  writeFile('/etc/spike/web.env', SECRET, { mode: 0o600, sudo: true });
+  const joined = logs.join('\n');
+  assert.doesNotMatch(joined, new RegExp(Buffer.from(SECRET, 'utf8').toString('base64').slice(0, 24)), 'no base64 of the body in any log line');
+  assert.doesNotMatch(joined, /0123456789abcdef0123456789abcdef01234567/, 'no plaintext either');
+  assert.match(joined, /\[ssh lars@box\] write \/etc\/spike\/web\.env \(\d+ bytes, mode 600\)/, 'the exec logs the redacted label');
+  assert.match(joined, /would write \/etc\/spike\/web\.env/, 'the writer\'s own plan line survives');
+});
+
+await ta('a `shown` command that FAILS non-fatally logs only its exit status — never "Command failed: <cmd>" (the secret-bearing command text)', async () => {
+  const logs = [];
+  const exec = P.makeExec({ apply: true, log: (l) => logs.push(String(l)) });
+  // a real child that exits 3; the command text stands in for one that embeds a secret
+  const cmd = `${JSON.stringify(process.execPath)} -e "process.exit(3)" SECRET_IN_ARGV`;
+  const r = exec(cmd, { allowFail: true, shown: 'write /etc/spike/web.env (99 bytes)' });
+  assert.equal(r.softFailed, true);
+  const joined = logs.join('\n');
+  assert.match(joined, /~ write \/etc\/spike\/web\.env \(99 bytes\) \(non-fatal: exit status 3\)/, joined);
+  assert.doesNotMatch(joined, /SECRET_IN_ARGV|Command failed/, 'the command text never reaches the journal');
+  // …while an ordinary command keeps its diagnostic
+  const r2 = exec(`${JSON.stringify(process.execPath)} -e "process.exit(4)" plain`, { allowFail: true });
+  assert.equal(r2.softFailed, true);
+  assert.match(logs[logs.length - 1], /plain \(non-fatal: /, 'unlabelled commands still log their own reason');
+});
+
+console.log('\ncmdRunIntents — the dispatch:');
+
+await ta("cmdRunIntents (--apply) routes a 'settings-apply' intent to the leg, writes the ROW's current values, resolves it done", async () => {
+  let claims = 0; const resolved = []; const cmds = []; const writes = [];
+  const deps = {
+    apply: true, log: () => {}, sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 11, instance_id: 18, action: 'settings-apply', attempts: 1 } : null),
+      // the runner re-fetches the row — a PATCH that landed after the enqueue rides along
+      getInstanceById: async () => ({ ...activeStandalone, settings: { platform_visibility: 'gated', joinability: 'open' } }),
+      resolveIntent: async (_db, id, state) => { resolved.push({ id, state }); },
+      setInstanceStatus: async () => { throw new Error('must not touch the lifecycle'); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null,
+      resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => { cmds.push(cmd); return /\bcat /.test(cmd) ? { ok: true, stdout: LIVE_ENV } : /instance/.test(cmd) ? { ok: true, stdout: manifestWith({ platformVisibility: 'gated', joinability: 'open' }) } : { ok: true, stdout: '{"ok":true}' }; },
+    writeFile: (p, body) => { writes.push(body); return { ok: true }; }, doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.ran, 1);
+  assert.equal(r.ok, 1);
+  assert.deepEqual(resolved, [{ id: 11, state: 'done' }]);
+  assert.ok(cmds.some((c) => /systemctl restart spike/.test(c)), 'the restart actually ran');
+  assert.match(writes[0], new RegExp(`^${NEUTRAL_PREFIX}_JOINABILITY=open$`, 'm'), 'the bytes on disk come from the freshly-fetched row (the "already queued will carry it" receipt is provable)');
+});
+
+await ta('cmdRunIntents (--apply): a FAILED restart on attempt 1 re-pends the intent — no resolve, and the instance status is NEVER written (ADR 0190)', async () => {
+  let claims = 0; const resolved = []; const statusWrites = []; const updates = [];
+  const deps = {
+    apply: true, log: () => {}, sleep: async () => {},
+    db: { query: async (sql, params) => { if (/UPDATE provisioning_intents/.test(sql)) updates.push({ sql, params }); return { rows: [] }; } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 12, instance_id: 18, action: 'settings-apply', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...activeStandalone }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => {
+      if (/\bcat /.test(cmd)) return { ok: true, stdout: LIVE_ENV };
+      if (/systemctl restart/.test(cmd)) throw new Error('Command failed: sudo systemctl restart spike');
+      return { ok: true, stdout: '' };
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1);
+  assert.equal(resolved.length, 0, 'not resolved — it re-pends for a later tick');
+  assert.equal(updates.length, 1, 're-pended via the intents table');
+  assert.match(updates[0].sql, /state='pending'/);
+  assert.match(updates[0].params[1], /could not apply the settings on spike/, 'the reason rides last_error');
+  assert.equal(statusWrites.length, 0, 'a healthy ACTIVE instance is never marked broken over a settings push');
+});
+
+await ta('cmdRunIntents (--apply): a dedicated refusal RETIRES at the cap with the reason on the instance and NO status change', async () => {
+  let claims = 0; const resolved = []; const statusWrites = [];
+  const deps = {
+    apply: true, log: () => {}, sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 13, instance_id: 18, action: 'settings-apply', attempts: P.MAX_INTENT_ATTEMPTS } : null),
+      getInstanceById: async () => ({ ...activeStandalone, hosting_shape: 'dedicated' }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
+  };
+  const r = await P.cmdRunIntents(deps);
+  assert.equal(r.errors, 1);
+  assert.equal(resolved[0].state, 'error');
+  assert.equal(statusWrites.length, 1);
+  assert.equal(statusWrites[0].s, 'active', 'a healthy instance is never marked broken over a refused push');
+  assert.match(statusWrites[0].patch.error_note, /dedicated/);
+});
+
+console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_settings.mjs

@@ -42,6 +42,9 @@ provisioning.updateInstanceSettings = async (_db, id, patch) => {
 };
 provisioning.recordEvent = async (_db, e) => { events.push(e); };
 provisioning.getOpenIntent = async () => null;
+// The live push (task 1003140) — stubbed so the reachable path is deterministic here;
+// its own outcomes are covered in tests/provisioning_settings_apply.mjs.
+provisioning.enqueueSettingsApply = async () => ({ intent: { id: 9, action: 'settings-apply', state: 'pending' }, created: true });
 let manifest = null;            // the latest manifest attempt the read surfaces (task 1003235)
 provisioning.getLatestOAuthManifestForInstance = async () => manifest;
 
@@ -93,7 +96,7 @@ const patch = (p, b) => call('PATCH', p, b);
 
 function reset({ inst, as } = {}) {
   instance = inst !== undefined ? inst
-    : { owner_builder_id: 7, slug: 'spike', status: 'active', domain: 'spike.cloudbongos.com', settings: {} };
+    : { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'co-tenant', domain: 'spike.cloudbongos.com', settings: {} };
   builder = as || { id: 7, github_login: 'owner', rank: 'thetes' };
   updateCalls = [];
   events = [];
@@ -195,7 +198,8 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'open' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
   assert.equal(events[0].event, 'settings');
@@ -207,7 +211,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'gated', joinability: 'invite_only' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -223,7 +227,7 @@ await ta('an Archon may change ANY instance — audited api:archon', async () =>
   reset({ as: { id: 999, github_login: 'archon', rank: 'archon' } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.equal(events[0].actor, 'api:archon', 'the override is distinguishable in the audit ledger');
+  assert.equal(events[0].actor, 'api:archon:999', 'the override names WHICH archon (the force-teardown convention, task 1003140)');
   assert.equal(events[0].ownerBuilderId, 7, 'the event still belongs to the instance owner');
 });