@bongos/core 1.19.709 → 1.19.710

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.709",
-  "core_contract": "1.19.709",
-  "source_commit": "e931b6db287584c48e0e0fbb4f302198e7ad7ae1",
+  "core_version": "1.19.710",
+  "core_contract": "1.19.710",
+  "source_commit": "ff37fbc25d95dd2884f9f0158cdb5338ed673774",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T06:55:41.726Z",
+  "built_at": "2026-09-13T07:06:06.980Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 477,
+    "docs_redacted": 478,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 2140,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2641,
-  "tree_sha256": "38d60d3f6875f0ae881aeb4942d3a09b3aa7f9d0df66d7ec712d0ead28d6b3dd",
+  "file_count": 2642,
+  "tree_sha256": "11ec07e4ffff8f23d2aeb9a35181c59d87255a2a80010d858b071858726a3acc",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1132,7 +1132,7 @@
     {
       "path": "docs/adr/0128-provisioning-runner-privilege-and-db-auth-model.md",
       "mode": "0000644",
-      "sha256": "1f8311bbe45204ee6f049024e3630cd0586c9bed44c78d4dc1f870b0c0c2381c"
+      "sha256": "1b144566a9166db2a54c07241970d12621273e29691f799799fc5b6a39b3c440"
     },
     {
       "path": "docs/adr/0129-cloudbongos-control-plane-pull-deploy.md",
@@ -1212,7 +1212,7 @@
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
       "mode": "0000644",
-      "sha256": "53488f1ff783c49467dd7f9bcf17f5a35c8e3161e2840a89ac5f3f571f7471d9"
+      "sha256": "0eaedcf642882a857024cf68e900ecfca457ba379150a8afbd16a374c4a16c82"
     },
     {
       "path": "docs/adr/0146-configurable-reward-mode-cost-plus-only.md",
@@ -1914,10 +1914,15 @@
       "mode": "0000644",
       "sha256": "630f6460b3484f4cc629cce9c431f824bb8363d30a249db9e21e89863995c7ac"
     },
+    {
+      "path": "docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md",
+      "mode": "0000644",
+      "sha256": "96d78083fc4b04b8bdce61dee59e05465ec273759cfac325b160f68c8e5184a4"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "49273e63c50c201cd70200a4f0db7f233e496827823adb9449638eb5a0c1d030"
+      "sha256": "dd5c5de0fb4c01c355d4adc9cd550717bc6d6c074bedaf6e05fbbd0385fd9138"
     },
     {
       "path": "docs/api-reference.md",
@@ -2802,7 +2807,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ebca814eb4d786c2958e44b166b23986ef624b9145bc9c5a6b5a0068ef05a411"
+      "sha256": "94214ff6dfe72959e4aa130b0f40efde676215cae1cf8dcdd66ec9ca59972f0c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2992,7 +2997,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "d9956abefe8496cbbb8bbc94361431d40823c3a9d1fa8f4145e8b48999b54672"
+      "sha256": "dadf37b7916c96aeb6e5a1d068a8b59b7b73648dbf6816f949f63fe1220fad16"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -7787,12 +7792,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9e9bbca8f0efb3bed421d30ad97be1b18edf775e80cbc07590a583b2452ea609"
+      "sha256": "566cea60dfb2c1088d418f3ca787364b72cc4c83fdb73d7397f5cfbaa4a54981"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb6d8897c8a65579eaee354a12435b412606029b3f182f192cf5628941580075"
+      "sha256": "5e946e11f0cf01f78c59df42dec1f4903b79bb19b31e603be63e7997bddad050"
     },
     {
       "path": "public-docs/index.html",
@@ -8607,17 +8612,17 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "c87cccdd63ac6fa6d38771c3ad178e5e919f8bee62ad769b9d127819f84e2750"
+      "sha256": "3612ebe8f54da7498a6c4998e0d1d1c4596a80d54f70b5543b4a46dfca2ffbcf"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "55c394bb932966cd2c53ab44e34d7fc23e855c1157c185456c5a630d8c3e62e1"
+      "sha256": "a59615231f2843a11cf2d9d2f6f07c7aa2dacb6e83fb6126fdfeae9cfdc19abd"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "82fb65fea5dd9a33770690c902680cb428eb74b1c2abdaeab7f89f444ae1c11f"
+      "sha256": "007c5cfa3b42567df0016038fc7ec5c7dbdab60ec6ec8ecd9d06386933e5641d"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9412,7 +9417,7 @@
     {
       "path": "src/bongos/pool.js",
       "mode": "0000644",
-      "sha256": "c9edcf9cb1f027ca122388beabae488d2b771b9e7aee2cd12fbdb48ea6f0ded8"
+      "sha256": "5c6121de5ba67f23b4609ddf06cad6fcda1dd5e19f09996616a49e23bcca38a1"
     },
     {
       "path": "src/bongos/prelaunch-gate.js",
@@ -9572,7 +9577,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5359ee8368381b16bb0d6e18a13e390dd9366b3a3cdc3965e749cb5746f5cc4f"
+      "sha256": "fb8072c2a17b700fa08472c181b9e7beda25058987ecfcfea20825cb86849e0d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12142,7 +12147,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "d70cc9bd673dce403787814849abbeef9ed0ea01f9e38a2d3288886879490830"
+      "sha256": "e247471cb6b11000b0e2bcb41166c24adbbe0db902513832f5e40fe1ba655ef8"
     },
     {
       "path": "tests/provision_restart.mjs",

package/docs/adr/0128-provisioning-runner-privilege-and-db-auth-model.md

@@ -39,6 +39,8 @@ Add a single config knob, **`PROVISION_SUDO=1`** (alias `PROVISION_PRIVILEGED=1`
 - **The dedicated-droplet cloud-init path is deliberately unchanged** (`dedicatedUserData`). It runs as root on a fresh droplet — a different privilege + file-perms model — and is out of the co-tenant/standalone scope this task exercised; escalating it is a separate change.
 - **Follow-ups noted from the standup:** the live `/etc/caddy/Caddyfile` drifts from `infra/Caddyfile` with no auto-sync (a deploy-time reconcile is worth considering); the migrate-as-postgres readable-checkout precondition should be asserted by the box provisioning, not just documented.
 
+> **Followed up 2026-09-12 by [ADR 0281](<redacted>.md)** (task [1003369](https://cloudbongos.com/builders#/task/1003369)), which takes the last alternative below from the other end: the *instance* now holds per-instance DB credentials (its own password-authed role) rather than the runner holding app creds. **This ADR is unchanged** — the runner still escalates via `sudo -u postgres` for `createdb`/`migrate`, and `PROVISION_SUDO` still means exactly what it means here.
+
 ## Alternatives considered
 
 - **Grant `lars` a PG login role + writable `/etc`.** Rejected: non-portable per-box setup, and it weakens the trust boundary — the runner shouldn't *own* `/etc` or be a standing PG superuser; `sudo -u postgres` is scoped to the two DB commands.

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -21,6 +21,8 @@ The co-tenant instances that federate on cloudbongos.com subdomains today (e.g.
 
 A `standalone` runs **on the hub box** ([scripts/gds/provision.js](../../scripts/gds/provision.js): `standaloneBase`, control-plane-local IP) as the **same UID as the hub** (`serviceUnit` hardcodes `User=lars`), and its deploy runs `npm ci` (not `--ignore-scripts`) in a **passwordless-sudo-capable** runner context. A malicious owner could ship a `postinstall` and get code execution as `lars` with sudo on the hub box → the hub's signing key, every instance's secrets, the hub DB. This is a pre-existing property of running owner code on the hub box at all, independent of federation, but any free "run your code for you" tier would expose it at scale.
 
+> **Amended 2026-09-12 ([ADR 0281](<redacted>.md), task [1003369](https://cloudbongos.com/builders#/task/1003369)):** `serviceUnit` no longer hardcodes `User=lars` — each provisioned instance now runs as its own unix account with its own password-authed PG role, so the *running* instance is no longer the same UID as the hub. **Finding 2 stands regardless:** the exposure it names is the DEPLOY, not the steady state — `npm ci` still runs owner `postinstall` code in the passwordless-sudo-capable runner context, before the per-instance account is ever involved. The decision below is unchanged.
+
 The federation protocol itself is sound: the hub binds the minted audience to the instance's exact origin (the `#1002108` fix; asymmetric Ed25519 so one instance can't forge for another). A leaked per-instance client secret is contained to its own origin. The weakness is **placement** (shared cookie domain) and **execution** (owner code on the hub box), not the protocol.
 
 ## Decision

package/docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md

@@ -0,0 +1,56 @@
+# ADR 0281 — An instance's identity is its own unix account and its own password-authed Postgres role
+
+**Status:** Accepted — implemented 2026-09-12 (task [1003369](https://cloudbongos.com/builders#/task/1003369) · goal 1000094, audit ref `B3` of the 2026-08-29 security audit).
+
+## Context
+
+[ADR 0111](<redacted>.md) made instance standup automatic and [ADR 0128](<redacted>.md) settled how the *runner* escalates to perform it. Neither settled who the *instance* is once it is running, and the answer was: everybody is the same person.
+
+`serviceUnit` hardcoded `User=lars` / `Group=lars`, and **co-tenant is the default shape** — so on a shared box every instance's Node process ran under one uid. Two consequences, both reachable by any code an instance runs, neither of them a bug in any route:
+
+- **Sibling environments.** A unix user may read `/proc/<pid>/environ` of its own processes. Every instance's `EnvironmentFile` carries `GITHUB_APP_PRIVATE_KEY`, `<PREFIX>_HUB_CLIENT_SECRET` and its OAuth client secret ([ADR 0141](<redacted>.md) §4, [ADR 0133](<redacted>.md)). One uid meant every instance could read every sibling's.
+- **Sibling databases.** `src/bongos/pool.js` connected by **passwordless peer auth** over the local socket, with `PGDATABASE` supplied as a systemd `Environment=` default. Peer auth answers "which unix user are you", so any code running as `lars` could open a pool against **any** database on the box by naming it — including the control plane's own `builders` and `builder_sessions`.
+
+The per-instance `web.env` (`chmod 600`) and the per-instance database were already correct. They were sound walls with one door, and every instance had the key.
+
+ADR 0128 anticipated the DB half in its own alternatives: *"Do createdb/migrate via the app `DATABASE_URL` … Left open for a future instance that wires DB creds into the runner's box.env."* This is that change, from the other end — the instance gets credentials, not the runner.
+
+## Decision
+
+**Each instance gets its own unix account and its own password-authenticated Postgres role, both derived from its slug, both created by the provision run.**
+
+**Naming.** `instanceUser(inst)` → `bongos-<slug>`, folded to `bongos-<head>-<8 hex of sha256(slug)>` when the slug would push it past utmp's 32 characters. Prefixed, never the bare slug: a project may legally be called `postgres` or `lars`, and a bare-slug scheme would hand it an existing account. The hash suffix is not decoration — two slugs sharing a 16-character prefix would otherwise fold onto one account, which is precisely the shared identity being removed. An invalid slug **throws** rather than producing a name.
+
+**The unix account** is a system account with `/usr/sbin/nologin` and a home at `/var/lib/<user>` — deliberately **not** under `/home`, because the unit sets `ProtectHome=read-only` and the server writes inside its config home on first boot (`secret-box.js` provisions `builder-secret.key` there). A `/home` account would make that write `EROFS` and the instance would come up unable to hold a secret.
+
+**The unit** carries the hardening block the sibling backup unit already had — `ProtectSystem=strict`, `ProtectHome=read-only`, `PrivateTmp=true`, alongside the existing `NoNewPrivileges=true` — with `ReadWritePaths` as the entire allow-list: the state dir, plus an **optional** `-<workDir>/config` (the modules toggle writes `config/modules.json` at runtime; the `-` keeps a shape without one from failing to mount). **The checkout the service runs is deliberately not writable by it.**
+
+**The Postgres role** is created or rotated per run: `LOGIN` with a password, owner of its own database, `REVOKE CONNECT … FROM PUBLIC` — and **not** `SUPERUSER`, `CREATEDB`, `CREATEROLE` or `BYPASSRLS`. The revoke is the half that isolates: Postgres grants `CONNECT` on every database to `PUBLIC` by default, so per-role passwords **alone** would leave a sibling one peer-auth hop from any other instance's data. The grants run in a **second** statement against the instance DB, **after** the migrate, because the privileged migrate runs as `postgres` and therefore owns every table it creates; `ALTER DEFAULT PRIVILEGES` aims the same grant forward so the next migration needs no second visit.
+
+**The password** is minted per provision run (32 bytes, base64url) and never stored: the same run sets it on the role and writes it into the `0600` `web.env`, so **every provision rotates the credential** and no plaintext copy outlives the run outside that file. `pool.js` reads `PGUSER`/`PGPASSWORD` **explicitly** rather than leaving them to `pg`'s env defaults — the whole defect was a connection whose identity nothing in the code stated, so the identity is now stated where a test can assert it.
+
+**Where the credential may travel is part of the decision, not an afterthought.** Two paths carry the rendered command, and both would have persisted the password somewhere this ADR cannot lock down:
+
+- **The runner’s own log.** `makeExec`’s `run()` prints the raw command on both the dry-run and the success path, so the role DDL — which embeds the password — would land in the journal. The call site passes **`shown`**, the same mechanism `makeWriteFile` already uses for the `web.env` body, and `dbRoleCmdShown()` lives beside `dbRoleCmd` so a label cannot outlive the secret it hides. A `shown` call site also suppresses stderr, since a failing shell may echo the line back.
+- **DigitalOcean cloud-init user-data.** DO **retains** user-data and serves it back through its API, its console and the droplet’s own metadata endpoint — a permanent second copy. So the dedicated shape takes **`peerOnly`**: the role, its DB ownership and the `PUBLIC` revoke are all still created, and only the password is omitted. A dedicated droplet is **single-tenant**, so the co-tenancy vector B3 describes does not exist on it, and the role peer-auths to its own unix account. Baking a credential into a retained blob to defend against siblings that are not there would be strictly worse than the thing it protects against.
+
+**Absence is the old behavior.** No password ⇒ no `PGUSER`/`PGPASSWORD` lines in `web.env` and no keys in the pool config, so an instance provisioned before this keeps exactly the peer auth it had. This cannot brick a box mid-rollout.
+
+## Consequences
+
+- **The two named vectors close.** `/proc/<pid>/environ` is readable only by the process's own uid, so sibling environments are gone; a sibling holds no password for another's role and `PUBLIC` no longer carries `CONNECT`, so sibling databases are gone.
+- **The SQL contains no double quote, and that is load-bearing.** Every literal is dollar-quoted and every identifier goes through `format(%I)`, because these commands are embedded in the dedicated droplet's cloud-init as `- [ bash, -lc, "…" ]` — a YAML **double-quoted** scalar. A plain `"role"` identifier reads fine in `psql` and silently truncates the cloud-init line. `seedFirstVersionCmd` dollar-quotes for the same reason; a test now asserts the absence rather than leaving it to habit.
+- **A partial, stated honestly: on-disk co-tenant reads.** The instance account is added to the app-user group (`usermod -aG`) so it can read the checkout it runs from — without it the unit fails at exec with `EACCES`. That grants exactly the read the app user's group already had, so **file-level** co-tenant separation is not what this change delivers; the process and database boundaries are. Narrowing it further means per-instance ownership of the checkout, which belongs with the shared-checkout question, not here.
+- **A generated secret is only as private as the narrowest channel it crosses.** Both leaks above were found by the ship grade, not by the design, and neither was a typo: each was a call site that never opted into a redaction mechanism the codebase already had. The regression guard is written as an **invariant** rather than an assertion about one line — `provisionInstance` is run and *every* command embedding a dollar-quoted secret must carry a clean `shown` — so the next secret-bearing call site is caught by the same test.
+- **Re-provision is the rotation path**, and it is idempotent throughout: `id -u` short-circuits an existing account, `install -d` re-asserts the state dir, and the role DDL upserts. A re-provision repairs a hand-edited box rather than failing on it.
+- **`provision.js` sits two lines under the 1,500-line ratchet.** The generators and their full rationale live in `provision-repo.js`; the runner carries the wiring and a pointer. The next change there will have to move something out.
+- **The non-privileged path is unchanged in kind.** The DDL escalates through the same `asPostgres()` helper ADR 0128 introduced, so a runner without `PROVISION_SUDO` renders the same commands without `sudo` — as broken, and no more broken, than it already was for `createdb`.
+
+## Alternatives considered
+
+- **A `DATABASE_URL` in `web.env` instead of discrete `PG*` vars.** `pool.js` already prefers it, so it would have needed no pool change at all. Rejected: the socket path has to ride as `?host=…` or a percent-encoded authority, and the exact parse is `pg-connection-string`'s business rather than something the test could pin — trading a stated, assertable identity for a URL whose behavior we would be trusting.
+- **Per-role passwords without `REVOKE CONNECT … FROM PUBLIC`.** Rejected on the mechanism: it reads like isolation and is not, because peer auth plus the default `PUBLIC` grant walks straight around the password.
+- **`ProtectSystem=full`, or `strict` with the working directory writable.** Rejected: the first leaves everything outside `/usr` writable, and the second makes the code the service executes writable by the service — an obvious foothold in a change whose whole subject is containment.
+- **Keeping `User=lars` and isolating with a second mechanism** (a PG role alone, or namespaces). Rejected: the shared uid *is* the `/proc` vector; nothing layered on top removes it.
+- **Generating the dedicated droplet’s password on the droplet** (`openssl rand` inside a `runcmd`), instead of `peerOnly`. Rejected: it would have to be written into a `web.env` that cloud-init does not currently produce at all, so it buys a password for a single-tenant box by adding an untested file-writing leg to the one path ADR 0128 explicitly left alone.
+- **Storing the generated password in `provisioning_instances`.** Rejected: it would put a live credential in the control-plane database in plaintext to buy stability the rotation does not need — the role is upserted and the env file rewritten in the same pass, so nothing needs to remember it.

package/docs/adr/README.md

@@ -372,3 +372,4 @@ This keeps the decision history honest and traceable.
 | 0278 | [**A gated project still takes applications, and the exemption is scoped to the verb** ([task 1003525](https://cloudbongos.com/builders#/task/1003525) · the apply write itself in [task 1003624](https://cloudbongos.com/builders#/task/1003624) · goal 1000106 — *Working area 1, Project creation*; owner decision 2026-09-11). A project's owner sets who may SEE it (`platformVisibility`, [ADR 0192](<redacted>.md)) and who may JOIN it (`joinability`, [ADR 0194](<redacted>.md)) independently — and set to their middle values, members-only AND apply-to-join, the project took no applications at all: the member door refused every cookie-less request with `401` before the public `POST <api>/access-requests` could answer, because that write was not on the exempt list. The two settings composed into **"nobody can apply"**, which nobody chose. It survived because nothing LIED about it — the hub's join box relayed the project's own `401` honestly as `members_only`, and the hall's landing, where the apply form lives, is itself behind the door; the composition was simply unreachable. Found by the R14 proof ([task 1002333](https://cloudbongos.com/builders#/task/1002333)). ADR 0192 §3 had fixed the exempt list at "the door, the manifest, the probes and the downloads — and nothing wider" and left widening it as an owner call, which is what this is. **Decision: yes — and BOTH halves are exempted, each scoped to one path and one verb.** `POST <api>/access-requests` (it grants nothing — an application is a row in a queue the owner still reviews, [ADR 0201](<redacted>.md), already public on every non-gated project) and `GET <api>/access-requests/status` (without it the answer is half an answer: `bongos login` cannot re-poll the device flow after a `not_approved` — the `device_code` is spent — so an applicant would file a request and then wait on an approval they can never observe). `EXEMPT` entries may now be `{ re, methods }` beside the bare `RegExp`s, and `isExempt(path, method)` takes the verb as an OPTIONAL second argument that **fails closed** for a scoped entry when none is given, so the one-argument static callers cannot accidentally widen. **The verb is load-bearing, not tidiness:** the bare `GET` on `<api>/access-requests` is the OWNER'S QUEUE (`requireBuilder` + `access_request.review`), the surface listing would-be builders by name with their vouch state — a path-only exemption would have silently taken the member door off the front of it, leaving one layer where there were two, and the queue's own `requirePermission` still holding is exactly what makes that loss easy to miss. **It opens no oracle the gate was closing:** the status route's boolean twin `GET <api>/auth/web/admission-status` is ALREADY reachable on a gated project inside the `auth/*` subtree §3 exempts whole (§3 records that cost in as many words), and the two share ONE per-IP budget on purpose ([ADR 0209](<redacted>.md)) so neither can be alternated against the other. What it DOES add, stated as the honest cost: applicant detail — `pending`/`dismissed`/`none` over the twin's bare `admitted`. Whether that answer should collapse is ADR 0209's still-open owner question and is deliberately NOT decided here. No hub change: `joinRelayOutcome` maps the RELAYED status, so it carries the project's real answer the moment the `401` stops. Rejected: "gated means gated" — hide *Apply to join* and say so in the manage blurb (coherent, and the call went the other way); exempting the path without the verb; exempting the write alone; collapsing the status response while the route happened to be open (that is how a deferred decision gets made by accident).](<redacted>.md) | project visibility / join door / member door |
 | 0279 | [**An upgrade is proven by the served version, not by a health check** ([task 1002884](https://cloudbongos.com/builders#/task/1002884) · goal 1000090 — *Working area 4, Bongos Core distribution*; from idea 1000682). On 2026-08-11 the auto-upgrade sweep printed `✓ upgrade complete — core 1.19.13 → 1.19.56`, wrote a success row to `core_upgrades` and exited 0 while live kept serving **1.19.13**. Three shipped checks formed a closed loop that could not see the failure they existed to catch: the `systemctl restart` failed with `Interactive authentication required` (a `User=` unit, no TTY) and `upgrade.js` treated it as a WARNING and fell through; `readInstalledCoreVersion()` then confirmed the version on **disk**, where `npm install` had correctly put it; and `pollHealth()` got a 200 from the **still-running old process**, because a health check confirms a port is served, never *what* serves it. A lying tool is worse than a broken one — nothing goes looking. The damage outlived the incident: `subscribe.js` had already routed the unattended lane around `bongos upgrade` in favour of `go-live.js`, citing this false-pass in a comment. **Decision: a bump is confirmed by asking the running process what version it is.** (1) A failed restart enters the same auto-rollback path as a failed install/migrate/health and exits non-zero — rolling back rather than merely erroring keeps disk and process consistent, since disk-ahead-of-process is the state that made the incident invisible. (2) The served version is read back from `/version` (`coreVersion`, since 1.17.2, prelaunch-gate exempt), defaulting to the `--health-url` origin and overridable via `--version-url` — derived rather than opt-in because every existing call site passes only `--health-url`, and a check you must opt into is off exactly where it is needed. (3) A **mismatch** fails (proof of failure → roll back); an **unreadable** endpoint only warns (absence of proof — refusing every such bump would regress harder than the false-pass), except under an explicit `--version-url`, which asks for proof and therefore gets a failure. That strict mode is what the unattended subscription lane now passes, its roster already carrying the URL. **Escalation is `sudo -n`, not a hand-placed polkit rule:** `restartService()` retries a failed restart through `sudo -n` when not root — the idiom `dev.js`/`dev-lib.js` already use and consistent with `provision.js`, `upgrade.js` having been the one place that restarted without escalating. The live `/etc/polkit-1/rules.d/<redacted>.rules` mitigation is superseded: a rebuilt box inherits code, not hand-placed `/etc` files (polkit route kept in [`docs/recipes/instance-service-restart.md`](../recipes/instance-service-restart.md)). `--no-health-check` stays the single escape hatch and now waives the read-back too. Rejected: comparing `startedAt` (cannot distinguish a restart onto the same old core from one onto the new); making an unreadable endpoint fatal by default; requiring `--version-url` everywhere (absent from every current call site — the same "off where it matters" failure in a new costume); keeping polkit as the answer.](<redacted>.md) | core distribution / upgrade verification |
 | 0280 | [**The unattended lane may drive a co-tenant, because the roster entry IS the per-instance decision** ([task 1003843](https://cloudbongos.com/builders#/task/1003843) · goal 1000106; from [task 1003521](https://cloudbongos.com/builders#/task/1003521), which built co-tenant mode into `go-live.js` and deliberately left this caller alone). `subscribe.js` keeps a SECOND COPY of go-live's target contract, and it drifted: `GO_LIVE_REQUIRED` still listed `deployTimer` after 1003521 made it optional, so `goLiveTargetFor()` returned `missing: ['deployTimer']` for every provisioned co-tenant, and `rawTopologyFor()`'s fixed field list dropped `pinMode` before the target was built — the same stale-normalizer trap that function's own comment was written to fix, one field later. **1003521 deferred this as a policy judgement call; reading the fallback shows the premise was wrong.** `mapped.ok === false` never meant "skip this instance" — it meant "deploy it the WEAKER way": a bare `bongos upgrade`, no backup, no deploy-timer guard, and a pin COMMITTED AND PUSHED into the co-tenant's own repo, which is exactly what `pinMode` exists to prevent. The lane was already auto-deploying co-tenants; the only open question was whether it did so well. A THIRD defect sat behind the other two and would have turned the silent downgrade into a hard failure had only the first been fixed: the normalizer yields `deployTimer: null`, an explicit null SURVIVES `JSON.stringify` into `--target-json`, and go-live's `validateTarget` runs `isSafeToken(null)` on it and rejects the whole target. A FOURTH sat PAST the go-live call and is what separates "reachable" from "safe": after any successful upgrade the lane runs its own pin net, `commitPin()`, which commits the pin files and PUSHES them to `origin` — a net that predates `pinMode`. Under `local-commit` go-live leaves the tree clean so it no-ops by luck; under **`leave-dirty`** the pin is in the working tree BY DESIGN, so the net committed it and pushed it into the customer's own repo — the lane honouring `pinMode` right up to the moment it undid it. **Decision: the lane may drive a co-tenant and needs no new gate, because listing an instance in `config/update-subscriptions.json` already IS the explicit per-instance operator decision** — the roster ships empty, nothing is touched until an operator lists it, and the routine is autonomy-gated (`requiresAutonomy: true`, default OFF) on top of that; a second consent gate asks the same person the same question twice. So: `GO_LIVE_REQUIRED` now MIRRORS go-live's `REQUIRED_FIELDS`, with a test reading BOTH source files and failing on drift; `deployTimer` moves to the optional-field loop so a co-tenant OMITS the key rather than carrying a null; `rawTopologyFor` carries `pinMode`; `resolveGoLive` gains a `needsCoTenant` probe leg; and `goLiveEngineFor()` makes the decision ONCE for both the dry run and the apply path, which had re-derived it separately. The pin net now obeys the same `pinMode` go-live was given — `commitPin()` takes `push` (default true, so the platform instance is unchanged), `local-commit` commits without pushing, `leave-dirty` skips the net, the rollback tidy follows the same rule, and the "not durable" advice stops telling an operator to `git push` a repo we do not own; its refusal to touch a worktree carrying NON-pin changes is unchanged in every mode. **The probe is CONDITIONAL on purpose** — demanding `pinMode` of every target would strip the go-live path from any instance between the `--target-json` release and 1003521's, trading a live regression for a hypothetical one. Rejected: a second consent gate (an `allowCoTenant` flag); deferring to the unspecced fleet control plane ([task 1001948](https://cloudbongos.com/builders#/task/1001948)) — which does not leave co-tenants alone, it leaves them pushing pins into customer repos; dropping `deployTimer` from `GO_LIVE_REQUIRED` and nothing else (the fix as proposed — trades a silent downgrade for a hard rejection); probing unconditionally; reaching co-tenant mode WITHOUT teaching the durability net about it (nominal support that breaks its own promise seconds later); and teaching `loadSubscriptions()` about `pinMode` instead, since that normalizer ships in the control plane's vendored core that nobody bumps — the exact trap `rawTopologyFor` routes around.](<redacted>.md) | core distribution / unattended deploy |
+| 0281 | [**An instance’s identity is its own unix account and its own password-authed Postgres role** ([task 1003369](https://cloudbongos.com/builders#/task/1003369) · goal 1000094, audit ref `B3` of the 2026-08-29 security audit). [ADR 0111](<redacted>.md) made standup automatic and [ADR 0128](<redacted>.md) settled how the RUNNER escalates; neither settled who the INSTANCE is once it runs, and the answer was that everybody was the same person. `serviceUnit` hardcoded `User=lars`, and **co-tenant is the default shape** — so on a shared box every instance’s process ran under one uid, and `pool.js` connected by **passwordless peer auth**. Two consequences, neither a bug in any route: a unix user may read `/proc/<pid>/environ` of its own processes, so every instance could read every sibling’s `GITHUB_APP_PRIVATE_KEY`, hub client secret and OAuth secret; and peer auth answers “which unix user are you”, so any code as `lars` could open a pool against **any** database on the box by naming it — including the control plane’s own `builders` and `builder_sessions`. The `0600` `web.env` and the per-instance DB were already correct: sound walls with one door, and every instance had the key. **Decision: each instance gets its own unix account and its own password-authed PG role, both derived from its slug, both created by the provision run.** The account is `bongos-<slug>`, hash-folded past utmp’s 32 chars — prefixed because a project may legally be called `postgres`, and hash-suffixed because two slugs sharing a 16-char prefix would otherwise fold onto ONE account, which is the shared identity being removed. Its home is `/var/lib/<user>` and deliberately **not** under `/home`, since the unit sets `ProtectHome=read-only` and the server writes `builder-secret.key` inside its config home on first boot — a `/home` account would make that `EROFS`. The unit gains `ProtectSystem=strict` / `ProtectHome=read-only` / `PrivateTmp=true` with `ReadWritePaths` as the whole allow-list; **the checkout the service runs is deliberately not writable by it**. The role is `LOGIN` + password, owns its own DB, and is NOT superuser/CREATEDB/CREATEROLE — with **`REVOKE CONNECT … FROM PUBLIC` as the half that actually isolates**, because PG grants `CONNECT` to `PUBLIC` by default and per-role passwords alone leave a sibling one peer-auth hop away. Grants run in a SECOND statement **after** the migrate, since the privileged migrate runs as `postgres` and owns every table it creates; `ALTER DEFAULT PRIVILEGES` aims the same grant forward. The password is minted per run and never stored — the same run sets it on the role and rewrites the `0600` env file, so **every provision rotates it** — and `pool.js` reads `PGUSER`/`PGPASSWORD` **explicitly** rather than via `pg`’s env defaults, because the whole defect was a connection whose identity nothing in the code stated. **Absence is the old behavior:** no password ⇒ no credential lines and no pool keys, so an instance provisioned before this keeps its peer auth and the rollout cannot brick a box. Two consequences worth the record. (1) **The generated SQL contains no double quote, and that is load-bearing** — every literal is dollar-quoted and every identifier goes through `format(%I)`, because these commands are embedded in the dedicated droplet’s cloud-init as `- [ bash, -lc, "…" ]`, a YAML DOUBLE-QUOTED scalar: a plain `"role"` identifier reads fine in `psql` and silently truncates the line. A test asserts the absence rather than leaving it to habit. (2) **A partial, stated honestly** — the account is added to the app-user group so it can read the checkout it runs from (without it the unit fails at exec with `EACCES`), so FILE-level co-tenant separation is not what this delivers; the process and database boundaries are. Rejected: a `DATABASE_URL` in `web.env` (needs no pool change, but trades a stated, assertable identity for a socket-path parse that is `pg-connection-string`’s business); per-role passwords WITHOUT the `PUBLIC` revoke (reads like isolation, and peer auth walks around it); `ProtectSystem=full`, or `strict` with the working directory writable (makes the code the service executes writable by the service, in a change whose subject is containment); keeping `User=lars` and isolating with a second mechanism (the shared uid IS the `/proc` vector); storing the password in `provisioning_instances` (a live credential in plaintext, to buy stability the rotation does not need).](<redacted>.md) | tenant isolation / provisioning / DB auth |

package/docs/module-api-changelog.md

@@ -1877,5 +1877,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.707 with no explicit bump. run 34742245823. (task 1002620)
   1.19.709 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.708 with no explicit bump. run 34743928060. (task 1002620)
+  1.19.710 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.709 with no explicit bump. run 34744369035. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/ops-gotchas.md

@@ -25,6 +25,20 @@ Organized by topic, not chronology. New entries go in the matching section; crea
 - **Why it bites:** The `pg` library's defaults assume a standard TCP+password setup, which is the most common configuration but not the cheapest one for a single-machine deploy. Peer auth is more secure and frictionless once you know the socket path. The error message points at SASL, not at the host setting, which buries the real cause.
 - **Where this lives in the codebase:** [`src/db.js`](../../src/db.js) has the explicit socket host.
 
+### Re-provisioning an EXISTING instance moves its `HOME`, orphaning any stored builder secrets
+
+- **Symptom:** after a re-provision, an instance that had builder API keys stored can no longer decrypt them. Nothing errors at startup — the instance comes up healthy and simply behaves as though no key was ever saved.
+- **Root cause:** task [1003369](https://cloudbongos.com/builders#/task/1003369) ([ADR 0281](../adr/<redacted>.md)) gives each instance its own unix account with `HOME=/var/lib/bongos-<slug>`. [`src/bongos/secret-box.js`](../../src/bongos/secret-box.js) keeps its master key at `~/.config/<configDir>/builder-secret.key`, so the key an instance wrote under the OLD shared home (`/home/lars/.config/…`) is no longer on its `HOME` path. `provisionMasterKey()` finds nothing, mints a fresh key, and every previously encrypted secret is now undecryptable ciphertext.
+- **Who this hits:** only a **re-provision of an instance that has already stored secrets**. A fresh standup has nothing to lose, and an instance whose `web.env` sets `BUILDER_SECRET_KEY` is unaffected — that env wins over the file.
+- **Fix (before the re-provision, one command as root):**
+  ```bash
+  install -D -o bongos-<slug> -g bongos-<slug> -m 600 \
+    /home/lars/.config/<configDir>/builder-secret.key \
+    /var/lib/bongos-<slug>/.config/<configDir>/builder-secret.key
+  ```
+  `<configDir>` is the instance’s `branding.configDir` (vanilla: `cloudbongos`). Do it **first** — `provisionMasterKey()` writes with the `wx` flag and refuses to clobber, so a key placed after the instance has already minted its own will not be picked up.
+- **Why it bites:** the failure is silent on both ends. The old key is not deleted, the new one is valid, and the only visible symptom is secrets that quietly stopped working.
+
 ---
 
 ## Colyseus

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.709",
+  "version": "1.19.710",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.709",
+      "version": "1.19.710",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.709",
+  "version": "1.19.710",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo.js

@@ -10,6 +10,7 @@
 
 'use strict';
 
+const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -111,6 +112,177 @@ function standaloneMigrateCmd(inst, { privileged = false } = {}) {
 // transfer from primea"): its bespoke pull-deploy regenerated nothing.
 function standaloneRegenDocsCmd() { return `node ${CORE_PKG_DIR}/scripts/gds/regen-instance-docs.js`; }
 
+// ── Per-instance identity: its OWN unix account + its OWN password-authed PG role ──
+// (task 1003369, audit ref B3 of the 2026-08-29 security audit.)
+//
+// THE HOLE THIS CLOSES. Every instance service used to run `User=lars/Group=lars`, and
+// co-tenant is the DEFAULT shape — so on a shared box every instance ran as the SAME
+// unix user. A unix user may read /proc/<pid>/environ of its own processes, which means
+// any instance could read every SIBLING's environment: GITHUB_APP_PRIVATE_KEY, the
+// <PREFIX>_HUB_CLIENT_SECRET, every OAuth secret web.env carries. The DB half was the
+// same shape one layer down: pool.js connected by PASSWORDLESS peer auth, so any code
+// running as lars could open a pool against any sibling database — including the control
+// plane's own `builders` and `builder_sessions`. Neither was a bug in a route; it was the
+// identity every instance shared. Giving each instance its own unix account and its own
+// password-authed role is what makes the boundary real.
+//
+// NAME SHAPE. A unix account name is capped at 32 chars (utmp) and must match
+// [a-z_][a-z0-9_-]*; a slug is 2–40 of [a-z0-9-] (isValidSlug). So the name cannot be
+// the slug verbatim, and it must not be the BARE slug either — that would let a project
+// named `postgres` or `lars` claim an existing account. Prefixed + length-folded:
+//   short slug → bongos-<slug>
+//   long slug  → bongos-<slug truncated>-<8 hex of sha256(slug)>   (still <= 32)
+// The hash suffix keeps two slugs that share a 16-char prefix from folding onto one
+// account — which would hand each the other's identity, the very thing being fixed.
+const INSTANCE_USER_PREFIX = 'bongos-';
+const INSTANCE_USER_MAX = 32;              // utmp's cap; useradd enforces it
+
+// The unix account an instance's service (and only that instance's service) runs as.
+// Deterministic — the runner derives it fresh every run rather than storing it, so a
+// re-provision can never address a different account than the one it created. PURE.
+function instanceUser(inst) {
+  const slug = String((inst && inst.slug) || '');
+  if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(slug)) {
+    throw new Error(`instanceUser: refusing to derive an account name from an invalid slug ${JSON.stringify(slug)}`);
+  }
+  const whole = INSTANCE_USER_PREFIX + slug;
+  if (whole.length <= INSTANCE_USER_MAX) return whole;
+  const digest = crypto.createHash('sha256').update(slug).digest('hex').slice(0, 8);
+  // Budget: prefix + head + '-' + 8 hex === INSTANCE_USER_MAX. Trailing dashes are
+  // stripped so the fold can never emit `--` (which useradd's NAME_REGEX rejects).
+  const head = slug.slice(0, INSTANCE_USER_MAX - INSTANCE_USER_PREFIX.length - 9).replace(/-+$/, '');
+  return `${INSTANCE_USER_PREFIX}${head}-${digest}`;
+}
+
+// The instance account's HOME — and the ONE directory the hardened unit leaves
+// writable. It is deliberately NOT under /home: the unit sets ProtectHome=read-only
+// (so one instance cannot read the operator's or a sibling's home), and the server DOES
+// write inside its config home at runtime — src/bongos/secret-box.js provisions
+// builder-secret.key under ~/.config/<configDir> on first boot. A /home account would
+// make that write EROFS and the instance would come up unable to hold a secret. PURE.
+function instanceStateDir(inst) { return path.posix.join('/var/lib', instanceUser(inst)); }
+
+// The instance's OWN Postgres login role. Same name as the unix account so an operator
+// reading `ps` and `pg_stat_activity` sees one identity, not two — a dash is legal in a
+// quoted PG identifier, and every SQL site below quotes it. PURE.
+function instanceDbRole(inst) { return instanceUser(inst); }
+
+// A fresh password for that role. base64url ([A-Za-z0-9_-]) on purpose: it needs no
+// escaping in the env file that carries it, in the dollar-quoted SQL literal that sets
+// it, or in a connection URL — the three places it travels. 32 bytes ~ 256 bits.
+// Generated per provision run, not stored: every run ALTERs the role and rewrites
+// web.env in the same pass, so the credential rotates on its own.
+function generateDbPassword() { return crypto.randomBytes(32).toString('base64url'); }
+
+// Create the instance's unix account if it is not already there, with its state dir.
+// IDEMPOTENT by construction — `id -u` short-circuits an existing account, and the
+// `install -d` re-asserts ownership and mode on every run, so a re-provision repairs a
+// hand-edited box instead of failing on it. A SYSTEM account with /usr/sbin/nologin:
+// nothing should ever log in as an instance.
+function ensureInstanceUserCmd(inst, { privileged = false } = {}) {
+  const user = instanceUser(inst), dir = instanceStateDir(inst), sudo = privileged ? 'sudo ' : '';
+  return `id -u ${user} >/dev/null 2>&1 || ${sudo}useradd --system --shell /usr/sbin/nologin --home-dir ${dir} ${user}; ` +
+         `${sudo}install -d -o ${user} -g ${user} -m 0700 ${dir}`;
+}
+
+// Let the instance account READ the checkout it runs from. The co-tenant shape's
+// WorkingDirectory is this control-plane checkout and the standalone shape's is
+// /srv/<base>/<slug>; both are owned by the app user, and a fresh system account is in
+// neither the owner nor the group, so without this the unit fails at exec with EACCES.
+// Group membership grants exactly the read the app user's group already has — it does
+// NOT re-open the two vectors this task closes: /proc/<pid>/environ stays readable only
+// by the process's own uid, and the DB now demands a password no sibling holds.
+function grantInstanceRepoReadCmd(inst, { privileged = false } = {}) {
+  return `${privileged ? 'sudo ' : ''}usermod -aG ${APP_USER} ${instanceUser(inst)}`;
+}
+
+// Create-or-rotate the instance's PG login role and hand it its OWN database — and
+// nothing else. Three statements, one psql, ON_ERROR_STOP:
+//   1. CREATE ROLE ... LOGIN PASSWORD, or ALTER ... PASSWORD when it already exists (the
+//      re-provision path — this is what rotates the credential).
+//   2. ALTER DATABASE ... OWNER TO — the role owns its own DB, so the app's DDL needs no
+//      superuser, and in PG15+ it inherits the public schema through pg_database_owner.
+//   3. REVOKE CONNECT ... FROM PUBLIC — the half that actually isolates. Postgres grants
+//      CONNECT on every database to PUBLIC by default, so per-role passwords ALONE would
+//      still leave a sibling one peer-auth hop from any other instance's data.
+// NOT a superuser and NOT CREATEDB/CREATEROLE: an instance that is compromised gets its
+// own data and no path to anyone else's.
+//
+// Runs against `postgres`, not the instance DB: ALTER DATABASE ... OWNER cannot run from
+// inside the database it renames the owner of.
+//
+// QUOTING, which is load-bearing in a way that is easy to undo by accident. Every literal
+// is DOLLAR-QUOTED and every identifier goes through format(%I), so the rendered command
+// contains no single quote and NO DOUBLE QUOTE. It has to survive three executors
+// unchanged — inline /bin/sh, `bash -s` over SSH, and, the strict one, `- [ bash, -lc,
+// "..." ]` inside the dedicated droplet's cloud-init, which is a YAML DOUBLE-QUOTED
+// scalar. A plain "role" identifier reads fine in psql and silently truncates the YAML.
+// seedFirstVersionCmd dollar-quotes for the same reason; a test asserts the absence.
+// `peerOnly` is the DEDICATED shape's mode, and it exists because of where that
+// command TRAVELS (task 1003369). A dedicated droplet's steps ride DigitalOcean
+// cloud-init user-data, which DO RETAINS and serves back through its API, its console
+// and the droplet's own metadata endpoint — so a password embedded there is a second,
+// permanent copy of the credential in a place this task cannot lock down, which is
+// strictly worse than what it protects against. A dedicated droplet is SINGLE-TENANT:
+// there are no siblings on it, so the co-tenancy vector B3 describes does not exist,
+// and the role can peer-auth to its own unix account. The role, its DB ownership and
+// the PUBLIC revoke are still created — only the password is omitted, deliberately.
+function dbRoleCmd(inst, { password = null, peerOnly = false, privileged = false } = {}) {
+  const role = instanceDbRole(inst), db = dbName(inst);
+  if (peerOnly) {
+    if (password) throw new Error('dbRoleCmd: peerOnly takes no password — it exists to keep one out of cloud-init user-data');
+  } else if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
+    throw new Error('dbRoleCmd: password must be a non-empty base64url string (generateDbPassword)');
+  }
+  // Two shapes of the same upsert. peerOnly omits the PASSWORD clause entirely rather
+  // than passing an empty one — `WITH LOGIN` leaves any existing password untouched.
+  const login = peerOnly
+    ? { clause: 'WITH LOGIN', args: '' }
+    : { clause: 'WITH LOGIN PASSWORD %L', args: `, $p$${password}$p$` };
+  const sql =
+    `DO $do$ BEGIN ` +
+    `IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $r$${role}$r$) THEN ` +
+    `EXECUTE format($f$ALTER ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `ELSE ` +
+    `EXECUTE format($f$CREATE ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `END IF; ` +
+    `EXECUTE format($f$ALTER DATABASE %I OWNER TO %I$f$, $d$${db}$d$, $r$${role}$r$); ` +
+    `EXECUTE format($f$REVOKE CONNECT ON DATABASE %I FROM PUBLIC$f$, $d$${db}$d$); ` +
+    `END $do$;`;
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d postgres -c '${sql}'`, privileged);
+}
+
+// What the runner LOGS in place of dbRoleCmd, whose SQL embeds the password. Lives here,
+// beside the command, so the two cannot drift: a `shown` that outlived the secret it hides
+// would be a silent re-leak. Names every effect the real command has. PURE.
+function dbRoleCmdShown(inst) {
+  return `psql -d postgres -c '<upsert role ${instanceDbRole(inst)} + own ${dbName(inst)} + revoke PUBLIC connect>' (password redacted)`;
+}
+
+// Hand the instance role the objects the migrate just created. This is NOT belt-and-braces:
+// the privileged migrate runs as `postgres`, so every table and sequence it creates is
+// OWNED BY postgres. Owning the DATABASE does not carry ownership of objects inside it, so
+// without these grants the instance would authenticate perfectly and then fail its first
+// SELECT. The ALTER DEFAULT PRIVILEGES pair is the same statement aimed forward: it applies
+// to objects the CURRENT role creates later, which is exactly what the next migrate does —
+// so a schema migration shipped six months from now needs no second visit here.
+//
+// Runs against the instance DB (schema grants are per-database), and AFTER the migrate.
+function dbRoleGrantsCmd(inst, { privileged = false } = {}) {
+  const role = instanceDbRole(inst), db = dbName(inst);
+  // Same quoting rule as dbRoleCmd: format(%I), never a double-quoted identifier.
+  const g = (stmt) => `EXECUTE format($f$${stmt} %I$f$, $r$${role}$r$); `;
+  const sql =
+    `DO $do$ BEGIN ` +
+    g('GRANT ALL ON SCHEMA public TO') +
+    g('GRANT ALL ON ALL TABLES IN SCHEMA public TO') +
+    g('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO') +
+    g('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO') +
+    g('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO') +
+    `END $do$;`;
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${db} -c '${sql}'`, privileged);
+}
+
 // ── STANDALONE scaffold (ADR 0108 / 0125, task 2055) ──────────────────────────
 // The MISSING first leg of the greenfield "one guided flow": provision.js used to
 // THROW if the instance repo wasn't already cloned. These generate + run the scaffold
@@ -831,13 +1003,22 @@ module.exports = {
   buildCorePinRefreshCommit,
   dbCreateCmd,
   dbName,
+  dbRoleCmd,
+  dbRoleCmdShown,
+  dbRoleGrantsCmd,
   deployKeyPath,
   deployKeyTitle,
+  ensureInstanceUserCmd,
   ensurePrivateRepoAccess,
+  generateDbPassword,
+  grantInstanceRepoReadCmd,
   installedCorePackDir,
   installedCoreTarball,
+  instanceDbRole,
   instanceInitSpec,
   instanceRepoRemote,
+  instanceStateDir,
+  instanceUser,
   migrateCmd,
   onboardMode,
   parseTargetRef,

package/scripts/gds/provision-units.js

@@ -11,10 +11,11 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, CORE_PKG_DIR, dbName, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, CORE_PKG_DIR, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
+  const user = instanceUser(inst), stateDir = instanceStateDir(inst);
   const standalone = inst.hosting_shape === 'standalone';
   const workDir = standalone ? standaloneRoot(inst) : REPO_ROOT;
   const execStart = standalone
@@ -28,10 +29,21 @@ Requires=postgresql.service
 
 [Service]
 Type=simple
-User=lars
-Group=lars
+# This instance's OWN unix account, never the shared app user (task 1003369, audit B3).
+# Co-tenant is the default shape, so a shared User= let every instance read every
+# sibling's /proc/<pid>/environ — GITHUB_APP_PRIVATE_KEY, the hub client secret, every
+# OAuth cred in the EnvironmentFile below. A distinct uid is what closes that: /proc
+# environ is readable only by the process's own uid.
+User=${user}
+Group=${user}
 WorkingDirectory=${workDir}
+# Read by PID 1 as root BEFORE the privilege drop, so 0600 root-owned stays correct —
+# the instance account itself never needs read on its own secrets file.
 EnvironmentFile=${envFile}
+# HOME is the state dir, NOT /home: the server writes inside its config home on first
+# boot (secret-box.js provisions builder-secret.key there) and ProtectHome below makes
+# /home read-only. Without this the instance comes up unable to hold a secret.
+Environment=HOME=${stateDir}
 Environment=PGDATABASE=${dbName(inst)}
 Environment=PORT=${inst.port}
 ExecStart=${execStart}
@@ -40,6 +52,15 @@ RestartSec=3
 StandardOutput=journal
 StandardError=journal
 NoNewPrivileges=true
+# The same hardening the sibling backup unit already carries. ReadWritePaths is the
+# whole allow-list under ProtectSystem=strict: the state dir, plus the instance's own
+# config/ (the modules toggle writes config/modules.json at runtime). The checkout the
+# service RUNS is deliberately not writable by it. The leading dash on config/ keeps a
+# shape that has none from failing to mount rather than failing to start.
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=true
+ReadWritePaths=${stateDir} -${workDir}/config
 
 [Install]
 WantedBy=multi-user.target
@@ -168,7 +189,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null, dbPassword = null } = {}) {
   const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -239,13 +260,20 @@ GITHUB_APP_ID=${appId}
 GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
 `
     : '';
+  // The per-instance DB credential (task 1003369, audit B3). Present only once the
+  // runner has created the role — a first dry-run and any legacy caller omit it, and the
+  // instance then falls back to the peer auth it used before, so this can never brick a
+  // box mid-migration. src/bongos/pool.js reads both names explicitly.
+  const dbLines = dbPassword
+    ? `PGUSER=${instanceDbRole(inst)}\nPGPASSWORD=${dbPassword}\n`
+    : '';
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
-${fedLines}${settingsEnvLines(inst, prefix)}`;
+${dbLines}${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
 function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
   return path.posix.join(etcBase, inst.slug, 'web.env');

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
@@ -232,6 +232,9 @@ async function provisionInstance(inst, deps) {
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl escalation prefix (task 2066)
+  // One fresh per-instance DB password per run (task 1003369, see provision-repo.js): step
+  // 2b sets it on the role, step 3 writes it to web.env, so the two cannot disagree.
+  const dbPassword = generateDbPassword();
   log(`provision ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
   // Idempotency: an already-active instance is a no-op success (re-drained intent).
@@ -374,6 +377,15 @@ async function provisionInstance(inst, deps) {
     else log('  [code] would refresh the committed @bongos/core pin if it trails the running core (task 1003050)');
     boxExec(standaloneInstallCmd(), { cwd: root });
   }
+  // ── step 1c: the instance's OWN unix account (task 1003369, audit B3) ─────
+  // Idempotent; the group-add is what lets a fresh system account READ the checkout it runs
+  // from — without it the unit fails at exec with EACCES. Rationale: provision-repo.js.
+  if (local) {
+    log(`  [user] ensure unix account ${instanceUser(inst)} + its state dir`);
+    boxExec(ensureInstanceUserCmd(inst, { privileged }));
+    boxExec(grantInstanceRepoReadCmd(inst, { privileged }));
+  } else { log('    (instance unix account created via cloud-init on the droplet)'); }
+
   log('  [db] create + GDS-only migrate');
   if (local) {
     boxExec(dbCreateCmd(inst, { privileged }), { allowFail: true });   // "already exists" is fine
@@ -395,9 +407,21 @@ async function provisionInstance(inst, deps) {
     }
   } else { log('    (db create + migrate + first-version seed run via cloud-init on the droplet)'); }
 
+  // ── step 2b: the instance's OWN password-authed PG role (task 1003369, audit B3) ──
+  // AFTER the migrate: it runs as `postgres`, which therefore OWNS the tables it creates.
+  if (local) {
+    log('  [db] create/rotate the per-instance role + revoke PUBLIC connect');
+    // `shown` is MANDATORY: dbRoleCmd embeds the password, and run() logs the raw command
+    // on BOTH the dry-run and success paths — the exact leak this task exists to prevent
+    // (makeWriteFile passes `shown` for the web.env body for the same reason, and a `shown`
+    // call site also suppresses stderr). The GRANTS carry no secret and log in full.
+    boxExec(dbRoleCmd(inst, { password: dbPassword, privileged }), { shown: dbRoleCmdShown(inst) });
+    boxExec(dbRoleGrantsCmd(inst, { privileged }));
+  } else { log('    (per-instance DB role created via cloud-init on the droplet)'); }
+
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db), dbPassword }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -570,6 +594,10 @@ function dedicatedUserData(inst) {
   // enable the timer alongside the web unit. Mirrors provisionInstance's step 4b.
   const svcB64 = Buffer.from(backupService(i), 'utf8').toString('base64');
   const timerB64 = Buffer.from(backupTimer(i), 'utf8').toString('base64');
+  // task 1003369: the same role the local leg creates at step 2b, same position around the
+  // migrate, but PASSWORD-LESS (peerOnly) — DO retains user-data and serves it back, and a
+  // dedicated droplet is single-tenant. Whole argument on dbRoleCmd.
+  const roleLines = `  - [ bash, -lc, "${dbRoleCmd(i, { peerOnly: true })}" ]\n  - [ bash, -lc, "${dbRoleGrantsCmd(i)}" ]\n`;
   return `#cloud-config
 write_files:
   - path: ${backupServicePath(i)}
@@ -581,10 +609,12 @@ write_files:
     permissions: '0644'
     content: ${timerB64}
 runcmd:
+  - [ bash, -lc, "${ensureInstanceUserCmd(i)}" ]
+  - [ bash, -lc, "${grantInstanceRepoReadCmd(i)}" ]
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
   - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
+${roleLines}  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
   - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
 `;
 }
@@ -1441,6 +1471,8 @@ module.exports = {
   CONFIG, MAX_INTENT_ATTEMPTS, provisionerBotEmail,
   // pure step generators (tested directly)
   dbName, dbCreateCmd, migrateCmd, seedFirstVersionCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
+  // per-instance unix account + password-authed PG role (task 1003369, audit B3)
+  instanceUser, instanceStateDir, instanceDbRole, generateDbPassword, ensureInstanceUserCmd, grantInstanceRepoReadCmd, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd,
   backupUnitName, backupServicePath, backupTimerPath, backupScriptPath, backupService, backupTimer,
   standaloneRoot, standalonePullCmd, standaloneInstallCmd, standaloneMigrateCmd,
   // standalone scaffold (ADR 0108 / 0125, task 2055; consumer-core fix task 1002275)

package/src/bongos/pool.js

@@ -45,6 +45,20 @@ if (process.env.DATABASE_URL) {
     // Peer auth via the local Unix socket on the droplet; PG* env overrides for other environments.
     host: process.env.PGHOST || '/var/run/postgresql',
     database: process.env.PGDATABASE || instanceDbName(),
+    // The per-instance DB credential (task 1003369, audit B3). A provisioned instance's
+    // web.env carries PGUSER/PGPASSWORD naming a role that owns its OWN database and
+    // has CONNECT on no other — so a co-tenant box no longer lets one instance open a
+    // pool against a sibling's data, or against the control plane's own builders and
+    // builder_sessions, simply by running as the same unix user.
+    //
+    // Named EXPLICITLY rather than left to pg's env defaults, which would resolve the
+    // same two vars invisibly. The whole defect this closes was a connection whose
+    // identity nothing in the code stated, so the identity is stated here, and a test
+    // can assert it. Absent (self-host, dev, an instance provisioned before this landed)
+    // the keys are omitted entirely and pg falls back to exactly the peer auth it used
+    // before — this cannot brick a box whose role has not been created yet.
+    ...(process.env.PGUSER ? { user: process.env.PGUSER } : {}),
+    ...(process.env.PGPASSWORD ? { password: process.env.PGPASSWORD } : {}),
   });
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.709'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.710'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -2446,5 +2446,232 @@ await ta('teardownInstance(standalone): no registered key / no token → teardow
   assert.ok(b.cmds.some((c) => /rm -f \S+\/\.git\/cloudbongos-deploy-key \S+\.pub/.test(c)), 'local key halves removed even with no credential');
 });
 
+
+console.log('\nper-instance unix account + password-authed PG role (task 1003369, audit B3):');
+
+t('instanceUser: prefixed, never the bare slug — a project called `postgres` cannot claim that account', () => {
+  assert.equal(P.instanceUser(coTenant), 'bongos-mercury');
+  assert.equal(P.instanceUser({ slug: 'postgres' }), 'bongos-postgres');
+  assert.notEqual(P.instanceUser({ slug: 'lars' }), 'lars');
+});
+
+t('instanceUser: a 40-char slug folds to a LEGAL account name — <=32 chars, no trailing/double dash', () => {
+  const slug = 'a'.repeat(39) + 'b';                       // the isValidSlug maximum
+  const u = P.instanceUser({ slug });
+  assert.ok(u.length <= 32, `account name must fit utmp's 32 chars, got ${u.length} (${u})`);
+  assert.match(u, /^[a-z][a-z0-9-]*[a-z0-9]$/, 'must satisfy useradd NAME_REGEX');
+  assert.ok(!u.includes('--'), 'no double dash');
+});
+
+t('instanceUser: two slugs sharing a long prefix get DIFFERENT accounts — a fold collision would hand each the other\'s identity', () => {
+  const a = 'production-instance-alpha-one';               // 29 chars, identical for 26 of them
+  const b = 'production-instance-alpha-two';
+  assert.notEqual(P.instanceUser({ slug: a }), P.instanceUser({ slug: b }));
+});
+
+t('instanceUser: an invalid slug THROWS rather than deriving an account name from it', () => {
+  assert.throws(() => P.instanceUser({ slug: '../../etc/passwd' }), /invalid slug/);
+  assert.throws(() => P.instanceUser({ slug: 'Has Spaces' }), /invalid slug/);
+  assert.throws(() => P.instanceUser({ slug: '' }), /invalid slug/);
+});
+
+t('instanceStateDir is NOT under /home — ProtectHome=read-only would make the first-boot secret write EROFS', () => {
+  const dir = P.instanceStateDir(coTenant);
+  assert.equal(dir, '/var/lib/bongos-mercury');
+  assert.ok(!dir.startsWith('/home'), 'the writable state dir must survive ProtectHome=read-only');
+});
+
+t('generateDbPassword: base64url only, so it needs no escaping in the env file, the SQL literal or a URL', () => {
+  for (let i = 0; i < 20; i++) {
+    const pw = P.generateDbPassword();
+    assert.match(pw, /^[A-Za-z0-9_-]+$/, `not base64url: ${pw}`);
+    assert.ok(pw.length >= 40, `too short to be 32 bytes: ${pw.length}`);
+  }
+  assert.notEqual(P.generateDbPassword(), P.generateDbPassword(), 'must not be deterministic');
+});
+
+t('ensureInstanceUserCmd: idempotent SYSTEM account, nologin, state dir re-asserted every run', () => {
+  const c = P.ensureInstanceUserCmd(coTenant, { privileged: true });
+  assert.match(c, /id -u bongos-mercury >\/dev\/null 2>&1 \|\|/, 'an existing account short-circuits');
+  assert.match(c, /useradd --system/, 'a system account, not a login user');
+  assert.match(c, /--shell \/usr\/sbin\/nologin/, 'nothing should ever log in as an instance');
+  assert.match(c, /install -d -o bongos-mercury -g bongos-mercury -m 0700 \/var\/lib\/bongos-mercury/);
+  assert.ok(!P.ensureInstanceUserCmd(coTenant).includes('sudo '), 'unprivileged renders without sudo');
+});
+
+t('grantInstanceRepoReadCmd: adds the instance account to the app-user group so the unit can exec its WorkingDirectory', () => {
+  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG lars bongos-mercury');
+});
+
+t('dbRoleCmd: LOGIN + password, upserted — CREATE on a fresh box, ALTER on a re-provision (the rotation path)', () => {
+  const c = P.dbRoleCmd(coTenant, { password: 'pw_ABC-123', privileged: true });
+  assert.match(c, /sudo -u postgres psql -v ON_ERROR_STOP=1 -d postgres/, 'role DDL runs on `postgres`, not the instance DB');
+  assert.match(c, /SELECT 1 FROM pg_roles WHERE rolname = \$r\$bongos-mercury\$r\$/);
+  assert.match(c, /CREATE ROLE %I WITH LOGIN PASSWORD %L/);
+  assert.match(c, /ALTER ROLE %I WITH LOGIN PASSWORD %L/);
+  assert.ok(c.includes('$p$pw_ABC-123$p$'), 'the password rides a dollar-quoted literal');
+});
+
+t('dbRoleCmd: the role is NOT a superuser and gets no CREATEDB/CREATEROLE — a compromised instance reaches its own data and no further', () => {
+  const c = P.dbRoleCmd(coTenant, { password: P.generateDbPassword(), privileged: true });
+  assert.ok(!/SUPERUSER/i.test(c), 'never a superuser');
+  assert.ok(!/CREATEDB/i.test(c), 'no CREATEDB');
+  assert.ok(!/CREATEROLE/i.test(c), 'no CREATEROLE');
+  assert.ok(!/BYPASSRLS/i.test(c), 'no BYPASSRLS');
+});
+
+t('dbRoleCmd: REVOKEs CONNECT from PUBLIC — the half that isolates, since PG grants it to PUBLIC by default', () => {
+  const c = P.dbRoleCmd(coTenant, { password: 'pw', privileged: true });
+  assert.match(c, /REVOKE CONNECT ON DATABASE %I FROM PUBLIC/, 'without this a sibling peer-auths straight in');
+  assert.match(c, /ALTER DATABASE %I OWNER TO %I/, 'the role owns its own DB');
+});
+
+t('dbRoleCmd: refuses a password that is not base64url — no caller can smuggle a quote into the SQL', () => {
+  assert.throws(() => P.dbRoleCmd(coTenant, { password: "x'; DROP DATABASE mercury; --" }), /base64url/);
+  assert.throws(() => P.dbRoleCmd(coTenant, { password: '' }), /base64url/);
+  assert.throws(() => P.dbRoleCmd(coTenant, {}), /base64url/);
+});
+
+t('dbRoleGrantsCmd: runs on the INSTANCE db and grants forward too — the migrate runs as postgres, so it owns the tables', () => {
+  const c = P.dbRoleGrantsCmd(coTenant, { privileged: true });
+  assert.match(c, /-d mercury/, 'schema grants are per-database');
+  assert.match(c, /GRANT ALL ON ALL TABLES IN SCHEMA public TO %I/, 'the tables the migrate already created');
+  assert.match(c, /ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO %I/, 'and the ones the NEXT migrate will');
+  assert.match(c, /GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO %I/);
+});
+
+t('BOTH role commands render with NO double quote — they have to survive a YAML double-quoted cloud-init scalar', () => {
+  const dq = String.fromCharCode(34);
+  for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant)]) {
+    assert.ok(!c.includes(dq), `a double-quoted identifier silently truncates the cloud-init line: ${c}`);
+  }
+});
+
+t('serviceUnit: runs as the instance\'s OWN account, never the shared app user (the /proc/<pid>/environ vector)', () => {
+  const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  assert.match(u, /^User=bongos-mercury$/m);
+  assert.match(u, /^Group=bongos-mercury$/m);
+  assert.ok(!/^User=lars$/m.test(u), 'a shared User= is the defect this closes');
+  assert.ok(!/^Group=lars$/m.test(u));
+});
+
+t('serviceUnit: two instances on one box get two DIFFERENT accounts — co-tenant is the default shape', () => {
+  const a = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  const b = P.serviceUnit({ ...coTenant, slug: 'venus', db_name: 'venus' }, { etcBase: '/etc' });
+  assert.match(a, /^User=bongos-mercury$/m);
+  assert.match(b, /^User=bongos-venus$/m);
+});
+
+t('serviceUnit: carries the hardening block, with HOME + ReadWritePaths pointing at the state dir', () => {
+  const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  assert.match(u, /^ProtectSystem=strict$/m);
+  assert.match(u, /^ProtectHome=read-only$/m);
+  assert.match(u, /^PrivateTmp=true$/m);
+  assert.match(u, /^NoNewPrivileges=true$/m);
+  assert.match(u, /^Environment=HOME=\/var\/lib\/bongos-mercury$/m, 'the config-home write must not land under the read-only /home');
+  assert.match(u, /^ReadWritePaths=\/var\/lib\/bongos-mercury /m, 'the state dir is writable');
+});
+
+t('serviceUnit: ReadWritePaths does NOT make the checkout the service runs writable by it', () => {
+  const inst = { ...coTenant, hosting_shape: 'standalone' };
+  const u = P.serviceUnit(inst, { etcBase: '/etc' });
+  const root = P.standaloneRoot(inst);
+  const rw = u.split('\n').find((l) => l.startsWith('ReadWritePaths='));
+  assert.ok(rw.includes(`-${root}/config`), 'only config/, and optional so a shape without one still mounts');
+  assert.ok(!rw.split(' ').includes(root), 'the code the service runs stays read-only to it');
+});
+
+t('webEnvBody: carries PGUSER + PGPASSWORD for the instance role when the runner minted one', () => {
+  const b = P.webEnvBody(coTenant, { dbPassword: 'pw_ABC-123' });
+  assert.match(b, /^PGUSER=bongos-mercury$/m);
+  assert.match(b, /^PGPASSWORD=pw_ABC-123$/m);
+  assert.match(b, /^PGDATABASE=mercury$/m);
+});
+
+t('webEnvBody: NO password ⇒ no PG credential lines — an instance provisioned before this keeps its peer auth', () => {
+  const b = P.webEnvBody(coTenant);
+  assert.doesNotMatch(b, /^PGUSER=/m);
+  assert.doesNotMatch(b, /^PGPASSWORD=/m);
+  assert.match(b, /^PGDATABASE=mercury$/m, 'the DB name is unchanged either way');
+});
+
+t('dedicatedUserData: the droplet runs the SAME account + role steps, in the same order around the migrate', () => {
+  const ud = P.dedicatedUserData(coTenant);
+  const at = (needle) => ud.indexOf(needle);
+  assert.ok(at('useradd --system') > -1, 'the droplet creates the account too');
+  assert.ok(at('usermod -aG lars') > -1);
+  assert.ok(at('useradd --system') < at('createdb mercury'), 'account before the DB');
+  assert.ok(at('migrate.sh') < at('CREATE ROLE %I'), 'the role grants must follow the migrate that created the tables');
+  assert.ok(at('CREATE ROLE %I') < at('GRANT ALL ON ALL TABLES'), 'role before its grants');
+});
+
+t('dedicatedUserData: NEVER bakes a password into cloud-init — DO retains user-data and serves it back', () => {
+  const ud = P.dedicatedUserData(coTenant);
+  // The dollar-quoted password literal dbRoleCmd uses. Its absence is the assertion.
+  assert.ok(!ud.includes('$p$'), 'a credential in user-data is a permanent copy we cannot lock down');
+  assert.match(ud, /CREATE ROLE %I WITH LOGIN\$f\$/, 'the role is still created, password-less (single-tenant droplet)');
+  assert.match(ud, /REVOKE CONNECT ON DATABASE %I FROM PUBLIC/, 'and PUBLIC still loses CONNECT');
+});
+
+t('dbRoleCmd(peerOnly): omits the PASSWORD clause entirely, and REFUSES a password', () => {
+  const c = P.dbRoleCmd(coTenant, { peerOnly: true });
+  assert.ok(!/PASSWORD/.test(c), 'no PASSWORD clause at all — not an empty one');
+  assert.match(c, /CREATE ROLE %I WITH LOGIN\$f\$/);
+  assert.match(c, /ALTER DATABASE %I OWNER TO %I/, 'ownership and the revoke are unchanged');
+  assert.throws(() => P.dbRoleCmd(coTenant, { peerOnly: true, password: 'pw_ABC' }), /peerOnly takes no password/);
+});
+
+t('dbRoleCmdShown: the label the runner logs names every effect and carries NO password', () => {
+  const pw = P.generateDbPassword();
+  const real = P.dbRoleCmd(coTenant, { password: pw });
+  const shown = P.dbRoleCmdShown(coTenant);
+  assert.ok(real.includes(pw), 'precondition: the real command does embed the secret');
+  assert.ok(!shown.includes(pw), 'the logged label must not');
+  assert.ok(!shown.includes('$p$'), 'nor the dollar-quoted literal around it');
+  for (const effect of ['bongos-mercury', 'mercury', 'revoke PUBLIC connect']) {
+    assert.ok(shown.includes(effect), `the label must still name: ${effect}`);
+  }
+});
+
+
+await ta('provisionInstance: EVERY secret-bearing command opts into `shown`, so no password reaches the runner log', async () => {
+  // The generator tests prove the label is clean; this proves the CALL SITE uses it.
+  // Stated as an invariant rather than one assertion about one line: any future command
+  // that embeds a dollar-quoted secret is caught by the same test, which is the failure
+  // mode worth pinning — the leak was not a typo, it was a call site that never opted in.
+  const { deps } = recorder();
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+
+  const secretBearing = seen.filter((c) => c.cmd.includes('$p$'));
+  assert.ok(secretBearing.length >= 1, 'precondition: the run really does issue a password-bearing command');
+  for (const { cmd, opts } of secretBearing) {
+    assert.ok(opts.shown, `a command embedding a secret must pass \`shown\`: ${cmd.slice(0, 60)}…`);
+    assert.ok(!opts.shown.includes('$p$'), 'the label must not carry the dollar-quoted secret');
+    // The password itself, pulled back out of the real command, must not be in the label.
+    const pw = (cmd.match(/\$p\$([^$]+)\$p\$/) || [])[1];
+    assert.ok(pw && pw.length > 20, 'precondition: recovered the generated password from the command');
+    assert.ok(!opts.shown.includes(pw), 'the label must not carry the password');
+  }
+});
+
+await ta('provisionInstance: the password IS written to web.env, which makeWriteFile logs by path not body', async () => {
+  const { deps } = recorder();
+  const bodies = [];
+  deps.writeFile = (path, body, opts) => { bodies.push({ path, body, opts }); return { ok: true }; };
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+
+  const env = bodies.find((b) => /web\.env$/.test(b.path));
+  assert.ok(env, 'wrote a web.env');
+  assert.equal(env.opts && env.opts.mode, 0o600, 'web.env stays chmod 600');
+  const pw = (seen.map((c) => c.cmd).join('\n').match(/\$p\$([^$]+)\$p\$/) || [])[1];
+  assert.ok(pw, 'recovered the run\'s generated password');
+  assert.ok(env.body.includes(`PGPASSWORD=${pw}`), 'the SAME password the role was set to reaches web.env — one mint per run');
+  assert.ok(env.body.includes('PGUSER=bongos-mercury'));
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);