@bongos/core 1.19.709 → 1.19.711

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.709",
+  "version": "1.19.711",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.709",
+      "version": "1.19.711",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.709",
+  "version": "1.19.711",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agent-invoke.js

@@ -446,33 +446,11 @@ function parseArgv(argv = []) {
   return { name, question, outArg, asJson, error: null };
 }
 
-/**
- * The gate. Decides whether this definition may be invoked on demand, and gives
- * the reason in the same breath — rule 2 needs the reason as much as the verdict,
- * because the reason is the whole content of the ledger row a refusal writes.
- *
- * PURE: takes the registry row, returns `{ decision, reason }`.
- */
-function gateFor(row) {
-  if (!row) return { decision: 'no-go', reason: 'no such agent in the registry' };
-  if (row.trigger_type !== 'on-demand') {
-    return {
-      decision: 'no-go',
-      reason: `trigger_type is '${row.trigger_type}', not 'on-demand' — this agent is dispatched by an event, not asked a question`,
-    };
-  }
-  // Checked before `enabled` even though the schema's flagged_not_armed CHECK
-  // makes a flagged row necessarily disabled: the two states have the same
-  // verdict and completely different fixes, and the reason is what the caller
-  // acts on.
-  if (isNonEmptyString(row.scope_violation)) {
-    return { decision: 'no-go', reason: `disarmed by the scope wall: ${row.scope_violation}` };
-  }
-  if (row.enabled !== true) {
-    return { decision: 'no-go', reason: 'the definition is present in the registry but not enabled' };
-  }
-  return { decision: 'go', reason: null };
-}
+// THE GATE lives in the module, not here: the same question is asked by
+// POST /agents/:name/invoke on the other side of the trust boundary, and a gate
+// with two implementations has two behaviours the day one is edited. Required
+// directly from a script the way agents-sync requires the validator.
+const { gateFor } = require('../../modules/agents/lib/gate.js');
 
 // ---- the chain -------------------------------------------------------------
 

package/scripts/gds/provision-repo.js

@@ -10,6 +10,7 @@
 
 'use strict';
 
+const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -111,6 +112,177 @@ function standaloneMigrateCmd(inst, { privileged = false } = {}) {
 // transfer from primea"): its bespoke pull-deploy regenerated nothing.
 function standaloneRegenDocsCmd() { return `node ${CORE_PKG_DIR}/scripts/gds/regen-instance-docs.js`; }
 
+// ── Per-instance identity: its OWN unix account + its OWN password-authed PG role ──
+// (task 1003369, audit ref B3 of the 2026-08-29 security audit.)
+//
+// THE HOLE THIS CLOSES. Every instance service used to run `User=lars/Group=lars`, and
+// co-tenant is the DEFAULT shape — so on a shared box every instance ran as the SAME
+// unix user. A unix user may read /proc/<pid>/environ of its own processes, which means
+// any instance could read every SIBLING's environment: GITHUB_APP_PRIVATE_KEY, the
+// <PREFIX>_HUB_CLIENT_SECRET, every OAuth secret web.env carries. The DB half was the
+// same shape one layer down: pool.js connected by PASSWORDLESS peer auth, so any code
+// running as lars could open a pool against any sibling database — including the control
+// plane's own `builders` and `builder_sessions`. Neither was a bug in a route; it was the
+// identity every instance shared. Giving each instance its own unix account and its own
+// password-authed role is what makes the boundary real.
+//
+// NAME SHAPE. A unix account name is capped at 32 chars (utmp) and must match
+// [a-z_][a-z0-9_-]*; a slug is 2–40 of [a-z0-9-] (isValidSlug). So the name cannot be
+// the slug verbatim, and it must not be the BARE slug either — that would let a project
+// named `postgres` or `lars` claim an existing account. Prefixed + length-folded:
+//   short slug → bongos-<slug>
+//   long slug  → bongos-<slug truncated>-<8 hex of sha256(slug)>   (still <= 32)
+// The hash suffix keeps two slugs that share a 16-char prefix from folding onto one
+// account — which would hand each the other's identity, the very thing being fixed.
+const INSTANCE_USER_PREFIX = 'bongos-';
+const INSTANCE_USER_MAX = 32;              // utmp's cap; useradd enforces it
+
+// The unix account an instance's service (and only that instance's service) runs as.
+// Deterministic — the runner derives it fresh every run rather than storing it, so a
+// re-provision can never address a different account than the one it created. PURE.
+function instanceUser(inst) {
+  const slug = String((inst && inst.slug) || '');
+  if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(slug)) {
+    throw new Error(`instanceUser: refusing to derive an account name from an invalid slug ${JSON.stringify(slug)}`);
+  }
+  const whole = INSTANCE_USER_PREFIX + slug;
+  if (whole.length <= INSTANCE_USER_MAX) return whole;
+  const digest = crypto.createHash('sha256').update(slug).digest('hex').slice(0, 8);
+  // Budget: prefix + head + '-' + 8 hex === INSTANCE_USER_MAX. Trailing dashes are
+  // stripped so the fold can never emit `--` (which useradd's NAME_REGEX rejects).
+  const head = slug.slice(0, INSTANCE_USER_MAX - INSTANCE_USER_PREFIX.length - 9).replace(/-+$/, '');
+  return `${INSTANCE_USER_PREFIX}${head}-${digest}`;
+}
+
+// The instance account's HOME — and the ONE directory the hardened unit leaves
+// writable. It is deliberately NOT under /home: the unit sets ProtectHome=read-only
+// (so one instance cannot read the operator's or a sibling's home), and the server DOES
+// write inside its config home at runtime — src/bongos/secret-box.js provisions
+// builder-secret.key under ~/.config/<configDir> on first boot. A /home account would
+// make that write EROFS and the instance would come up unable to hold a secret. PURE.
+function instanceStateDir(inst) { return path.posix.join('/var/lib', instanceUser(inst)); }
+
+// The instance's OWN Postgres login role. Same name as the unix account so an operator
+// reading `ps` and `pg_stat_activity` sees one identity, not two — a dash is legal in a
+// quoted PG identifier, and every SQL site below quotes it. PURE.
+function instanceDbRole(inst) { return instanceUser(inst); }
+
+// A fresh password for that role. base64url ([A-Za-z0-9_-]) on purpose: it needs no
+// escaping in the env file that carries it, in the dollar-quoted SQL literal that sets
+// it, or in a connection URL — the three places it travels. 32 bytes ~ 256 bits.
+// Generated per provision run, not stored: every run ALTERs the role and rewrites
+// web.env in the same pass, so the credential rotates on its own.
+function generateDbPassword() { return crypto.randomBytes(32).toString('base64url'); }
+
+// Create the instance's unix account if it is not already there, with its state dir.
+// IDEMPOTENT by construction — `id -u` short-circuits an existing account, and the
+// `install -d` re-asserts ownership and mode on every run, so a re-provision repairs a
+// hand-edited box instead of failing on it. A SYSTEM account with /usr/sbin/nologin:
+// nothing should ever log in as an instance.
+function ensureInstanceUserCmd(inst, { privileged = false } = {}) {
+  const user = instanceUser(inst), dir = instanceStateDir(inst), sudo = privileged ? 'sudo ' : '';
+  return `id -u ${user} >/dev/null 2>&1 || ${sudo}useradd --system --shell /usr/sbin/nologin --home-dir ${dir} ${user}; ` +
+         `${sudo}install -d -o ${user} -g ${user} -m 0700 ${dir}`;
+}
+
+// Let the instance account READ the checkout it runs from. The co-tenant shape's
+// WorkingDirectory is this control-plane checkout and the standalone shape's is
+// /srv/<base>/<slug>; both are owned by the app user, and a fresh system account is in
+// neither the owner nor the group, so without this the unit fails at exec with EACCES.
+// Group membership grants exactly the read the app user's group already has — it does
+// NOT re-open the two vectors this task closes: /proc/<pid>/environ stays readable only
+// by the process's own uid, and the DB now demands a password no sibling holds.
+function grantInstanceRepoReadCmd(inst, { privileged = false } = {}) {
+  return `${privileged ? 'sudo ' : ''}usermod -aG ${APP_USER} ${instanceUser(inst)}`;
+}
+
+// Create-or-rotate the instance's PG login role and hand it its OWN database — and
+// nothing else. Three statements, one psql, ON_ERROR_STOP:
+//   1. CREATE ROLE ... LOGIN PASSWORD, or ALTER ... PASSWORD when it already exists (the
+//      re-provision path — this is what rotates the credential).
+//   2. ALTER DATABASE ... OWNER TO — the role owns its own DB, so the app's DDL needs no
+//      superuser, and in PG15+ it inherits the public schema through pg_database_owner.
+//   3. REVOKE CONNECT ... FROM PUBLIC — the half that actually isolates. Postgres grants
+//      CONNECT on every database to PUBLIC by default, so per-role passwords ALONE would
+//      still leave a sibling one peer-auth hop from any other instance's data.
+// NOT a superuser and NOT CREATEDB/CREATEROLE: an instance that is compromised gets its
+// own data and no path to anyone else's.
+//
+// Runs against `postgres`, not the instance DB: ALTER DATABASE ... OWNER cannot run from
+// inside the database it renames the owner of.
+//
+// QUOTING, which is load-bearing in a way that is easy to undo by accident. Every literal
+// is DOLLAR-QUOTED and every identifier goes through format(%I), so the rendered command
+// contains no single quote and NO DOUBLE QUOTE. It has to survive three executors
+// unchanged — inline /bin/sh, `bash -s` over SSH, and, the strict one, `- [ bash, -lc,
+// "..." ]` inside the dedicated droplet's cloud-init, which is a YAML DOUBLE-QUOTED
+// scalar. A plain "role" identifier reads fine in psql and silently truncates the YAML.
+// seedFirstVersionCmd dollar-quotes for the same reason; a test asserts the absence.
+// `peerOnly` is the DEDICATED shape's mode, and it exists because of where that
+// command TRAVELS (task 1003369). A dedicated droplet's steps ride DigitalOcean
+// cloud-init user-data, which DO RETAINS and serves back through its API, its console
+// and the droplet's own metadata endpoint — so a password embedded there is a second,
+// permanent copy of the credential in a place this task cannot lock down, which is
+// strictly worse than what it protects against. A dedicated droplet is SINGLE-TENANT:
+// there are no siblings on it, so the co-tenancy vector B3 describes does not exist,
+// and the role can peer-auth to its own unix account. The role, its DB ownership and
+// the PUBLIC revoke are still created — only the password is omitted, deliberately.
+function dbRoleCmd(inst, { password = null, peerOnly = false, privileged = false } = {}) {
+  const role = instanceDbRole(inst), db = dbName(inst);
+  if (peerOnly) {
+    if (password) throw new Error('dbRoleCmd: peerOnly takes no password — it exists to keep one out of cloud-init user-data');
+  } else if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
+    throw new Error('dbRoleCmd: password must be a non-empty base64url string (generateDbPassword)');
+  }
+  // Two shapes of the same upsert. peerOnly omits the PASSWORD clause entirely rather
+  // than passing an empty one — `WITH LOGIN` leaves any existing password untouched.
+  const login = peerOnly
+    ? { clause: 'WITH LOGIN', args: '' }
+    : { clause: 'WITH LOGIN PASSWORD %L', args: `, $p$${password}$p$` };
+  const sql =
+    `DO $do$ BEGIN ` +
+    `IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $r$${role}$r$) THEN ` +
+    `EXECUTE format($f$ALTER ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `ELSE ` +
+    `EXECUTE format($f$CREATE ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `END IF; ` +
+    `EXECUTE format($f$ALTER DATABASE %I OWNER TO %I$f$, $d$${db}$d$, $r$${role}$r$); ` +
+    `EXECUTE format($f$REVOKE CONNECT ON DATABASE %I FROM PUBLIC$f$, $d$${db}$d$); ` +
+    `END $do$;`;
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d postgres -c '${sql}'`, privileged);
+}
+
+// What the runner LOGS in place of dbRoleCmd, whose SQL embeds the password. Lives here,
+// beside the command, so the two cannot drift: a `shown` that outlived the secret it hides
+// would be a silent re-leak. Names every effect the real command has. PURE.
+function dbRoleCmdShown(inst) {
+  return `psql -d postgres -c '<upsert role ${instanceDbRole(inst)} + own ${dbName(inst)} + revoke PUBLIC connect>' (password redacted)`;
+}
+
+// Hand the instance role the objects the migrate just created. This is NOT belt-and-braces:
+// the privileged migrate runs as `postgres`, so every table and sequence it creates is
+// OWNED BY postgres. Owning the DATABASE does not carry ownership of objects inside it, so
+// without these grants the instance would authenticate perfectly and then fail its first
+// SELECT. The ALTER DEFAULT PRIVILEGES pair is the same statement aimed forward: it applies
+// to objects the CURRENT role creates later, which is exactly what the next migrate does —
+// so a schema migration shipped six months from now needs no second visit here.
+//
+// Runs against the instance DB (schema grants are per-database), and AFTER the migrate.
+function dbRoleGrantsCmd(inst, { privileged = false } = {}) {
+  const role = instanceDbRole(inst), db = dbName(inst);
+  // Same quoting rule as dbRoleCmd: format(%I), never a double-quoted identifier.
+  const g = (stmt) => `EXECUTE format($f$${stmt} %I$f$, $r$${role}$r$); `;
+  const sql =
+    `DO $do$ BEGIN ` +
+    g('GRANT ALL ON SCHEMA public TO') +
+    g('GRANT ALL ON ALL TABLES IN SCHEMA public TO') +
+    g('GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO') +
+    g('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO') +
+    g('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO') +
+    `END $do$;`;
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${db} -c '${sql}'`, privileged);
+}
+
 // ── STANDALONE scaffold (ADR 0108 / 0125, task 2055) ──────────────────────────
 // The MISSING first leg of the greenfield "one guided flow": provision.js used to
 // THROW if the instance repo wasn't already cloned. These generate + run the scaffold
@@ -831,13 +1003,22 @@ module.exports = {
   buildCorePinRefreshCommit,
   dbCreateCmd,
   dbName,
+  dbRoleCmd,
+  dbRoleCmdShown,
+  dbRoleGrantsCmd,
   deployKeyPath,
   deployKeyTitle,
+  ensureInstanceUserCmd,
   ensurePrivateRepoAccess,
+  generateDbPassword,
+  grantInstanceRepoReadCmd,
   installedCorePackDir,
   installedCoreTarball,
+  instanceDbRole,
   instanceInitSpec,
   instanceRepoRemote,
+  instanceStateDir,
+  instanceUser,
   migrateCmd,
   onboardMode,
   parseTargetRef,

package/scripts/gds/provision-units.js

@@ -11,10 +11,11 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, CORE_PKG_DIR, dbName, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, CORE_PKG_DIR, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
+  const user = instanceUser(inst), stateDir = instanceStateDir(inst);
   const standalone = inst.hosting_shape === 'standalone';
   const workDir = standalone ? standaloneRoot(inst) : REPO_ROOT;
   const execStart = standalone
@@ -28,10 +29,21 @@ Requires=postgresql.service
 
 [Service]
 Type=simple
-User=lars
-Group=lars
+# This instance's OWN unix account, never the shared app user (task 1003369, audit B3).
+# Co-tenant is the default shape, so a shared User= let every instance read every
+# sibling's /proc/<pid>/environ — GITHUB_APP_PRIVATE_KEY, the hub client secret, every
+# OAuth cred in the EnvironmentFile below. A distinct uid is what closes that: /proc
+# environ is readable only by the process's own uid.
+User=${user}
+Group=${user}
 WorkingDirectory=${workDir}
+# Read by PID 1 as root BEFORE the privilege drop, so 0600 root-owned stays correct —
+# the instance account itself never needs read on its own secrets file.
 EnvironmentFile=${envFile}
+# HOME is the state dir, NOT /home: the server writes inside its config home on first
+# boot (secret-box.js provisions builder-secret.key there) and ProtectHome below makes
+# /home read-only. Without this the instance comes up unable to hold a secret.
+Environment=HOME=${stateDir}
 Environment=PGDATABASE=${dbName(inst)}
 Environment=PORT=${inst.port}
 ExecStart=${execStart}
@@ -40,6 +52,15 @@ RestartSec=3
 StandardOutput=journal
 StandardError=journal
 NoNewPrivileges=true
+# The same hardening the sibling backup unit already carries. ReadWritePaths is the
+# whole allow-list under ProtectSystem=strict: the state dir, plus the instance's own
+# config/ (the modules toggle writes config/modules.json at runtime). The checkout the
+# service RUNS is deliberately not writable by it. The leading dash on config/ keeps a
+# shape that has none from failing to mount rather than failing to start.
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=true
+ReadWritePaths=${stateDir} -${workDir}/config
 
 [Install]
 WantedBy=multi-user.target
@@ -168,7 +189,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null, dbPassword = null } = {}) {
   const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -239,13 +260,20 @@ GITHUB_APP_ID=${appId}
 GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
 `
     : '';
+  // The per-instance DB credential (task 1003369, audit B3). Present only once the
+  // runner has created the role — a first dry-run and any legacy caller omit it, and the
+  // instance then falls back to the peer auth it used before, so this can never brick a
+  // box mid-migration. src/bongos/pool.js reads both names explicitly.
+  const dbLines = dbPassword
+    ? `PGUSER=${instanceDbRole(inst)}\nPGPASSWORD=${dbPassword}\n`
+    : '';
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
-${fedLines}${settingsEnvLines(inst, prefix)}`;
+${dbLines}${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
 function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
   return path.posix.join(etcBase, inst.slug, 'web.env');

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
@@ -232,6 +232,9 @@ async function provisionInstance(inst, deps) {
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl escalation prefix (task 2066)
+  // One fresh per-instance DB password per run (task 1003369, see provision-repo.js): step
+  // 2b sets it on the role, step 3 writes it to web.env, so the two cannot disagree.
+  const dbPassword = generateDbPassword();
   log(`provision ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
   // Idempotency: an already-active instance is a no-op success (re-drained intent).
@@ -374,6 +377,15 @@ async function provisionInstance(inst, deps) {
     else log('  [code] would refresh the committed @bongos/core pin if it trails the running core (task 1003050)');
     boxExec(standaloneInstallCmd(), { cwd: root });
   }
+  // ── step 1c: the instance's OWN unix account (task 1003369, audit B3) ─────
+  // Idempotent; the group-add is what lets a fresh system account READ the checkout it runs
+  // from — without it the unit fails at exec with EACCES. Rationale: provision-repo.js.
+  if (local) {
+    log(`  [user] ensure unix account ${instanceUser(inst)} + its state dir`);
+    boxExec(ensureInstanceUserCmd(inst, { privileged }));
+    boxExec(grantInstanceRepoReadCmd(inst, { privileged }));
+  } else { log('    (instance unix account created via cloud-init on the droplet)'); }
+
   log('  [db] create + GDS-only migrate');
   if (local) {
     boxExec(dbCreateCmd(inst, { privileged }), { allowFail: true });   // "already exists" is fine
@@ -395,9 +407,21 @@ async function provisionInstance(inst, deps) {
     }
   } else { log('    (db create + migrate + first-version seed run via cloud-init on the droplet)'); }
 
+  // ── step 2b: the instance's OWN password-authed PG role (task 1003369, audit B3) ──
+  // AFTER the migrate: it runs as `postgres`, which therefore OWNS the tables it creates.
+  if (local) {
+    log('  [db] create/rotate the per-instance role + revoke PUBLIC connect');
+    // `shown` is MANDATORY: dbRoleCmd embeds the password, and run() logs the raw command
+    // on BOTH the dry-run and success paths — the exact leak this task exists to prevent
+    // (makeWriteFile passes `shown` for the web.env body for the same reason, and a `shown`
+    // call site also suppresses stderr). The GRANTS carry no secret and log in full.
+    boxExec(dbRoleCmd(inst, { password: dbPassword, privileged }), { shown: dbRoleCmdShown(inst) });
+    boxExec(dbRoleGrantsCmd(inst, { privileged }));
+  } else { log('    (per-instance DB role created via cloud-init on the droplet)'); }
+
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db), dbPassword }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -570,6 +594,10 @@ function dedicatedUserData(inst) {
   // enable the timer alongside the web unit. Mirrors provisionInstance's step 4b.
   const svcB64 = Buffer.from(backupService(i), 'utf8').toString('base64');
   const timerB64 = Buffer.from(backupTimer(i), 'utf8').toString('base64');
+  // task 1003369: the same role the local leg creates at step 2b, same position around the
+  // migrate, but PASSWORD-LESS (peerOnly) — DO retains user-data and serves it back, and a
+  // dedicated droplet is single-tenant. Whole argument on dbRoleCmd.
+  const roleLines = `  - [ bash, -lc, "${dbRoleCmd(i, { peerOnly: true })}" ]\n  - [ bash, -lc, "${dbRoleGrantsCmd(i)}" ]\n`;
   return `#cloud-config
 write_files:
   - path: ${backupServicePath(i)}
@@ -581,10 +609,12 @@ write_files:
     permissions: '0644'
     content: ${timerB64}
 runcmd:
+  - [ bash, -lc, "${ensureInstanceUserCmd(i)}" ]
+  - [ bash, -lc, "${grantInstanceRepoReadCmd(i)}" ]
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
   - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
+${roleLines}  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
   - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
 `;
 }
@@ -1441,6 +1471,8 @@ module.exports = {
   CONFIG, MAX_INTENT_ATTEMPTS, provisionerBotEmail,
   // pure step generators (tested directly)
   dbName, dbCreateCmd, migrateCmd, seedFirstVersionCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
+  // per-instance unix account + password-authed PG role (task 1003369, audit B3)
+  instanceUser, instanceStateDir, instanceDbRole, generateDbPassword, ensureInstanceUserCmd, grantInstanceRepoReadCmd, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd,
   backupUnitName, backupServicePath, backupTimerPath, backupScriptPath, backupService, backupTimer,
   standaloneRoot, standalonePullCmd, standaloneInstallCmd, standaloneMigrateCmd,
   // standalone scaffold (ADR 0108 / 0125, task 2055; consumer-core fix task 1002275)

package/src/bongos/pool.js

@@ -45,6 +45,20 @@ if (process.env.DATABASE_URL) {
     // Peer auth via the local Unix socket on the droplet; PG* env overrides for other environments.
     host: process.env.PGHOST || '/var/run/postgresql',
     database: process.env.PGDATABASE || instanceDbName(),
+    // The per-instance DB credential (task 1003369, audit B3). A provisioned instance's
+    // web.env carries PGUSER/PGPASSWORD naming a role that owns its OWN database and
+    // has CONNECT on no other — so a co-tenant box no longer lets one instance open a
+    // pool against a sibling's data, or against the control plane's own builders and
+    // builder_sessions, simply by running as the same unix user.
+    //
+    // Named EXPLICITLY rather than left to pg's env defaults, which would resolve the
+    // same two vars invisibly. The whole defect this closes was a connection whose
+    // identity nothing in the code stated, so the identity is stated here, and a test
+    // can assert it. Absent (self-host, dev, an instance provisioned before this landed)
+    // the keys are omitted entirely and pg falls back to exactly the peer auth it used
+    // before — this cannot brick a box whose role has not been created yet.
+    ...(process.env.PGUSER ? { user: process.env.PGUSER } : {}),
+    ...(process.env.PGPASSWORD ? { password: process.env.PGPASSWORD } : {}),
   });
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.709'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.711'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');