@bongos/core 1.19.839 → 1.19.841

package/tests/pr_assign.mjs

@@ -0,0 +1,189 @@
+// tests/pr_assign.mjs — a shipped pull request is assigned to the builder who wrote it
+// (task 1003991).
+//
+// The server opens every builder-box PR with its own credential, so the PR's AUTHOR is
+// the owner account: 259 of the last 300 PRs. The builder who wrote the work found
+// "created by me" empty on GitHub — and the PR is where CI and merge state live. The
+// server now assigns the PR to the task's claim holder and names them in the body.
+//
+// Two layers, no DB / network:
+//   1. modules/lifecycle/pr-assign.js through its injectable fetch — the assignment call
+//      and every fail-soft shape (it must NEVER reject: an assignment is a courtesy).
+//   2. The real POST /tasks/:id/publish-branch router with the data layer, the auth gate
+//      and the git/GitHub calls stubbed at the module boundary — proving the route assigns
+//      the CLAIM HOLDER (not the Archon who re-shipped it), names them in the body, and
+//      still answers 201 when the assignment fails.
+//
+// Run:  node tests/pr_assign.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { prAssigneeLine } from '../scripts/gds/ship-land.js';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+const gp = require('../modules/lifecycle/github-push.js');
+const prAssign = require('../modules/lifecycle/pr-assign.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  return Promise.resolve().then(fn)
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); });
+}
+
+const REPO = { owner: 'someowner', repo: 'somerepo', branch: 'main' };
+const okJson = (body, status = 201) => ({ ok: status < 300, status, json: async () => body, text: async () => JSON.stringify(body) });
+const quiet = { warn() {} };
+
+// ---- layer 1: the assignment call -----------------------------------------
+await t('assignPullRequest POSTs the login to /issues/:number/assignees', async () => {
+  let seen = null;
+  const fetchImpl = async (url, opts) => { seen = { url, method: opts.method, body: JSON.parse(opts.body), auth: opts.headers.Authorization, signal: opts.signal }; return okJson({ assignees: [{ login: 'Some-Builder' }] }); };
+  const out = await prAssign.assignPullRequest({ number: 946, login: 'some-builder' }, { token: 'T', repoInfo: REPO, fetchImpl, logImpl: quiet });
+  assert.deepEqual(out, { assigned: true });
+  assert.equal(seen.url, 'https://api.github.com/repos/someowner/somerepo/issues/946/assignees');
+  assert.equal(seen.method, 'POST');
+  assert.deepEqual(seen.body, { assignees: ['some-builder'] });
+  assert.equal(seen.auth, 'Bearer T');
+  assert.ok(seen.signal instanceof AbortSignal, 'the one optional call before the 201 is time-boxed');
+});
+
+await t('fail-soft: every failure RESOLVES with a reason — it never rejects', async () => {
+  const run = (args, deps) => prAssign.assignPullRequest(args, { token: 'T', repoInfo: REPO, logImpl: quiet, ...deps });
+  const never = async () => { throw new Error('must not fetch'); };
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => okJson({ message: 'Resource not accessible by integration' }, 403) }), { assigned: false, reason: 'http_403' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => { throw new Error('socket hang up'); } }), { assigned: false, reason: 'threw' });
+  // GitHub answers 201 and silently drops a login that cannot be assigned (not a collaborator).
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => okJson({ assignees: [] }) }), { assigned: false, reason: 'not_assignable' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { token: '', fetchImpl: never }), { assigned: false, reason: 'unconfigured' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { repoInfo: { error: 'nope' }, fetchImpl: never }), { assigned: false, reason: 'unconfigured' });
+  assert.deepEqual(await run({ number: 'abc', login: 'x' }, { fetchImpl: never }), { assigned: false, reason: 'bad_pr_number' });
+});
+
+await t('a login that is not a GitHub login is refused before any request, and never reaches a PR body', async () => {
+  const never = async () => { throw new Error('must not fetch'); };
+  for (const login of ['', null, undefined, 'a b', '-lead', 'x/../y', 'a'.repeat(40), 'name\n@everyone', '@already']) {
+    assert.deepEqual(await prAssign.assignPullRequest({ number: 1, login }, { token: 'T', repoInfo: REPO, fetchImpl: never, logImpl: quiet }), { assigned: false, reason: 'bad_login' }, JSON.stringify(login));
+    assert.equal(prAssign.prBuilderLine(login), '', JSON.stringify(login));
+  }
+  assert.equal(prAssign.prBuilderLine('Some-Builder1'), 'Built by @Some-Builder1.');
+  assert.equal(prAssign.prBuilderLine('name_shortcode'), 'Built by @name_shortcode.', 'a managed-user login carries an underscore');
+});
+
+await t('a failure is logged without the credential', async () => {
+  const lines = [];
+  await prAssign.assignPullRequest({ number: 1, login: 'x' }, {
+    token: 'SECRET_TOKEN', repoInfo: REPO, logImpl: { warn: (...a) => lines.push(JSON.stringify(a)) },
+    fetchImpl: async () => { throw new Error('connect https://x-access-token:SECRET_TOKEN@github.com failed'); },
+  });
+  assert.equal(lines.length, 1);
+  assert.ok(!lines[0].includes('SECRET_TOKEN'), lines[0]);
+});
+
+await t('the ship CLI says where the PR is findable, and says nothing when nobody was assigned', () => {
+  assert.match(prAssigneeLine('some-builder'), /assigned to @some-builder .*Assigned to you/);
+  for (const v of [null, undefined, '', 'a b', 'x\n[otb-plain] forged', 'a'.repeat(40)]) assert.equal(prAssigneeLine(v), null, JSON.stringify(v));
+});
+
+// ---- layer 2: the real publish route --------------------------------------
+const HEAD = 'a'.repeat(40);
+let caller = null;         // req.builder
+let holder = null;         // db.getLastClaimHolder
+let assignResult = null;   // what the GitHub assignees call answers
+let opened = null;         // the PR the route asked for
+let assignCalls = [];
+
+api.requireBuilder = (req, res, next) => { req.builder = caller; next(); };
+db.getLastClaimHolder = async () => holder;
+db.setClaimPublishedSha = async () => {};
+gp.isConfigured = () => true;
+gp.pushBundle = async () => ({ head_sha: HEAD });
+gp.openOrFindPullRequest = async (args) => { opened = args; return { number: 77, url: 'https://github.com/o/r/pull/77', node_id: 'N' }; };
+gp.enableAutoMergeDetailed = async () => ({ ok: true });
+gp.setCommitStatus = async () => true;
+prAssign.assignPullRequest = async (args) => { assignCalls.push(args); if (assignResult instanceof Error) throw assignResult; return assignResult; };
+
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) });
+  next();
+});
+app.use(buildTasksRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function publish() {
+  opened = null; assignCalls = [];
+  const res = await fetch(`${base}/tasks/1003848/publish-branch`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ branch: 'task-1003848', head_sha: HEAD, bundle_b64: Buffer.from('bundle').toString('base64'), value_summary: 'A thing got better.' }),
+  });
+  return { status: res.status, body: await res.json() };
+}
+
+await t('the route assigns the PR to the claim holder and names them in the body', async () => {
+  caller = { id: 5, rank: 'thetes', github_login: 'some-builder' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.deepEqual(assignCalls, [{ number: 77, login: 'some-builder' }]);
+  assert.match(opened.body, /Built by @some-builder\./);
+  assert.equal(r.body.pr_assignee, 'some-builder');
+});
+
+await t('an Archon re-shipping someone else\'s task assigns the AUTHOR, not themselves', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201);
+  assert.equal(assignCalls[0].login, 'some-builder');
+  assert.ok(!opened.body.includes('the-archon'));
+});
+
+await t('a failed assignment never fails the ship: still 201, pr_assignee null', async () => {
+  caller = { id: 5, rank: 'thetes', github_login: 'some-builder' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  for (const result of [{ assigned: false, reason: 'http_403' }, new Error('assign blew up')]) {
+    assignResult = result;
+    const r = await publish();
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.pr_url, 'https://github.com/o/r/pull/77');
+    assert.equal(r.body.pr_assignee, null);
+  }
+});
+
+await t('a never-claimed task falls back to the caller', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  holder = null;
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(assignCalls[0].login, 'the-archon');
+});
+
+// A PR body is never rewritten, so a wrong name would be permanent: a lookup that FAILS
+// must name nobody rather than credit the Archon who happened to re-ship it.
+await t('a claim-holder lookup that THROWS names nobody, and still ships', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  db.getLastClaimHolder = async () => { throw new Error('simulated DB outage'); };
+  assignResult = { assigned: false, reason: 'bad_login' };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(assignCalls[0].login, null);
+  assert.ok(!opened.body.includes('Built by'), opened.body);
+  assert.equal(r.body.pr_assignee, null);
+});
+
+server.close();
+console.log(`\npr_assign: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/provision.mjs

@@ -415,6 +415,8 @@ function recorder({ apply = false } = {}) {
     // Stub the DNS token-scope preflight (task 1980) so the composition stays hermetic
     // (no real CF call). Default: reachable; a test overrides it to exercise the block.
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    // Caddy's resolved-config check (task 1002860) stubbed wired; tests/provision_caddy_wiring.mjs covers it.
+    checkCaddyWiring: () => null,
     // Owner OAuth token lookup for the scaffold push (task 1002317). Default: none →
     // the scaffold takes the SSH `origin` fallback (so existing push assertions hold
     // without touching the real db module). A test overrides it to exercise the token path.
@@ -1115,6 +1117,7 @@ function dnsRecorder({ apply = false } = {}) {
     // Preflight (task 1980) stubbed reachable so --apply DNS tests reach the step-5
     // behavior they assert (the preflight itself is covered by its own test below).
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, envs, cleared };
 }
@@ -1525,6 +1528,7 @@ function privRecorder({ apply = false } = {}) {
     writeFile: (p, _body, opts) => { writes.push({ p, opts: opts || {} }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, writes };
 }
@@ -1666,6 +1670,7 @@ await ta('provisionInstance(co-tenant, remote): box steps use the box `exec`, bu
       controlWriteFile: () => ({ ok: true }),
       doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+      checkCaddyWiring: () => null,
     };
     await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
     // box-mutating steps → the box executor (which, in prod, ssh's to the co-hosting box)
@@ -1697,6 +1702,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
       controlWriteFile: (p) => { controlWrites.push(p); return { ok: true }; },                 // the control-plane writer
       doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      checkCaddyWiring: () => null,
     };
     await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps);
     // The bug (task 2074): these landed on the REMOTE box, which never had the scaffolded
@@ -1736,6 +1742,7 @@ await ta('provisionInstance(standalone, remote, --apply): FAILS LOUD when the co
       exec: () => ({ ok: true, stdout: '' }), controlExec: () => ({ ok: true, stdout: '' }),
       writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }), doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      checkCaddyWiring: () => null,
     };
     await assert.rejects(
       () => P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps),
@@ -1980,6 +1987,7 @@ function attachRecorder({ apply = false, envBody = WEB_ENV_ON_BOX } = {}) {
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, envs, writes, events, dnsNotes, cleared };
 }
@@ -2226,6 +2234,7 @@ await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach le
     exec: (cmd) => ({ ok: true, stdout: /\bcat\b.*web\.env/.test(String(cmd)) ? 'PORT=3010\n' : '' }),
     writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.ran, 1);
@@ -2288,6 +2297,7 @@ function truthRecorder({ healthzFails = false } = {}) {
     writeFile: () => ({ ok: true }),
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
     getGithubToken: async () => null,
   };
   return { deps, cmds, statuses, patches, probes, logs, events, dnsNotes };
@@ -2361,6 +2371,7 @@ await ta('F19: a RETIRED intent records its reason on the instance without chang
     },
     exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+    checkCaddyWiring: () => null,
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1);
@@ -2386,6 +2397,7 @@ await ta('F19: a NON-final failure re-pends the intent and writes nothing on the
     },
     exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+    checkCaddyWiring: () => null,
   };
   await P.cmdRunIntents(deps);
   assert.equal(resolved.length, 0, 'not resolved — it re-pends for a later tick');

package/tests/provision_caddy_wiring.mjs

@@ -0,0 +1,148 @@
+// tests/provision_caddy_wiring.mjs — provisioning checks the base Caddyfile carries the
+// on-demand TLS ask and imports the site snippets before it reports a domain wired
+// (task 1002860, ADR 0303). Before it, a box missing either directive provisioned
+// "successfully" and the instance was simply unreachable. Hermetic: exec is a fake that
+// answers `caddy adapt` with a fixture of Caddy's resolved JSON.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { caddyWiringGap, checkCaddyWiring } = require('../scripts/gds/provision-net.js');
+
+const DOMAIN = 'mercury.example.com';
+// What `caddy adapt` prints: 2.7 writes the ask as a string, 2.8+ as a permission module.
+const adapted = ({ onDemand, hosts = [] } = {}) => JSON.stringify({
+  apps: {
+    http: { servers: { srv0: { routes: hosts.map((h) => ({ match: [{ host: [h] }] })) } } },
+    ...(onDemand ? { tls: { automation: { on_demand: onDemand } } } : {}),
+  },
+});
+const ASK_27 = { ask: 'http://127.0.0.1:3002/api/bongos/provisioning/tls-check' };
+const ASK_28 = { permission: { module: 'http', endpoint: 'http://127.0.0.1:3002/api/gds/provisioning/tls-check' } };
+const OPTS = { domain: DOMAIN, caddyfile: '/etc/caddy/Caddyfile', snippetDir: '/etc/caddy/sites' };
+
+test('a wired config passes in both the 2.7 ask and the 2.8 permission shape', () => {
+  for (const onDemand of [ASK_27, ASK_28]) {
+    assert.equal(caddyWiringGap(adapted({ onDemand, hosts: [DOMAIN] }), { ...OPTS, requireHost: true }), null);
+  }
+});
+
+test('no on-demand ask, or one aimed elsewhere, names the directive and the file to add it to', () => {
+  for (const onDemand of [undefined, { ask: 'http://127.0.0.1:9000/some-other-check' }]) {
+    const gap = caddyWiringGap(adapted({ onDemand, hosts: [DOMAIN] }), OPTS);
+    assert.match(gap, /on_demand_tls/);
+    assert.match(gap, /\/etc\/caddy\/Caddyfile/);
+    assert.match(gap, /\/provisioning\/tls-check/);
+  }
+});
+
+test('a domain Caddy does not serve after the snippet is written names the missing import', () => {
+  const gap = caddyWiringGap(adapted({ onDemand: ASK_27, hosts: ['other.example.com'] }), { ...OPTS, requireHost: true });
+  assert.match(gap, /import \/etc\/caddy\/sites\/\*\.caddy/);
+  assert.match(gap, /mercury\.example\.com/);
+  assert.equal(caddyWiringGap(adapted({ onDemand: ASK_27 }), OPTS), null, 'the preflight asks only for the ask — no snippet exists yet');
+});
+
+test('output that is not Caddy JSON, or a failed adapt, is a gap rather than a pass or a crash', () => {
+  assert.match(caddyWiringGap('', OPTS), /caddy adapt/);
+  assert.match(caddyWiringGap('null', OPTS), /caddy adapt/);
+  const boom = () => { const e = new Error('Command failed'); e.stderr = Buffer.from('Error: adapting config: Caddyfile:3 - unrecognized directive'); throw e; };
+  assert.match(checkCaddyWiring(boom, OPTS), /unrecognized directive/);
+  const cmds = [];
+  checkCaddyWiring((c) => { cmds.push(c); return { ok: true, stdout: adapted({ onDemand: ASK_27 }) }; }, OPTS);
+  assert.deepEqual(cmds, ['caddy adapt --config /etc/caddy/Caddyfile --adapter caddyfile'], 'unprivileged and read-only');
+});
+
+// -- the runner legs --------------------------------------------------------
+
+const coTenant = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'requested', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: DOMAIN };
+const activeStandalone = { id: 18, slug: 'spike', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7, port: 3010, db_name: 'spike', domain: 'spike.example.com' };
+const WEB_ENV = 'PORT=3010\nBONGOS_PUBLIC_ORIGIN=https://old.example.com\n';
+
+// `served` = the hosts Caddy's resolved config carries once a snippet is written — the
+// fake flips to them after the first .caddy write, like the real import would.
+function harness({ onDemand = ASK_27, importsSnippets = true, reloadFails = false } = {}) {
+  const cmds = [], writes = [], statuses = [];
+  let snippetWritten = null;
+  const exec = (cmd, opts = {}) => {
+    cmds.push({ cmd, opts });
+    if (cmd.startsWith('caddy adapt')) return { ok: true, stdout: adapted({ onDemand, hosts: importsSnippets && snippetWritten ? [snippetWritten] : [] }) };
+    if (/cat\b.*web\.env/.test(cmd)) return { ok: true, stdout: WEB_ENV };
+    if (/reload caddy/.test(cmd) && reloadFails) throw new Error('Job for caddy.service failed');
+    return { ok: true, stdout: '' };
+  };
+  const deps = {
+    apply: true, log: () => {}, sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s) => { statuses.push(s); }, recordEvent: async () => {},
+      recordDnsNote: async () => {}, clearReleasedDomains: async () => {},
+    },
+    exec,
+    writeFile: (p, body) => { writes.push(p); if (p.endsWith('.caddy')) snippetWritten = (/^(\S+) \{/.exec(body) || [])[1] || null; return { ok: true }; },
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    getGithubToken: async () => null,
+  };
+  const ran = (re) => cmds.some((c) => re.test(c.cmd));
+  return { deps, cmds, writes, statuses, ran };
+}
+
+test('provision: a box with no tls-check ask is refused before anything on it changes', async () => {
+  const h = harness({ onDemand: null });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /^Caddy preflight failed: .*on_demand_tls/);
+  assert.equal(h.writes.length, 0, 'no file written');
+  assert.ok(!h.ran(/createdb|systemctl/), 'no database or service touched');
+  assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+});
+
+test('provision: a snippet Caddy never imports fails the run instead of reporting success, and Caddy is not reloaded', async () => {
+  const h = harness({ importsSnippets: false });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /^Caddy wiring failed: .*import \/etc\/caddy\/sites\/\*\.caddy/);
+  assert.ok(h.writes.some((p) => p.endsWith('/mercury.caddy')), 'the snippet was written first — that is what the check proves Caddy reads');
+  assert.ok(!h.ran(/reload caddy/));
+  assert.ok(!h.ran(/healthz/), 'never reaches the healthz step');
+});
+
+test('provision: a wired box reloads Caddy loudly — a rejected reload fails the run', async () => {
+  const ok = harness();
+  assert.equal((await P.provisionInstance(coTenant, ok.deps)).ok, true);
+  const reload = ok.cmds.find((c) => /reload caddy/.test(c.cmd));
+  assert.ok(reload, 'reloads');
+  assert.notEqual(reload.opts.allowFail, true, 'not allowFail');
+  await assert.rejects(P.provisionInstance(coTenant, harness({ reloadFails: true }).deps), /caddy\.service failed/);
+});
+
+test('provision: a domainless instance and a dry run never call caddy adapt', async () => {
+  const bare = harness({ onDemand: null });
+  assert.equal((await P.provisionInstance({ ...coTenant, domain: null }, bare.deps)).ok, true);
+  const dry = harness({ onDemand: null });
+  dry.deps.apply = false;
+  await P.provisionInstance(coTenant, dry.deps);
+  assert.ok(!bare.ran(/caddy adapt/) && !dry.ran(/caddy adapt/));
+});
+
+test('domain-attach: refused before the env patch without the ask; fails loudly when the snippet is not imported', async () => {
+  const noAsk = harness({ onDemand: null });
+  const r1 = await P.domainAttachInstance(activeStandalone, noAsk.deps);
+  assert.equal(r1.ok, false);
+  assert.match(r1.error, /^Caddy preflight failed/);
+  assert.equal(noAsk.writes.length, 0, 'web.env untouched');
+  assert.ok(!noAsk.ran(/systemctl/));
+
+  const noImport = harness({ importsSnippets: false });
+  const r2 = await P.domainAttachInstance(activeStandalone, noImport.deps);
+  assert.equal(r2.ok, false);
+  assert.match(r2.error, /^Caddy wiring failed: .*spike\.example\.com/);
+  assert.ok(!noImport.ran(/reload caddy/));
+
+  const wired = harness();
+  assert.equal((await P.domainAttachInstance(activeStandalone, wired.deps)).ok, true);
+  assert.notEqual(wired.cmds.find((c) => /reload caddy/.test(c.cmd)).opts.allowFail, true);
+});