@bongos/core 1.19.936 → 1.19.938

package/scripts/gds/provision-repo.js

@@ -14,7 +14,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail } = require('./provision-config.js');
+const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotName } = require('./provision-config.js');
 // The repo-identity + owner-credential leaf (task 1003081). Carved OUT of this file so
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
@@ -86,10 +86,34 @@ function seedFirstVersionCmd(inst, { privileged = false } = {}) {
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
 // scripts/deploy/deploy-instance.sh runbook API-driven instead of by hand.
 const CORE_PKG_DIR = 'node_modules/@bongos/core';
-// The unix account the instance's Node process + its backup timer run as. Mirrors
-// serviceUnit's hardcoded `User=lars`/`Group=lars` (the droplet's app user); kept as
-// one constant so the backup dir owner + the backup unit's User= can't drift from it.
-const APP_USER = 'lars';
+// The plane's app user: the unix account that owns the control-plane checkout, owns the
+// backup dir, runs the backup timers, and whose GROUP every instance account joins to read
+// the checkout. One resolver, so those four can't drift apart.
+//
+// Derived, never named (task 1002719). It used to be the founder's own account as a
+// literal, and a standup on any host that account did not exist on died `invalid user` at
+// the backup step. PROVISION_APP_USER pins it; otherwise it is the account this runner
+// executes as, which on a plane IS the app user (the runner unit runs as it), so the live
+// box resolves exactly what the literal said. A runner driving a different box over SSH
+// (remoteHost) should pin it. root is refused, not resolved: the instance
+// accounts join this account's group, and group root is not a read grant to hand a tenant.
+// Validated because it is interpolated into shell commands and unit files.
+const UNIX_ACCOUNT_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+function appUser({ env = process.env, userInfo = os.userInfo } = {}) {
+  let name = String(env.PROVISION_APP_USER || '').trim();
+  if (!name) {
+    try { name = userInfo().username; } catch { name = ''; } // a uid with no passwd entry
+  }
+  if (name === 'root' || !UNIX_ACCOUNT_RE.test(name)) {
+    const why = name === 'root' ? 'is root' : 'is not a usable unix account name';
+    throw new Error(`provisioning: the app user ${JSON.stringify(name)} ${why} — set PROVISION_APP_USER to the unprivileged account that owns this checkout`);
+  }
+  return name;
+}
+// The app user's PRIMARY group, looked up by the shell on the box the command runs on. It
+// need not share the account's name (a service account created into `users`), so it is
+// never spelled as the account name.
+function appGroupExpr() { return `$(id -gn ${appUser()})`; }
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
 // WHERE THE INSTANCE THIS CORE SERVES ACTUALLY LIVES (task 1004123).
 //
@@ -145,7 +169,7 @@ function standaloneRegenDocsCmd() { return `node ${CORE_PKG_DIR}/scripts/gds/reg
 // ── Per-instance identity: its OWN unix account + its OWN password-authed PG role ──
 // (task 1003369, audit ref B3 of the 2026-08-29 security audit.)
 //
-// THE HOLE THIS CLOSES. Every instance service used to run `User=lars/Group=lars`, and
+// THE HOLE THIS CLOSES. Every instance service used to run as the one shared app user, and
 // co-tenant is the DEFAULT shape — so on a shared box every instance ran as the SAME
 // unix user. A unix user may read /proc/<pid>/environ of its own processes, which means
 // any instance could read every SIBLING's environment: GITHUB_APP_PRIVATE_KEY, the
@@ -223,7 +247,7 @@ function ensureInstanceUserCmd(inst, { privileged = false } = {}) {
 // NOT re-open the two vectors this task closes: /proc/<pid>/environ stays readable only
 // by the process's own uid, and the DB now demands a password no sibling holds.
 function grantInstanceRepoReadCmd(inst, { privileged = false } = {}) {
-  return `${privileged ? 'sudo ' : ''}usermod -aG ${APP_USER} ${instanceUser(inst)}`;
+  return `${privileged ? 'sudo ' : ''}usermod -aG ${appGroupExpr()} ${instanceUser(inst)}`;
 }
 
 // Can this plane give a child instance its OWN unix account AT ALL? (task 1004018, ADR 0317)
@@ -758,7 +782,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     } else {
       writeFile(giPath, INSTANCE_GITIGNORE);
     }
-    exec(`git -C ${root} config user.name "Cloud Bongos"`);
+    exec(`git -C ${root} config user.name "${provisionerBotName()}"`);
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);
     const commitMsg = mode === 'adopt'
@@ -1012,7 +1036,7 @@ function buildCorePinRefreshCommit({ root, fromVersion, toVersion, repo, ownerTo
     : `git -C ${root} push origin main`;
   return {
     config: [
-      `git -C ${root} config user.name "Cloud Bongos"`,
+      `git -C ${root} config user.name "${provisionerBotName()}"`,
       `git -C ${root} config user.email "${provisionerBotEmail()}"`,
     ],
     add: `git -C ${root} add -A`,
@@ -1094,7 +1118,8 @@ async function refreshStandaloneCorePin(inst, deps) {
 // cwd, deploy-instance.sh §4); co-tenant/dedicated run this control-plane checkout's src/.
 
 module.exports = {
-  APP_USER,
+  appGroupExpr,
+  appUser,
   accountPlaneGap,
   accountPreflight,
   CORE_PKG_DIR,

package/scripts/gds/provision-units.js

@@ -11,7 +11,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, CORE_PKG_DIR, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
@@ -103,8 +103,8 @@ Requires=postgresql.service
 
 [Service]
 Type=oneshot
-User=${APP_USER}
-Group=${APP_USER}
+User=${appUser()}
+# No Group=: systemd then uses the app user's primary group, whatever it is named.
 # The DB to dump + where dumps land — set on the unit (not via the instance web.env)
 # so the dump targets the right database with no fallback to a stale default (root
 # cause of the task-2210 breakage). db-backup-nightly.sh reads both as env.

package/scripts/gds/provision.js

@@ -26,7 +26,7 @@
 //     WOULD run and mutates nothing (no DB writes, no shell, no cloud call). The
 //     LIVE leg is an explicit operator/timer `--apply`.
 //   • PRIVILEGE model (task 2066, ADR 0128). The intent runner runs as a NON-root
-//     user (User=lars) with passwordless sudo, which cannot itself write under /etc,
+//     user (the app user) with passwordless sudo, which cannot itself write under /etc,
 //     reload systemd/Caddy, or peer-auth to Postgres as a superuser. PROVISION_SUDO=1
 //     escalates exactly those steps (sudo install / sudo systemctl / sudo -u postgres);
 //     default OFF = bare commands (root / test / co-tenant-legacy contexts unchanged).
@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, accountPreflight, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { accountPreflight, appGroupExpr, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
@@ -282,6 +282,9 @@ async function provisionInstance(inst, deps) {
   // useradd would crash mid-provision instead of refusing.
   const accountGap = accountPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, privileged, probe: deps.accountPlaneGap });
   if (accountGap) return { ok: false, error: accountGap };
+  // App-user preflight (task 1002719): steps below name the app user, and appUser() refuses
+  // root or an unusable name. Refuse HERE, before the status flip, not midway through.
+  try { appUser(); } catch (e) { return { ok: false, error: e.message }; }
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
@@ -640,7 +643,7 @@ runcmd:
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
   - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-${roleLines}  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
+${roleLines}  - [ bash, -lc, "install -d -o ${appUser()} -g ${appGroupExpr()} -m 0750 ${CONFIG.backupDir}" ]
   - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
 `;
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.936'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.938'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_runner.mjs

@@ -38,6 +38,9 @@ const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
 const RP = require('../scripts/gds/provision-repo.js');
 
+// task 1002719: the app user is derived, so pin one that is nobody's real account.
+process.env.PROVISION_APP_USER = 'appsvc';
+
 let passed = 0;
 let failed = 0;
 const t = async (name, fn) => {
@@ -433,7 +436,7 @@ await t('the control plane upgrades as the operator account, never as root', asy
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
   const cmd = upgradeCall(d);
-  assert.match(cmd, /sudo -u lars /, 'runs as the operator account');
+  assert.match(cmd, /sudo -u appsvc /, 'runs as the operator account');
   assert.doesNotMatch(cmd, /sudo node /, 'a bare `sudo node` is the bug — it lands on root');
 });
 
@@ -442,7 +445,7 @@ await t('a tenant upgrades as its OWN account, which is also its Postgres login
   await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
-  assert.doesNotMatch(cmd, /sudo -u lars /, 'one tenant must never be upgraded under another account');
+  assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
 });
 
 await t('the database is NAMED, not discovered — an adopted repo has no core at its root to ask', async () => {
@@ -691,7 +694,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   // is reported rather than silently papered over.
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
-  assert.equal(r.runAs, 'lars');
+  assert.equal(r.runAs, 'appsvc');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
 });
@@ -699,7 +702,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
 await t('the control plane is never probed — it has no instance account by design', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'lars', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'appsvc', fellBack: false });
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
 });
 
@@ -707,7 +710,7 @@ await t('the dry run is invoked as the account that actually exists', async () =
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
-  assert.match(cmd, /sudo -u lars /, `must not sudo to an account that does not exist — got: ${cmd}`);
+  assert.match(cmd, /sudo -u appsvc /, `must not sudo to an account that does not exist — got: ${cmd}`);
   assert.doesNotMatch(cmd, /bongos-test4/);
 });
 
@@ -715,7 +718,7 @@ await t('the MOVE probes identically, so preview and move cannot diverge on the
   const d = acctDeps({ accountExists: false });
   await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
-  assert.match(cmd, /sudo -u lars /, 'the move follows the same probe as the preview');
+  assert.match(cmd, /sudo -u appsvc /, 'the move follows the same probe as the preview');
 });
 
 await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly widening it', () => {
@@ -789,7 +792,7 @@ await t('a ✖ line still wins over the raw tail', async () => {
 await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
-  assert.equal(v.ran_as, 'lars');
+  assert.equal(v.ran_as, 'appsvc');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 

package/tests/government_seed.mjs

@@ -42,6 +42,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_007_amendments.sql',                 // R14 amendment proposals table (task 1003027)
   'government_008_closed_items_index.sql',         // R16 closed-history index (task 1003029)
   'government_017_board_section_keys_v2.sql',      // BV2.R06 board section_key CHECK widening (task 1004085)
+  'government_018_passed_items_index.sql',         // BV2.R17 passed-item lookup index (task 1004096)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.