@bongos/core 1.19.937 → 1.19.939

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.937",
-  "core_contract": "1.19.937",
-  "source_commit": "2aee2eb9e23c44abf42a24b09f9603555ba33673",
+  "core_version": "1.19.939",
+  "core_contract": "1.19.939",
+  "source_commit": "5a36a537ba12fc2d9dc3ce29ec6e84fb102238e8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T05:57:31.197Z",
+  "built_at": "2026-09-21T18:56:49.358Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 511,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2334,
+    "functional_verbatim": 2335,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2871,
-  "tree_sha256": "026277292d3a56e019a060c711325a482164c64ae62daa9c92ee820321bd0a81",
+  "file_count": 2872,
+  "tree_sha256": "718dc449d9f22dd45347cce2f17dc24d6ca3d8e0cce9c9b1e7aad67a8683df47",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1897,7 +1897,7 @@
     {
       "path": "docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md",
       "mode": "0000644",
-      "sha256": "2697c7cdca6d518d7ca7d84cf354ca92f264bf641e0b178bfa038f83878d5963"
+      "sha256": "d36d2333c07107c09d7431b4f49ceaafe51231dd4646dbb13bb081d0b2b63a33"
     },
     {
       "path": "docs/adr/0282-a-module-that-spends-for-its-callers-declares-a-payer-and-the-core-refuses-it-without-one.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3fddd5b37bb0a00a12bf88b81992eb2510e0115b8cc7f67c8fd67c51b65ae678"
+      "sha256": "4e9e33798c5671990f7d9d45e0695f43b8de1621cdaa316dd30d4e014f93df90"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2897,7 +2897,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "a5c98b8ee01461669a5f4ee5fa361e85e11915eb8326e060c4cf20841c35c07e"
+      "sha256": "48dbce2966702987cbb9de6639ceb1e63ab3c7166e759bf93df06bd9f5875a88"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -4807,7 +4807,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "e5a689447524c8c3460a2a649bea3673c958c6ec8607ad41144c575d29d142d0"
+      "sha256": "de280baf7432be56c67a65681a6e5d5af7146464271dec547d5bd6d45be2f37a"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -6497,7 +6497,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "291a3765197f9429c70dd240fe5cdfa72a245ad3698c822032e71bb88999d533"
+      "sha256": "f5556a75b34977d0c46d4c9cf95383e4f57088c137e1c29c5b87211a5f159451"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -6667,7 +6667,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "7447a5eb37dc120e14fa6b5fb81c574ec951b9a46ed126d5c954c63b03bc6b6d"
+      "sha256": "8ceb0707b3bfe16e308cdf3034b034bcea8b5e266bcfa1d0e47bd53a61392990"
     },
     {
       "path": "modules/provisioning/routes/disconnect.js",
@@ -8002,12 +8002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f1999bdf0489eddf32aabd9a5d2aec6b82bd9765a598e0eff299c31a367b6ff6"
+      "sha256": "f9412625c08d05fd8718e0590544e5b4ac8d61ce85168c01c98973b0b0afbafd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0be6855a6ff73d2592bff19899727f708abd44265f2ea4538cc48491982a5aac"
+      "sha256": "fcdd31f9e93e415ebe9384cfa896520ea80733044e833513f914c0f873180774"
     },
     {
       "path": "public-docs/index.html",
@@ -8067,7 +8067,7 @@
     {
       "path": "scripts/gds/address-park-sweep.sh",
       "mode": "0000644",
-      "sha256": "9cf1964d675f385ff73bbbd7683f9b0fd2b9776c832548c2e662536af31b2d15"
+      "sha256": "b08a77da7a834dbe30fa9bd041ce05289f8abf48b3c44764ecbe2238cbc88e9c"
     },
     {
       "path": "scripts/gds/adopt-detect.js",
@@ -8137,7 +8137,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "27b436b82d129f956ddb956efdca9226f31602a8f22b4099b9e6b0ffeb49313e"
+      "sha256": "95607e7f1383148ecb21d448196872f752988d5c70169f5470a12eafc7e2643e"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -8427,12 +8427,12 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "5e8b7ebfe0b82a426e229a256daf231cb597d8e1df2b908c528a0ed0a67066a5"
+      "sha256": "6123be86860d43d95d5d44966eb3e49caf9c5dc05a2a9ec02c67f53f527919dd"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
       "mode": "0000644",
-      "sha256": "97f52f6aff95e1c81e069c1d4228eecb514af6068c810441465b5f5b7ee0f2ce"
+      "sha256": "f530f46117bb052f8294e29c95970f6325e1e39f7ee27c96b92c2d672537b37d"
     },
     {
       "path": "scripts/gds/demote.js",
@@ -8742,7 +8742,7 @@
     {
       "path": "scripts/gds/instance-apex.js",
       "mode": "0000644",
-      "sha256": "fcb59a4eda007d98179dfe54956fcce4ff07c11ca941ed6dea41b38c0daca421"
+      "sha256": "7b2402543c3b1eadbafc14907e6dc6689b434ac65fb9c709115dd81a92eb13eb"
     },
     {
       "path": "scripts/gds/key-card.js",
@@ -8947,12 +8947,12 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "68882e5e600881c0e3a96d4b84a9ad38dd77c3216a09a7886a263cfe40044f1e"
+      "sha256": "6905238b164d1fbd47abbc1f495e6f1bf2de58ed26545853f8aa92f199dc78e5"
     },
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "8ad61c85e0cf3f515fbd970fedcd6c33871d70e4dd42c36cb275ae907e31b655"
+      "sha256": "4a84f48518a6427e95bf23e273865b6b2753489b40737b9256191fd2a65562e1"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -8967,7 +8967,7 @@
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
-      "sha256": "210d5135b157363499dc34bb8ac34eb7f661a61d8ba3d23e6a64953e5893559e"
+      "sha256": "34f24f674b7be4607f598d6f968e3e3c1f15cb9175361956b0808a1df1ac723c"
     },
     {
       "path": "scripts/gds/provision-repo-auth.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "ef448bfb12437b2a3b83d7d726daff6a38b2a5a2db52096cc0150171d73547ce"
+      "sha256": "ab6b240d93920bb81bf096aff9553c478a2c3e8c0c4926b81c468e99aee89d67"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8987,12 +8987,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "4228fa562e8832f545558c15caf94fdc3e5d96d7928e6ecb8a6bf23dd6511f04"
+      "sha256": "f8c642838cbae5dc096f35870bda10f3da342e1cd93b0713e4528bfefe1819a8"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "e384ffc0ecfcdb05d275d1245a6bc1214f2737c0fa67ae21eb8228ce1a398abf"
+      "sha256": "e879686d5fcadfd32eb1dfc4e1640fc229cc4f0afc78615681964484e8457c1f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9512,7 +9512,7 @@
     {
       "path": "scripts/gds/stray-unit-sweep.sh",
       "mode": "0000644",
-      "sha256": "7bc5a6193130085d7faebfb6a71a16b89aa09747f30fdfd612d7cf4c7a1778ff"
+      "sha256": "f90a8ae14f3715f1454431d49be858b605bb3030a2ff3359f5ba2d41ebfd7a3f"
     },
     {
       "path": "scripts/gds/surface.js",
@@ -10007,7 +10007,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "546941331565d646b5b815a2a66c4833993abd3affcd2ba309ddad87191d766a"
+      "sha256": "7e4584b3285ed7261fa69727d9100dc10856000a7d8f75c8e9f1f47c26eb2f93"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10922,7 +10922,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "6077bfd9eca120db9dcfebec30fa355d0ae281df6cf9fbd6489203640051fcc1"
+      "sha256": "f8bc5b5329c4de27b41a9172e6b5023c4854d864f532aac3ed062e0d35633f00"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -13037,12 +13037,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "4e1d463693cb7d5e363964360b72085d2307578bd430f2fee1129698d907a567"
+      "sha256": "b6558cb094a2d38c837d3e5028573c14e5c55c832555b382c1d1135a55b5c6b5"
     },
     {
       "path": "tests/provision_account_identity.mjs",
       "mode": "0000644",
-      "sha256": "d56cf2553c0b5efa6a17df3d578b7b5766ff62504af6c226688f73ac417df3c6"
+      "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",
@@ -14009,6 +14009,11 @@
       "mode": "0000644",
       "sha256": "24257ca4ad1a7bcefb735ee1b02609469035730e0723645f71e10eb71525bb72"
     },
+    {
+      "path": "tests/sweep_app_account.mjs",
+      "mode": "0000644",
+      "sha256": "46fef77aa82d7f5295ed119b2d5ca77aeb29f5f267a3b82235260a94ee5bd41f"
+    },
     {
       "path": "tests/task_classifier_vocab.mjs",
       "mode": "0000644",

package/docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md

@@ -46,6 +46,8 @@ ADR 0128 anticipated the DB half in its own alternatives: *"Do createdb/migrate
 - **`provision.js` sits two lines under the 1,500-line ratchet.** The generators and their full rationale live in `provision-repo.js`; the runner carries the wiring and a pointer. The next change there will have to move something out.
 - **The non-privileged path is unchanged in kind.** The DDL escalates through the same `asPostgres()` helper ADR 0128 introduced, so a runner without `PROVISION_SUDO` renders the same commands without `sudo` — as broken, and no more broken, than it already was for `createdb`.
 
+> **Amended by task 1002719 — the app user is resolved, not named.** The account whose group every instance joins (and which owns the backup dir and runs the backup timers) was the founder's own account as a literal, so a standup on any other host died `invalid user` at the backup step. `appUser()` in `provision-repo.js` now answers it: `PROVISION_APP_USER`, else the account the runner runs as — which on a plane *is* the app user, so the founder box resolves exactly what the literal said. **root is refused, not resolved**: instance accounts join this account's group, and group root is not a read grant to hand a tenant. The name is validated before it reaches a shell command or a unit file, and the refusal is a preflight: it fires before the status flip, never midway through a standup. Its **group** is the account's primary group looked up on the box (`$(id -gn …)`; the backup unit carries no `Group=`), never the account name spelled twice — an admin-made service account need not have a group of its own name. `audit-authorship.sh` now flags the founder's unix account in account position (`-o`/`-u`, `User=`, `*user = '…'`) in runtime code, because the GitHub-login grep never could.
+
 ## Alternatives considered
 
 - **A `DATABASE_URL` in `web.env` instead of discrete `PG*` vars.** `pool.js` already prefers it, so it would have needed no pool change at all. Rejected: the socket path has to ride as `?host=…` or a percent-encoded authority, and the exact parse is `pg-connection-string`'s business rather than something the test could pin — trading a stated, assertable identity for a URL whose behavior we would be trusting.

package/docs/module-api-changelog.md

@@ -2348,5 +2348,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.935 with no explicit bump. run 35561285958. (task 1002620)
   1.19.937 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.936 with no explicit bump. run 35566446478. (task 1002620)
+  1.19.938 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.937 with no explicit bump. run 35638291152. (task 1002620)
+  1.19.939 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.938 with no explicit bump. run 35641614084. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another, and installs its backup dir as a hardcoded founder user (task 1002719). **Two of the three now refuse instead of failing opaquely, each for its own reason** — so fixing one cannot silently re-open the other. **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. **The identity leg refuses too** (task 1004018, [ADR 0317](../adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md)): provisioning probes whether the runner can reach root on this plane and returns `Account preflight failed: …` before any mutation, because `useradd` cannot run under `USER node` and every child there would otherwise share one uid — the sibling-secret vector [ADR 0281](../adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) exists to close. It is a capability question, not a knob: there is no setting that accepts a shared uid. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs assumed a systemd box, and on a compose self-host a new project still cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another, and installed its backup dir as a hardcoded founder user. **That third leg is fixed** (task 1002719): the backup dir's owner is `PROVISION_APP_USER`, else the account the runner runs as (root is refused), so the standup no longer dies `invalid user` on a host without the founder's account. **The other two now refuse instead of failing opaquely, each for its own reason** — so fixing one cannot silently re-open the other. **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. **The identity leg refuses too** (task 1004018, [ADR 0317](../adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md)): provisioning probes whether the runner can reach root on this plane and returns `Account preflight failed: …` before any mutation, because `useradd` cannot run under `USER node` and every child there would otherwise share one uid — the sibling-secret vector [ADR 0281](../adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) exists to close. It is a capability question, not a knob: there is no setting that accepts a shared uid. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/modules/hall-ui/public/deploy.js

@@ -6,7 +6,7 @@
 // pipeline and the ONLY act that makes shipped work visible to users — and it was
 // reachable from exactly one place, a shell on the control-plane box holding an ssh key.
 // An agent could not close the loop either: the permission classifier blocks a mutating
-// `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold was the
+// `sudo -u <app user>` over ssh by design. So the one gate that is the owner's to hold was the
 // one gate with no instrument. This page is the instrument.
 //
 // WHY THE PROJECTS ARE HERE AND NOT IN THEIR OWN HALLS. The obvious shape — each owner

package/modules/provisioning/core-upgrade.js

@@ -7,7 +7,7 @@
 // that makes shipped work visible to users. It was reachable from exactly one
 // place — a shell on the control-plane box with an ssh key — so the owner could not
 // take it, and neither could an agent (the permission classifier blocks a mutating
-// `sudo -u lars` over ssh by design).
+// `sudo -u <app user>` over ssh by design).
 //
 // THIS FILE ONLY ASKS. It validates and queues an intent; the control-plane runner
 // drains it and drives the proven `bongos upgrade` path with its health gate and

package/modules/provisioning/routes/core-upgrade.js

@@ -8,7 +8,7 @@
 // reachable from exactly one place — a shell on the control-plane box holding an
 // ssh key — which is why the owner said "I don't think I can make anything live",
 // and why an agent could not close the loop for them either: the permission
-// classifier blocks a mutating `sudo -u lars` over ssh by design.
+// classifier blocks a mutating `sudo -u <app user>` over ssh by design.
 //
 // THE WEB TIER ONLY ASKS. This queues an intent; the control-plane runner drains it
 // and drives the proven `bongos upgrade` path with its health gate and auto-rollback

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.937",
+  "version": "1.19.939",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.937",
+      "version": "1.19.939",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.937",
+  "version": "1.19.939",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/address-park-sweep.sh

@@ -16,6 +16,7 @@
 # Run on the control plane as a sudoer:
 #   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
 #   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
+# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
 #
 # Left in place on purpose, even with --apply: each project's database, dumps and checkout,
 # and the row's domain + port (ADR 0181 — a revive re-uses that address).
@@ -23,15 +24,25 @@ set -uo pipefail
 
 APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
 DB="${PGDATABASE:-cloudbongos}"
-INSTANCE_DIR="${INSTANCE_DIR:-/home/lars/cloudbongos-instance}"
+# The instance checkout and the account that owns it (task 1004135) — never a named person.
+# Run from an instance's vendored core, the checkout is three levels up (the rule
+# selfInstanceRoot() in provision-repo.js uses); from anywhere else it must be named. The
+# account is that checkout's owner unless PROVISION_APP_USER pins it; root holds no role here.
+CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
+[ -n "${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout — this sweep is not running from one"; exit 1; }
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null)}"
+if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns $INSTANCE_DIR"; exit 1
+fi
 SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
 BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
 
-rows=$(sudo -n -u lars psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+rows=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
 
 # slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
-plan=$(sudo -n -u lars env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
+plan=$(sudo -n -u "$APP_USER" env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
 const core = './node_modules/@bongos/core';
 const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
 const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
@@ -66,7 +77,7 @@ while IFS='|' read -r kind slug domain zone reserved blackhole; do
   printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
   left+=("$slug:dns")
   [ "$APPLY" = 1 ] || continue
-  sudo -n -u lars bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
+  sudo -n -u "$APP_USER" bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
     _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
 done <<< "$plan"
 

package/scripts/gds/audit-authorship.sh

@@ -13,6 +13,8 @@
 #     during a builder's session. (Use `req.builder.id` / the active claim.)
 #   * `lars589` / `larskristensen` literals in setup-path code or test data
 #     that would mis-attribute a second builder's work.
+#   * The founder's unix account in account position (`-o`/`-u <it>`,
+#     `User=<it>`, `APP_USER = '<it>'`) in runtime code — section 6.
 #
 # What is INTENTIONAL and allow-listed (NOT a violation):
 #   * Archived shipping docs in `limitations/*-shipped.md` — historical record.
@@ -280,6 +282,31 @@ fi
 grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
   | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
 
+# ----------------------------------------------------------------------------
+# 6. The founder's UNIX ACCOUNT in account position (task 1002719). Family (c)
+#    greps the GitHub login, and a unix name is not a GitHub login — which is
+#    how the standup's `install -d -o <founder> …` reached every operator's box
+#    unseen. Runtime code only (tests/ pin fixtures by design), and the ops
+#    allowlist above does NOT apply: "that is the droplet's unix user" is the
+#    very assumption this family refuses in code that runs on other planes.
+#    Derive the account instead (provision-repo.js appUser()).
+# ----------------------------------------------------------------------------
+UNIX_USER_PATTERN='((^|[^A-Za-z0-9_.-])(-o|-g|-u)[ =]lars\b)|(\b(User|Group)=lars\b)|(\bchown( -R)? lars\b)|([A-Za-z_]*[Uu][Ss][Ee][Rr][A-Za-z_]*\s*[:=]\s*["'"'"']lars["'"'"'])'
+UNIX_ALLOWLIST=(
+  # This script's own pattern.
+  'scripts/gds/audit-authorship.sh'
+)
+UNIX_ALLOWLIST_RE=''
+for e in "${UNIX_ALLOWLIST[@]}"; do
+  UNIX_ALLOWLIST_RE+="^${e//./\\.}:|"
+done
+UNIX_ALLOWLIST_RE="${UNIX_ALLOWLIST_RE%|}"
+
+grep -RIn -E "${EXCLUDE_DIRS[@]}" --exclude-dir=tests --exclude-dir=test "${EXCLUDE_FILES[@]}" -e "$UNIX_USER_PATTERN" . 2>/dev/null \
+  | sed 's|^\./||' \
+  | sort -u \
+  | grep -vE "$UNIX_ALLOWLIST_RE" >> "$TMP_FILTERED" || true
+
 HIT_COUNT=$(wc -l < "$TMP_FILTERED" | tr -d ' ')
 
 if [ "$VERBOSE" = "1" ]; then
@@ -306,6 +333,7 @@ echo "Remediation:"
 echo "  * Paths like /Users/larskristensen/...  ->  use \$HOME or os.path.expanduser('~')"
 echo "  * builder_id = 1 / shipped_by = 1       ->  use req.builder.id / the active claim"
 echo "  * lars589 / larskristensen literals     ->  use the current builder's github_login"
+echo "  * -o/-u lars, User=lars, *user = 'lars' ->  derive the account (appUser() in provision-repo.js)"
 echo ""
 echo "If a hit IS intentional (historical doc, droplet operational identity,"
 echo "or a frozen seed/import script), add it to the ALLOWLIST or"

package/scripts/gds/db-backup-nightly.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Nightly pg_dump of the GDS Postgres DB.
 #
-# Runs as user `lars` via the gds-db-backup.timer systemd unit (see
+# Runs as the unit's User= (the plane's app account) via the gds-db-backup.timer systemd unit (see
 # scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
 # in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
 # files older than 30 days are pruned.
@@ -33,7 +33,7 @@ set -euo pipefail
 
 # ---- configuration ----------------------------------------------------------
 
-# Destination directory for dumps. Owned by lars:lars, mode 0750.
+# Destination directory for dumps. Owned by that account and its primary group, mode 0750.
 BACKUP_DIR="${GDS_BACKUP_DIR:-/var/backups/gds}"
 
 # Database to dump: explicit GDS_BACKUP_DB wins, else the instance's own branding
@@ -69,7 +69,7 @@ DUMP_GLOB="${DB_NAME}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D
 if [ ! -d "$BACKUP_DIR" ]; then
   echo "ERROR: backup dir $BACKUP_DIR does not exist." >&2
   echo "       Create it with:" >&2
-  echo "         sudo install -d -o lars -g lars -m 0750 $BACKUP_DIR" >&2
+  echo "         sudo install -d -o $(id -un) -g $(id -gn) -m 0750 $BACKUP_DIR" >&2
   exit 2
 fi
 

package/scripts/gds/db-backup-offsite.sh

@@ -9,7 +9,7 @@
 #
 # Vendor decision: DigitalOcean Spaces over Backblaze B2 — see ADR 0025.
 #
-# Runs as user `lars` via the gds-db-offsite.timer systemd unit (see
+# Runs as the unit's User= (the plane's app account) via the gds-db-offsite.timer systemd unit (see
 # scripts/gds/gds-db-offsite.service + .timer). Weekly cadence.
 #
 # Authentication: S3-style credentials for the Space live OUTSIDE the repo
@@ -121,7 +121,7 @@ for v in SPACES_KEY SPACES_SECRET SPACES_BUCKET SPACES_REGION SPACES_ENDPOINT; d
 done
 if [ "${#missing[@]}" -gt 0 ]; then
   echo "ERROR: missing Spaces credentials: ${missing[*]}" >&2
-  echo "       Set them in $ENV_FILE (chmod 600, owned by lars). See ADR 0022 + 0025." >&2
+  echo "       Set them in $ENV_FILE (chmod 600, owned by $(id -un)). See ADR 0022 + 0025." >&2
   exit 2
 fi
 

package/scripts/gds/instance-apex.js

@@ -25,4 +25,14 @@ function provisionerBotEmail(env = process.env) {
   return apex ? `bot@${apex}` : 'bot@cloud-bongos.invalid';
 }
 
-module.exports = { instanceApex, provisionerBotEmail };
+// The name that identity commits under: the pack's product name, else the platform's
+// (task 1002719). Every caller builds `git config user.name "<name>"`, so a name the
+// shell cannot carry inside double quotes falls back instead of being interpolated.
+function brandProductName() {
+  try { return String(require('../../src/branding').branding().identity.productName || '').trim(); } catch { return ''; }
+}
+function provisionerBotName(name = brandProductName()) {
+  return name && !/["`$\\\r\n]/.test(name) ? name : 'Cloud Bongos';
+}
+
+module.exports = { instanceApex, provisionerBotEmail, provisionerBotName };

package/scripts/gds/provision-config.js

@@ -108,7 +108,7 @@ const CONFIG = {
   standaloneBase: process.env.PROVISION_STANDALONE_BASE || '/srv/cloudbongos',
   // ── Privilege escalation (task 2066, ADR 0128) ───────────────────────────
   // The intent runner runs as a NON-root user (provision-intent-runner.service:
-  // User=lars) that holds passwordless sudo. That user cannot itself write under
+  // User= the app user) that holds passwordless sudo. That user cannot itself write under
   // /etc, reload systemd/Caddy, or peer-auth to Postgres as a superuser — so the
   // runbook steps below FAIL as bare commands (the goal-35 blocker). With
   // PROVISION_SUDO=1 (alias PROVISION_PRIVILEGED=1) the privileged steps escalate:
@@ -163,7 +163,7 @@ const CONFIG = {
 
 // task 1002757 — the provisioner's git identity resolves from the instance's own
 // apex (env → bot@<apex> → neutral), never the hub's address hardcoded.
-const { provisionerBotEmail } = require('./instance-apex');
+const { provisionerBotEmail, provisionerBotName } = require('./instance-apex');
 
 const MAX_INTENT_ATTEMPTS = numEnv('PROVISION_INTENT_MAX_ATTEMPTS', 3);
 
@@ -229,5 +229,6 @@ module.exports = {
   numEnv,
   oauthSecret,
   provisionerBotEmail,
+  provisionerBotName,
   softFailResult,
 };

package/scripts/gds/provision-core-upgrade.js

@@ -30,7 +30,7 @@
 
 const path = require('path');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, dbName, instanceUser, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
+const { appUser, dbName, instanceUser, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 
 // The shapes whose box this runner can actually reach. Mirrors UPGRADE_SHAPES in the
@@ -277,19 +277,19 @@ function parsePreflight(out) {
  * Which unix account should this instance's upgrade run as? Asks the box (task 1004128).
  *
  * The fleet is heterogeneous: instances provisioned before task 1003369 run as the
- * shared APP_USER, instances provisioned after run as their own `bongos-<slug>`. Neither
+ * shared app user, instances provisioned after run as their own `bongos-<slug>`. Neither
  * is guessable from the row, and getting it wrong is not a soft failure — `sudo` refuses
  * an unknown user and the upgrade dies before pre-flight, which is exactly how the
  * tenant leg has been broken.
  *
  * Falling back is NOT a privilege escalation: an instance with no account of its own is
- * already running as APP_USER (its unit says so), so this runs the upgrade as precisely
+ * already running as the app user (its unit says so), so this runs the upgrade as precisely
  * the account that owns the files and the database it is about to touch. It IS reported,
  * because a missing per-instance account is a provisioning gap someone should close, and
  * a silent fallback would hide it forever.
  */
 function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
-  if (inst.hosting_shape === 'control-plane') return { runAs: APP_USER, fellBack: false };
+  if (inst.hosting_shape === 'control-plane') return { runAs: appUser(), fellBack: false };
   // Re-checked HERE rather than left to instanceUser()'s own throw, for the reason
   // upgradeInvocation states about itself: a call site whose safety depends on a
   // helper's internals is one refactor away from a shell-interpolation path.
@@ -317,7 +317,7 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
   if (!/no such user|unknown user/i.test(said)) {
     return { runAs: wanted, fellBack: false, probeInconclusive: true };
   }
-  return { runAs: APP_USER, fellBack: true, wanted };
+  return { runAs: appUser(), fellBack: true, wanted };
 }
 
 // ONE BUILDER FOR BOTH LEGS (task 1004121).
@@ -357,7 +357,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
   // half right. The control-plane leg is correct and verified live. The tenant leg
   // assumed the per-instance account model of task 1003369 is provisioned everywhere —
   // and on the live box NO `bongos-*` account exists, no such Postgres role exists, and
-  // every instance unit still says `User=lars`. So the fix for "Postgres has no role
+  // every instance unit still names the shared app user. So the fix for "Postgres has no role
   // root" swapped one absent account for another, and every tenant upgrade died with
   // `sudo: unknown user bongos-test4`.
   //
@@ -368,7 +368,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
   // (resolveRunAs below) instead of either side assuming. Passing it in keeps this
   // builder pure; the default preserves the old derivation for callers that have not
   // probed.
-  const account = runAs || (inst.hosting_shape === 'control-plane' ? APP_USER : instanceUser(inst));
+  const account = runAs || (inst.hosting_shape === 'control-plane' ? appUser() : instanceUser(inst));
   const sudoP = privileged ? `sudo -u ${account} env PGDATABASE=${dbName(inst)} ` : '';
   const cli = path.posix.join('scripts', 'gds', 'upgrade.js');
   const shared = [`${sudoP}node ${cli}`, '--registry', `--to ${to}`,

package/scripts/gds/provision-process.js

@@ -20,7 +20,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, CORE_PKG_DIR, instanceUser, standaloneRoot } = require('./provision-repo.js');
+const { CORE_PKG_DIR, appGroupExpr, appUser, instanceUser, standaloneRoot } = require('./provision-repo.js');
 const {
   backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath,
   backupUnitName, serviceUnit, serviceUnitPath,
@@ -39,7 +39,7 @@ const systemd = {
   // The backup DIR belongs to this step, not to the runbook: it exists only to serve the
   // schedule, so a manager that installs no schedule must not create it either.
   installBackup(inst, { exec, writeFile, sudoP }) {
-    exec(`${sudoP}install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}`);
+    exec(`${sudoP}install -d -o ${appUser()} -g ${appGroupExpr()} -m 0750 ${CONFIG.backupDir}`);
     writeFile(backupServicePath(inst), backupService(inst), { mode: 0o644, sudo: true });
     writeFile(backupTimerPath(inst), backupTimer(inst), { mode: 0o644, sudo: true });
     exec(`${sudoP}systemctl daemon-reload`);

package/scripts/gds/provision-repo.js

@@ -14,7 +14,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail } = require('./provision-config.js');
+const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotName } = require('./provision-config.js');
 // The repo-identity + owner-credential leaf (task 1003081). Carved OUT of this file so
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
@@ -86,10 +86,34 @@ function seedFirstVersionCmd(inst, { privileged = false } = {}) {
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
 // scripts/deploy/deploy-instance.sh runbook API-driven instead of by hand.
 const CORE_PKG_DIR = 'node_modules/@bongos/core';
-// The unix account the instance's Node process + its backup timer run as. Mirrors
-// serviceUnit's hardcoded `User=lars`/`Group=lars` (the droplet's app user); kept as
-// one constant so the backup dir owner + the backup unit's User= can't drift from it.
-const APP_USER = 'lars';
+// The plane's app user: the unix account that owns the control-plane checkout, owns the
+// backup dir, runs the backup timers, and whose GROUP every instance account joins to read
+// the checkout. One resolver, so those four can't drift apart.
+//
+// Derived, never named (task 1002719). It used to be the founder's own account as a
+// literal, and a standup on any host that account did not exist on died `invalid user` at
+// the backup step. PROVISION_APP_USER pins it; otherwise it is the account this runner
+// executes as, which on a plane IS the app user (the runner unit runs as it), so the live
+// box resolves exactly what the literal said. A runner driving a different box over SSH
+// (remoteHost) should pin it. root is refused, not resolved: the instance
+// accounts join this account's group, and group root is not a read grant to hand a tenant.
+// Validated because it is interpolated into shell commands and unit files.
+const UNIX_ACCOUNT_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+function appUser({ env = process.env, userInfo = os.userInfo } = {}) {
+  let name = String(env.PROVISION_APP_USER || '').trim();
+  if (!name) {
+    try { name = userInfo().username; } catch { name = ''; } // a uid with no passwd entry
+  }
+  if (name === 'root' || !UNIX_ACCOUNT_RE.test(name)) {
+    const why = name === 'root' ? 'is root' : 'is not a usable unix account name';
+    throw new Error(`provisioning: the app user ${JSON.stringify(name)} ${why} — set PROVISION_APP_USER to the unprivileged account that owns this checkout`);
+  }
+  return name;
+}
+// The app user's PRIMARY group, looked up by the shell on the box the command runs on. It
+// need not share the account's name (a service account created into `users`), so it is
+// never spelled as the account name.
+function appGroupExpr() { return `$(id -gn ${appUser()})`; }
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
 // WHERE THE INSTANCE THIS CORE SERVES ACTUALLY LIVES (task 1004123).
 //
@@ -145,7 +169,7 @@ function standaloneRegenDocsCmd() { return `node ${CORE_PKG_DIR}/scripts/gds/reg
 // ── Per-instance identity: its OWN unix account + its OWN password-authed PG role ──
 // (task 1003369, audit ref B3 of the 2026-08-29 security audit.)
 //
-// THE HOLE THIS CLOSES. Every instance service used to run `User=lars/Group=lars`, and
+// THE HOLE THIS CLOSES. Every instance service used to run as the one shared app user, and
 // co-tenant is the DEFAULT shape — so on a shared box every instance ran as the SAME
 // unix user. A unix user may read /proc/<pid>/environ of its own processes, which means
 // any instance could read every SIBLING's environment: GITHUB_APP_PRIVATE_KEY, the
@@ -223,7 +247,7 @@ function ensureInstanceUserCmd(inst, { privileged = false } = {}) {
 // NOT re-open the two vectors this task closes: /proc/<pid>/environ stays readable only
 // by the process's own uid, and the DB now demands a password no sibling holds.
 function grantInstanceRepoReadCmd(inst, { privileged = false } = {}) {
-  return `${privileged ? 'sudo ' : ''}usermod -aG ${APP_USER} ${instanceUser(inst)}`;
+  return `${privileged ? 'sudo ' : ''}usermod -aG ${appGroupExpr()} ${instanceUser(inst)}`;
 }
 
 // Can this plane give a child instance its OWN unix account AT ALL? (task 1004018, ADR 0317)
@@ -758,7 +782,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     } else {
       writeFile(giPath, INSTANCE_GITIGNORE);
     }
-    exec(`git -C ${root} config user.name "Cloud Bongos"`);
+    exec(`git -C ${root} config user.name "${provisionerBotName()}"`);
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);
     const commitMsg = mode === 'adopt'
@@ -1012,7 +1036,7 @@ function buildCorePinRefreshCommit({ root, fromVersion, toVersion, repo, ownerTo
     : `git -C ${root} push origin main`;
   return {
     config: [
-      `git -C ${root} config user.name "Cloud Bongos"`,
+      `git -C ${root} config user.name "${provisionerBotName()}"`,
       `git -C ${root} config user.email "${provisionerBotEmail()}"`,
     ],
     add: `git -C ${root} add -A`,
@@ -1094,7 +1118,8 @@ async function refreshStandaloneCorePin(inst, deps) {
 // cwd, deploy-instance.sh §4); co-tenant/dedicated run this control-plane checkout's src/.
 
 module.exports = {
-  APP_USER,
+  appGroupExpr,
+  appUser,
   accountPlaneGap,
   accountPreflight,
   CORE_PKG_DIR,

package/scripts/gds/provision-units.js

@@ -11,7 +11,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { APP_USER, CORE_PKG_DIR, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
+const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanceUser, parseTargetRef, standaloneRoot } = require('./provision-repo.js');
 
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
@@ -103,8 +103,8 @@ Requires=postgresql.service
 
 [Service]
 Type=oneshot
-User=${APP_USER}
-Group=${APP_USER}
+User=${appUser()}
+# No Group=: systemd then uses the app user's primary group, whatever it is named.
 # The DB to dump + where dumps land — set on the unit (not via the instance web.env)
 # so the dump targets the right database with no fallback to a stale default (root
 # cause of the task-2210 breakage). db-backup-nightly.sh reads both as env.

package/scripts/gds/provision.js

@@ -26,7 +26,7 @@
 //     WOULD run and mutates nothing (no DB writes, no shell, no cloud call). The
 //     LIVE leg is an explicit operator/timer `--apply`.
 //   • PRIVILEGE model (task 2066, ADR 0128). The intent runner runs as a NON-root
-//     user (User=lars) with passwordless sudo, which cannot itself write under /etc,
+//     user (the app user) with passwordless sudo, which cannot itself write under /etc,
 //     reload systemd/Caddy, or peer-auth to Postgres as a superuser. PROVISION_SUDO=1
 //     escalates exactly those steps (sudo install / sudo systemctl / sudo -u postgres);
 //     default OFF = bare commands (root / test / co-tenant-legacy contexts unchanged).
@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, accountPreflight, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { accountPreflight, appGroupExpr, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
@@ -282,6 +282,9 @@ async function provisionInstance(inst, deps) {
   // useradd would crash mid-provision instead of refusing.
   const accountGap = accountPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, privileged, probe: deps.accountPlaneGap });
   if (accountGap) return { ok: false, error: accountGap };
+  // App-user preflight (task 1002719): steps below name the app user, and appUser() refuses
+  // root or an unusable name. Refuse HERE, before the status flip, not midway through.
+  try { appUser(); } catch (e) { return { ok: false, error: e.message }; }
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
@@ -640,7 +643,7 @@ runcmd:
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
   - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-${roleLines}  - [ bash, -lc, "install -d -o ${APP_USER} -g ${APP_USER} -m 0750 ${CONFIG.backupDir}" ]
+${roleLines}  - [ bash, -lc, "install -d -o ${appUser()} -g ${appGroupExpr()} -m 0750 ${CONFIG.backupDir}" ]
   - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
 `;
 }

package/scripts/gds/stray-unit-sweep.sh

@@ -13,6 +13,7 @@
 # Run on the control plane as a sudoer:
 #   bash scripts/gds/stray-unit-sweep.sh            # survey only — read-only
 #   bash scripts/gds/stray-unit-sweep.sh --apply    # disable --now, remove the unit files, reload, reset-failed
+# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
 #
 # Left in place on purpose, even with --apply: the project's database, its dumps under
 # /var/backups/gds, any checkout, and its Caddy block — data is precious, and the address is
@@ -23,10 +24,22 @@ APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
 DB="${PGDATABASE:-cloudbongos}"
 ETC=/etc/systemd/system
 
-# The torn-down slugs, from the ledger, read as the instance user (peer auth — the runner's
+# The app account (task 1004135) — never a named person: PROVISION_APP_USER, else the owner
+# of the instance checkout, found the way address-park-sweep.sh finds it (three levels up
+# from an instance's vendored core; from anywhere else INSTANCE_DIR names it). A clone in an
+# operator's own home must not decide it. root is refused: it holds no Postgres role here.
+CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
+[ -n "${PROVISION_APP_USER:-}${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout (or PROVISION_APP_USER) — this sweep is not running from one"; exit 1; }
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null)}"
+if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
+  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns ${INSTANCE_DIR:-the instance checkout}"; exit 1
+fi
+
+# The torn-down slugs, from the ledger, read as the app account (peer auth — the runner's
 # own identity; nothing here needs a superuser).
-slugs=$(sudo -n -u lars psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as lars"; exit 1; }
+slugs=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAc "select slug from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
+  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
 
 found=(); cleared=()
 echo "== torn-down rows that still have systemd units =="

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.937'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.939'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_runner.mjs

@@ -38,6 +38,9 @@ const P = require('../modules/provisioning/provisioning.js');
 const G = require('../modules/provisioning/control-plane-guard.js');
 const RP = require('../scripts/gds/provision-repo.js');
 
+// task 1002719: the app user is derived, so pin one that is nobody's real account.
+process.env.PROVISION_APP_USER = 'appsvc';
+
 let passed = 0;
 let failed = 0;
 const t = async (name, fn) => {
@@ -433,7 +436,7 @@ await t('the control plane upgrades as the operator account, never as root', asy
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos', port: 3002 }), d, intent());
   const cmd = upgradeCall(d);
-  assert.match(cmd, /sudo -u lars /, 'runs as the operator account');
+  assert.match(cmd, /sudo -u appsvc /, 'runs as the operator account');
   assert.doesNotMatch(cmd, /sudo node /, 'a bare `sudo node` is the bug — it lands on root');
 });
 
@@ -442,7 +445,7 @@ await t('a tenant upgrades as its OWN account, which is also its Postgres login
   await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
   assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
-  assert.doesNotMatch(cmd, /sudo -u lars /, 'one tenant must never be upgraded under another account');
+  assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
 });
 
 await t('the database is NAMED, not discovered — an adopted repo has no core at its root to ask', async () => {
@@ -691,7 +694,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   // is reported rather than silently papered over.
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'standalone', slug: 'test4' }), d);
-  assert.equal(r.runAs, 'lars');
+  assert.equal(r.runAs, 'appsvc');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
 });
@@ -699,7 +702,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
 await t('the control plane is never probed — it has no instance account by design', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'lars', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'appsvc', fellBack: false });
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
 });
 
@@ -707,7 +710,7 @@ await t('the dry run is invoked as the account that actually exists', async () =
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
-  assert.match(cmd, /sudo -u lars /, `must not sudo to an account that does not exist — got: ${cmd}`);
+  assert.match(cmd, /sudo -u appsvc /, `must not sudo to an account that does not exist — got: ${cmd}`);
   assert.doesNotMatch(cmd, /bongos-test4/);
 });
 
@@ -715,7 +718,7 @@ await t('the MOVE probes identically, so preview and move cannot diverge on the
   const d = acctDeps({ accountExists: false });
   await R.coreUpgradeInstance(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), d, intent());
   const cmd = (d.ranWith.find((c) => /upgrade\.js/.test(c.cmd)) || {}).cmd || '';
-  assert.match(cmd, /sudo -u lars /, 'the move follows the same probe as the preview');
+  assert.match(cmd, /sudo -u appsvc /, 'the move follows the same probe as the preview');
 });
 
 await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly widening it', () => {
@@ -789,7 +792,7 @@ await t('a ✖ line still wins over the raw tail', async () => {
 await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'standalone', slug: 'test4', port: 3006 }), '1.19.762', d);
-  assert.equal(v.ran_as, 'lars');
+  assert.equal(v.ran_as, 'appsvc');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 

package/tests/provision.mjs

@@ -18,6 +18,8 @@ import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
+const AP = require('../scripts/gds/instance-apex.js');
+const RP = require('../scripts/gds/provision-repo.js');
 
 // The env-var prefix a provisioned instance resolves = the envPrefix an instance INHERITS from
 // the neutral pack (task 1003740: webEnvBody no longer pins a branding pack anywhere — the
@@ -40,6 +42,11 @@ process.env.PROVISION_GIT_SSH_ALIAS = 'github-deploy';
 // The probe itself is covered directly, with an injected fs.
 process.env.PROVISION_PROCESS_MANAGER = 'systemd';
 
+// And the app user (task 1002719): unpinned it is whoever runs the suite. Pinned to a name
+// that is nobody's real account, so an assertion passes only if the value came through the
+// resolver — a leftover literal cannot produce it.
+process.env.PROVISION_APP_USER = 'appsvc';
+
 let passed = 0, failed = 0;
 function t(name, fn) {
   try { fn(); passed++; console.log(`  PASS  ${name}`); }
@@ -167,11 +174,16 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
   // must not attribute its commits to the hub. Assert against the resolver so
   // this pins the behaviour, not one instance's literal.
   assert.deepEqual(withTok.config, [
-    'git -C /srv/bongos/spike-harbor config user.name "Cloud Bongos"',
+    `git -C /srv/bongos/spike-harbor config user.name "${AP.provisionerBotName()}"`,
     `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
   assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
   assert.doesNotMatch(P.provisionerBotEmail({}), /example/i, 'never a founder-host address');
+  // task 1002719: the NAME comes from the pack too, and one the shell cannot quote falls back.
+  assert.equal(AP.provisionerBotName('Acme Forge'), 'Acme Forge', 'the pack\'s product name');
+  for (const unsafe of ['Acme "Forge"', 'a$(id)', 'a`id`', 'a\\b', 'a\nb', '']) {
+    assert.equal(AP.provisionerBotName(unsafe), 'Cloud Bongos', `falls back on ${JSON.stringify(unsafe)}`);
+  }
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);
@@ -199,7 +211,7 @@ t('backup units: per-instance names + the DB set on the unit (fixes the task-221
   // the DB is pinned on the unit → no fallback to the nonexistent example default
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
   assert.match(svc, /Environment=GDS_BACKUP_DIR=\/var\/backups\/gds/);
-  assert.match(svc, new RegExp(`User=${reEsc('lars')}`), 'runs as the app user (mirrors serviceUnit)');
+  assert.match(svc, new RegExp(`User=${reEsc('appsvc')}`), 'runs as the app user (mirrors serviceUnit)');
   assert.match(svc, /ReadWritePaths=\/var\/backups\/gds/, 'the only writable path is the backup dir');
   const timer = P.backupTimer(coTenant);
   assert.match(timer, /OnCalendar=\*-\*-\* 04:00:00 UTC/);
@@ -466,7 +478,7 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote systemd unit');
   assert.ok(writes.some((w) => /\/mercury\.caddy$/.test(w)), 'wrote per-instance Caddy snippet');
   // task 2213: EVERY instance is born with backups — dir + per-instance timer/service
-  assert.match(joined, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
+  assert.match(joined, /install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
   assert.match(joined, /systemctl enable --now mercury-db-backup\.timer/, 'enables the per-instance backup timer');
   assert.ok(writes.some((w) => /\/mercury-db-backup\.service$/.test(w)), 'wrote backup service unit');
   assert.ok(writes.some((w) => /\/mercury-db-backup\.timer$/.test(w)), 'wrote backup timer unit');
@@ -626,7 +638,8 @@ t('systemd manager: emits byte-identical commands + unit paths to the inline str
   PM.systemd.installBackup(INST, io2);
   // The backup DIR moved in here with the schedule it serves: a manager that installs no
   // schedule must not create it either. Order is unchanged — dir, units, reload, enable.
-  assert.match(io2.cmds[0], /^sudo install -d -o \S+ -g \S+ -m 0750 /);
+  // The group is the app user's PRIMARY group, looked up on the box (task 1002719).
+  assert.match(io2.cmds[0], /^sudo install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 /);
   assert.deepEqual(io2.cmds.slice(1), ['sudo systemctl daemon-reload', 'sudo systemctl enable --now demo-db-backup.timer']);
   assert.deepEqual(io2.files.map((f) => f.path),
     ['/etc/systemd/system/demo-db-backup.service', '/etc/systemd/system/demo-db-backup.timer']);
@@ -1329,7 +1342,7 @@ await ta('dedicatedUserData bakes the nightly backup: unit files (b64) + dir + t
   const b64 = cloudInit.match(/content: ([A-Za-z0-9+/=]+)/)[1];
   assert.match(Buffer.from(b64, 'base64').toString('utf8'), /Environment=GDS_BACKUP_DB=mercury/);
   // and the dir is created + the timer enabled on first boot
-  assert.match(cloudInit, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/);
+  assert.match(cloudInit, /install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 \/var\/backups\/gds/);
   assert.match(cloudInit, /enable --now mercury mercury-db-backup\.timer/);
 });
 
@@ -2932,7 +2945,31 @@ t('ensureInstanceUserCmd: idempotent SYSTEM account, nologin, state dir re-asser
 });
 
 t('grantInstanceRepoReadCmd: adds the instance account to the app-user group so the unit can exec its WorkingDirectory', () => {
-  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG lars bongos-mercury');
+  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG $(id -gn appsvc) bongos-mercury');
+});
+
+t('appUser: PROVISION_APP_USER, else the account the runner runs as — never a named founder (task 1002719)', () => {
+  const runner = (username) => () => ({ username });
+  assert.equal(RP.appUser({ env: { PROVISION_APP_USER: 'ops' }, userInfo: runner('deploy') }), 'ops', 'the pin wins');
+  assert.equal(RP.appUser({ env: {}, userInfo: runner('deploy') }), 'deploy', "unpinned: the runner's own account");
+  assert.equal(RP.appUser(), 'appsvc', 'the suite pin is what every generator above rendered');
+});
+
+t('appUser: refuses root and any name a shell command or unit file could not carry', () => {
+  const runner = (username) => () => ({ username });
+  assert.throws(() => RP.appUser({ env: {}, userInfo: runner('root') }), /is root — set PROVISION_APP_USER/);
+  assert.throws(() => RP.appUser({ env: {}, userInfo: () => { throw new Error('ENOENT'); } }),
+    /"" is not a usable unix account name/, 'a uid with no passwd entry names the knob');
+  for (const bad of ['a b', 'x;rm -rf /', '$(id)', 'Admin', '-o', 'a'.repeat(33)]) {
+    assert.throws(() => RP.appUser({ env: { PROVISION_APP_USER: bad }, userInfo: runner('deploy') }),
+      /not a usable unix account name/, `refuses ${JSON.stringify(bad)}`);
+  }
+  // …and the generators go through it rather than rendering the bad value.
+  process.env.PROVISION_APP_USER = 'root';
+  try {
+    assert.throws(() => P.backupService(coTenant), /is root/);
+    assert.throws(() => P.grantInstanceRepoReadCmd(coTenant), /is root/);
+  } finally { process.env.PROVISION_APP_USER = 'appsvc'; }
 });
 
 t('dbRoleCmd: LOGIN + password, upserted — CREATE on a fresh box, ALTER on a re-provision (the rotation path)', () => {
@@ -3052,7 +3089,7 @@ t('dedicatedUserData: the droplet runs the SAME account + role steps, in the sam
   const ud = P.dedicatedUserData(coTenant);
   const at = (needle) => ud.indexOf(needle);
   assert.ok(at('useradd --system') > -1, 'the droplet creates the account too');
-  assert.ok(at('usermod -aG lars') > -1);
+  assert.ok(at('usermod -aG $(id -gn appsvc)') > -1);
   assert.ok(at('useradd --system') < at('createdb mercury'), 'account before the DB');
   assert.ok(at('migrate.sh') < at('CREATE ROLE %I'), 'the role grants must follow the migrate that created the tables');
   assert.ok(at('CREATE ROLE %I') < at('GRANT ALL ON ALL TABLES'), 'role before its grants');

package/tests/provision_account_identity.mjs

@@ -12,6 +12,9 @@ const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
 const { accountPlaneGap, accountPreflight } = require('../scripts/gds/provision-repo.js');
 
+// The app user is derived from whoever runs the suite unless pinned (task 1002719).
+process.env.PROVISION_APP_USER = 'appsvc';
+
 const PROBE = `sh -c 'test "$(id -u)" = 0'`;
 const isRoot = () => ({ ok: true, stdout: '' });
 // What a shell that RAN reports: exit 1 from `test`, or 127 when sudo is not installed.
@@ -133,3 +136,16 @@ test('provision: a box where the runner reaches root is unchanged — the live s
   const idx = (re) => h.cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/id -u.*= 0/) < idx(/useradd --system/), 'the probe precedes the account it guards');
 });
+
+test('provision: an app user that resolves to root is refused before a single write (task 1002719)', async () => {
+  const h = harness();
+  process.env.PROVISION_APP_USER = 'root';   // what an unpinned runner running as root resolves
+  try {
+    const r = await P.provisionInstance(coTenant, h.deps);
+    assert.equal(r.ok, false);
+    assert.match(r.error, /is root — set PROVISION_APP_USER/);
+    assert.ok(!h.ran(/useradd/), 'refused before step 1c makes an account the run could not finish');
+    assert.equal(h.writes.length, 0);
+    assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+  } finally { process.env.PROVISION_APP_USER = 'appsvc'; }
+});

package/tests/sweep_app_account.mjs

@@ -0,0 +1,112 @@
+// tests/sweep_app_account.mjs — the two backfill sweeps act as the plane's app account,
+// never a named person (task 1004135). Both used to `sudo -u <founder>`, so a second
+// operator who ran them got `sudo: unknown user`.
+//
+// Behavioural: each sweep runs under bash with stub `sudo` / `stat` / `systemctl` first on
+// PATH. The sudo stub records its argv and answers nothing (an empty ledger), so the
+// assertion is on the account the script actually asked for. Nothing touches a box.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const skip = spawnSync('bash', ['-c', 'true']).error ? 'bash not on PATH' : false;
+const slash = (p) => p.replace(/\\/g, '/');
+
+function stubs() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-stubs-'));
+  const sudoLog = slash(path.join(dir, 'sudo.log'));
+  const statLog = slash(path.join(dir, 'stat.log'));
+  const bin = (name, body) => fs.writeFileSync(path.join(dir, name), `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
+  bin('sudo', `echo "$*" >> "${sudoLog}"; exit 0`);
+  bin('stat', `echo "$*" >> "${statLog}"; echo checkout-owner`);
+  bin('systemctl', 'exit 0');
+  const lines = (f) => (fs.existsSync(f) ? fs.readFileSync(f, 'utf8').split('\n').filter(Boolean) : []);
+  return { dir, sudo: () => lines(sudoLog), stat: () => lines(statLog) };
+}
+
+function run(scriptPath, s, env = {}) {
+  const base = { ...process.env };
+  delete base.PROVISION_APP_USER;
+  delete base.INSTANCE_DIR;
+  return spawnSync('bash', [slash(scriptPath)], {
+    cwd: REPO, encoding: 'utf8',
+    env: { ...base, ...env, PATH: `${s.dir}${path.delimiter}${process.env.PATH}` },
+  });
+}
+
+const STRAY = path.join(REPO, 'scripts', 'gds', 'stray-unit-sweep.sh');
+const PARK = path.join(REPO, 'scripts', 'gds', 'address-park-sweep.sh');
+
+test('stray-unit-sweep: PROVISION_APP_USER is the account the ledger is read as', { skip }, () => {
+  const s = stubs();
+  run(STRAY, s, { PROVISION_APP_USER: 'appsvc' });
+  assert.match(s.sudo()[0] || '', /^-n -u appsvc psql /);
+  assert.equal(s.stat().length, 0, 'a pin is not second-guessed');
+});
+
+test('stray-unit-sweep: unpinned outside a vendored core, it refuses rather than trust whoever owns this clone', { skip }, () => {
+  const s = stubs();
+  const r = run(STRAY, s);
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /set INSTANCE_DIR/);
+  assert.deepEqual(s.stat(), [], 'the clone\'s owner was never asked');
+  assert.deepEqual(s.sudo(), []);
+});
+
+test('stray-unit-sweep: INSTANCE_DIR names the checkout whose owner acts', { skip }, () => {
+  const s = stubs();
+  const inst = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-inst-'));
+  run(STRAY, s, { INSTANCE_DIR: slash(inst) });
+  assert.match(s.stat()[0] || '', new RegExp(`^-c %U .*${path.basename(inst)}$`));
+  assert.match(s.sudo()[0] || '', /^-n -u checkout-owner psql /);
+});
+
+test('stray-unit-sweep: root is refused before anything runs', { skip }, () => {
+  const s = stubs();
+  const r = run(STRAY, s, { PROVISION_APP_USER: 'root' });
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /cannot use 'root' as the app account — set PROVISION_APP_USER/);
+  assert.deepEqual(s.sudo(), [], 'sudo never asked');
+});
+
+test('address-park-sweep: outside a vendored core, INSTANCE_DIR must be named — no founder-home default', { skip }, () => {
+  const s = stubs();
+  const r = run(PARK, s);
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /set INSTANCE_DIR/);
+  assert.deepEqual(s.sudo(), []);
+});
+
+test('address-park-sweep: root is refused before anything runs', { skip }, () => {
+  const s = stubs();
+  const r = run(PARK, s, { INSTANCE_DIR: slash(os.tmpdir()), PROVISION_APP_USER: 'root' });
+  assert.equal(r.status, 1);
+  assert.match(r.stdout, /cannot use 'root' as the app account — set PROVISION_APP_USER/);
+  assert.deepEqual(s.sudo(), [], 'sudo never asked');
+});
+
+test('address-park-sweep: every sudo hop uses the pinned account', { skip }, () => {
+  const s = stubs();
+  run(PARK, s, { INSTANCE_DIR: slash(os.tmpdir()), PROVISION_APP_USER: 'appsvc' });
+  const hops = s.sudo().filter((l) => / -u /.test(l));
+  assert.ok(hops.length >= 2, `the ledger read and the core load both ran — got ${JSON.stringify(s.sudo())}`);
+  for (const h of hops) assert.match(h, /^-n -u appsvc /);
+});
+
+for (const [name, src] of [['address-park-sweep', PARK], ['stray-unit-sweep', STRAY]]) {
+  test(`${name}: run from an instance's vendored core, the instance is three levels up and its owner acts`, { skip }, () => {
+    const s = stubs();
+    const inst = fs.mkdtempSync(path.join(os.tmpdir(), 'sweep-inst-'));
+    const gds = path.join(inst, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gds, { recursive: true });
+    fs.copyFileSync(src, path.join(gds, `${name}.sh`));
+    run(path.join(gds, `${name}.sh`), s);
+    assert.match(s.stat()[0] || '', new RegExp(`^-c %U .*${path.basename(inst)}$`), 'the instance root, not the package');
+    assert.match(s.sudo()[0] || '', /^-n -u checkout-owner psql /);
+  });
+}