@bongos/core 1.19.975 → 1.19.977

package/tests/github_repos_helpers.mjs

@@ -8,6 +8,7 @@
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -139,10 +140,9 @@ test('getUserRepo: 404 → typed repo_not_found (GitHub\'s own no-leak shape, fo
   );
 });
 
-test('makeRepoPublic: PATCHes exactly {private:false} — the private direction is structurally impossible', async () => {
-  // Like createUserRepo's private:false, the direction is deliberately not a
-  // parameter: the deploy pull runs as the shared deploy key that cannot read a
-  // private repo (N4), so nothing in the codebase may flip a repo private.
+test('makeRepoPublic: PATCHes exactly {private:false} — the name is the direction', async () => {
+  // Like createUserRepo's private:false, the direction is not a parameter: each
+  // direction is its own named function, so no caller can send one it did not mean.
   let sentMethod = '';
   let sentBody = null;
   const fetchImpl = async (url, init) => {
@@ -164,6 +164,57 @@ test('makeRepoPublic: 403 → typed not_repo_admin', async () => {
   );
 });
 
+// ---- the private direction (task 1004193, split (b) of task 1003078) ----
+
+test('makeRepoPrivate: PATCHes exactly {private:true} to the same endpoint', async () => {
+  // Arrange
+  let sentUrl = '';
+  let sentMethod = '';
+  let sentBody = null;
+  const fetchImpl = async (url, init) => {
+    sentUrl = url; sentMethod = init.method; sentBody = JSON.parse(init.body);
+    return res(200, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, permissions: { admin: true } });
+  };
+  // Act
+  const out = await gh.makeRepoPrivate('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  // Assert
+  assert.equal(sentMethod, 'PATCH');
+  assert.match(sentUrl, /\/repos\/me\/mercury$/);
+  assert.deepEqual(sentBody, { private: true });
+  assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, admin: true });
+});
+
+test('makeRepoPrivate: 403 → typed not_repo_admin, the same mapping as the public direction', async () => {
+  const fetchImpl = async () => res(403, { message: 'Must have admin rights' });
+  await assert.rejects(
+    () => gh.makeRepoPrivate('tok', { owner: 'other', name: 'repo', fetchImpl }),
+    (e) => e.code === 'not_repo_admin' && e.status === 403,
+  );
+});
+
+test('the shared visibility PATCH is not exported — only the two named directions are', () => {
+  assert.equal(typeof gh.makeRepoPublic, 'function');
+  assert.equal(typeof gh.makeRepoPrivate, 'function');
+  const visibilityExports = Object.keys(gh).filter((k) => /private|public|visibility/i.test(k)).sort();
+  assert.deepEqual(visibilityExports, ['makeRepoPrivate', 'makeRepoPublic'],
+    'a direction parameter on an export would let a caller flip private without the deploy-key wiring');
+});
+
+test('no web route may call makeRepoPrivate — only the runner flips a repo private, after wiring its key', () => {
+  // ADR 0176 / walk finding N4: flipping before the project's own deploy key is wired
+  // breaks its next deploy pull, and only the control-plane runner can wire that key.
+  const routeDirs = ['src/bongos/routes', 'modules/provisioning/routes'];
+  const offenders = [];
+  for (const dir of routeDirs) {
+    const abs = path.join(ROOT, dir);
+    if (!fs.existsSync(abs)) continue;
+    for (const f of fs.readdirSync(abs).filter((n) => n.endsWith('.js'))) {
+      if (/makeRepoPrivate/.test(fs.readFileSync(path.join(abs, f), 'utf8'))) offenders.push(`${dir}/${f}`);
+    }
+  }
+  assert.deepEqual(offenders, []);
+});
+
 // ---- deploy-key helpers (task 1002735 / ADR 0176) ----
 
 test('listDeployKeys: GETs /repos/{owner}/{name}/keys, maps id/title/key/read_only', async () => {

package/tests/missing_dep_classify.mjs

@@ -0,0 +1,108 @@
+// tests/missing_dep_classify.mjs — the PURE missing-dependency detector core
+// (task 1002827), moved out of scripts/gds/audit-deps.js so a live route can
+// reuse it without pulling that script's CLI-only machinery into the server
+// process.
+//
+// tests/audit_deps.mjs already pins findMissingDeps/classify's BEHAVIOR
+// (unchanged by the move — it still imports them from audit-deps.js, which
+// now re-exports this module's names). This file instead pins the three
+// things that changed or were added: the module boundary (a module may reach
+// touchesOverlap only through the src/module-api.js doorway, never a deep
+// core require), the pure surface being intact post-move, and `candidateEdge`
+// — the ONE per-pair predicate findMissingDeps and dependency-advisory.js's
+// live adviseDependencies both call now, so neither re-types it.
+//
+// Run: node tests/missing_dep_classify.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { OPEN, isUnshippedBlocker, HOTSPOTS, classify, candidateEdge, findMissingDeps } =
+  require('../modules/lifecycle/missing-dep-classify.js');
+
+const { test, summary } = makeRunner();
+
+await test('OPEN names exactly the four auditable statuses', () => {
+  assert.deepEqual([...OPEN].sort(), ['active', 'backlog', 'blocked', 'ready']);
+});
+
+await test('isUnshippedBlocker: only shipped/abandoned are terminal', () => {
+  assert.equal(isUnshippedBlocker('shipped'), false);
+  assert.equal(isUnshippedBlocker('abandoned'), false);
+  assert.equal(isUnshippedBlocker('ready'), true);
+  assert.equal(isUnshippedBlocker('backlog'), true);
+});
+
+await test('classify: an exact non-hotspot file match is high confidence', () => {
+  const c = classify(['modules/foo/bar.js'], ['modules/foo/bar.js']);
+  assert.equal(c.confidence, 'high');
+});
+
+await test('classify: a hotspot-only overlap is low confidence', () => {
+  const c = classify(['CLAUDE.md'], ['CLAUDE.md']);
+  assert.equal(c.confidence, 'low');
+});
+
+await test('classify: no overlap at all returns null', () => {
+  assert.equal(classify(['a.js'], ['b.js']), null);
+});
+
+await test('findMissingDeps re-exported unchanged: a live example still flags', () => {
+  const tasks = [
+    { id: 1, status: 'ready', touches: ['modules/x/y.js'], dependencies: [] },
+    { id: 2, status: 'backlog', touches: ['modules/x/y.js'], dependencies: [] },
+  ];
+  assert.equal(findMissingDeps(tasks).length, 2);
+});
+
+// ---- candidateEdge: the ONE per-pair predicate, shared by findMissingDeps
+// and dependency-advisory.js's adviseDependencies (grade round 1 finding) ----
+
+await test('candidateEdge: an overlapping open non-dep is a real edge', () => {
+  const e = candidateEdge(
+    { id: 1, touches: ['modules/x/y.js'] },
+    { id: 2, status: 'ready', touches: ['modules/x/y.js'] },
+  );
+  assert.equal(e.task_id, 1);
+  assert.equal(e.dep_id, 2);
+  assert.equal(e.confidence, 'high');
+});
+
+await test('candidateEdge: null on self, terminal status, no touches, or an already-declared dep', () => {
+  const t = { id: 1, touches: ['a.js'], dependencies: ['2'] };
+  assert.equal(candidateEdge(t, { id: 1, status: 'ready', touches: ['a.js'] }), null, 'self');
+  assert.equal(candidateEdge(t, { id: 3, status: 'shipped', touches: ['a.js'] }), null, 'terminal');
+  assert.equal(candidateEdge(t, { id: 3, status: 'ready', touches: [] }), null, 'no touches');
+  assert.equal(candidateEdge(t, { id: 2, status: 'ready', touches: ['a.js'] }), null, 'already declared');
+});
+
+await test('candidateEdge: an explicit `declared` set is used instead of re-deriving from t.dependencies', () => {
+  const t = { id: 1, touches: ['a.js'], dependencies: [] };
+  const e = candidateEdge(t, { id: 2, status: 'ready', touches: ['a.js'] }, { declared: new Set(['2']) });
+  assert.equal(e, null, 'the passed-in declared set wins over the empty t.dependencies');
+});
+
+await test('candidateEdge runs classify exactly once — no separate touchesOverlap pre-check to duplicate', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/missing-dep-classify.js', import.meta.url), 'utf8');
+  const body = src.slice(src.indexOf('function candidateEdge'), src.indexOf('function findMissingDeps'));
+  assert.equal((body.match(/classify\(/g) || []).length, 1, 'exactly one classify() call in candidateEdge');
+  assert.equal(/touchesOverlap\(/.test(body), false, 'no redundant overlap pre-check — classify already answers that');
+});
+
+await test('the module reaches touchesOverlap through the module-api doorway, never a deep core require', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/missing-dep-classify.js', import.meta.url), 'utf8');
+  assert.match(src, /require\('\.\.\/\.\.\/src\/module-api'\)/, 'reaches core via the doorway');
+  assert.equal(/require\(['"]\.\.\/\.\.\/src\/bongos\//.test(src), false, 'never a direct src/bongos/* require (ADR 0083)');
+});
+
+await test('scripts/gds/audit-deps.js delegates to this module rather than redefining the pure core', () => {
+  const src = readFileSync(new URL('../scripts/gds/audit-deps.js', import.meta.url), 'utf8');
+  assert.match(src, /require\('\.\.\/\.\.\/modules\/lifecycle\/missing-dep-classify\.js'\)/);
+  assert.equal(/^function classify/m.test(src), false, 'classify is no longer redefined here');
+  assert.equal(/^function findMissingDeps/m.test(src), false, 'findMissingDeps is no longer redefined here');
+});
+
+summary();

package/tests/provision_repo_private.mjs

@@ -0,0 +1,260 @@
+// tests/provision_repo_private.mjs
+//
+// Split (b) of task 1003078 (task 1004193, ADR 0176): the `repo-private` provisioning
+// intent — its queue seam (modules/provisioning/repo-private.js), its runner leg
+// (scripts/gds/provision-repo-private.js) and the run-intents dispatch that reaches it.
+// Hermetic — exec, db and GitHub are recording fakes; no shell, no DB, no network.
+//
+// The load-bearing assertions:
+//   • ORDER: the project's own deploy key is registered and the checkout re-pointed at it
+//     BEFORE the repository is flipped private. Flip first and the next deploy pull fails
+//     with the shared key (walk finding N4) — this is the whole point of the task
+//   • the wiring is asked for as a PRE-flip wiring (intendedPrivate), because GitHub still
+//     answers "public" at that moment and the un-told wiring would do nothing
+//   • any failure BEFORE the flip leaves the repository untouched — no PATCH is sent
+//   • every expected failure is ok:false (retried), never a throw, so a running project is
+//     never relabelled 'error' by a flip that could not happen
+//   • non-standalone and not-yet-live projects are refused without touching GitHub
+//   • dry-run calls GitHub not at all
+//   • the queue seam: idempotent on its own kind, conflicts with any other open intent
+//
+// Run:  node tests/provision_repo_private.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { repoPrivateInstance } = require('../scripts/gds/provision-repo-private.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const { enqueueRepoPrivate } = require('../modules/provisioning/repo-private.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const liveStandalone = { id: 18, slug: 'demo', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7, target_ref: 'example-owner/demo' };
+
+// One ordered timeline across the shell AND GitHub, so the wire-before-flip order is
+// observable as positions in a single list rather than inferred from two.
+function recorder({ apply = true, token = 'gho_TOK', flipFails = null, getFails = null } = {}) {
+  const timeline = [], events = [], logs = [];
+  const deps = {
+    apply, log: (l) => logs.push(String(l)),
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: { recordEvent: async (_db, ev) => { events.push(ev); } },
+    exec: (cmd) => { timeline.push(['exec', cmd]); return { ok: true, stdout: '' }; },
+    getGithubToken: async () => (token ? { token, scope: 'read:user,repo' } : null),
+    fsImpl: { existsSync: () => false, readFileSync: () => 'ssh-ed25519 AAAAlocal cloudbongos-deploy-demo\n' },
+    githubRepos: {
+      getUserRepo: async (_t, a) => {
+        timeline.push(['gh', 'get']);
+        if (getFails) throw getFails;
+        return { full_name: `${a.owner}/${a.name}`, private: false, admin: true };
+      },
+      listDeployKeys: async () => { timeline.push(['gh', 'list']); return []; },
+      addDeployKey: async (_t, a) => { timeline.push(['gh', 'add', a.readOnly]); return { id: 99, title: a.title, read_only: true }; },
+      deleteDeployKey: async () => { timeline.push(['gh', 'del']); return true; },
+      makeRepoPrivate: async (_t, a) => {
+        timeline.push(['gh', 'flip-private', `${a.owner}/${a.name}`]);
+        if (flipFails) throw flipFails;
+        return { full_name: `${a.owner}/${a.name}`, private: true, admin: true };
+      },
+    },
+  };
+  const at = (pred) => timeline.findIndex(pred);
+  return { deps, timeline, events, logs, at };
+}
+const isFlip = (e) => e[0] === 'gh' && e[1] === 'flip-private';
+
+console.log('\nrunner leg — wire FIRST, flip SECOND:');
+
+await ta('the deploy key is registered and the checkout re-pointed BEFORE the repository is flipped private', async () => {
+  // Arrange
+  const r = recorder();
+  // Act
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  // Assert
+  assert.equal(out.ok, true, JSON.stringify(out));
+  const flip = r.at(isFlip);
+  const add = r.at((e) => e[0] === 'gh' && e[1] === 'add');
+  const sshCmd = r.at((e) => e[0] === 'exec' && /config core\.sshCommand/.test(e[1]));
+  const origin = r.at((e) => e[0] === 'exec' && /remote set-url origin git@github\.com:example-owner\/demo\.git/.test(e[1]));
+  assert.ok(flip >= 0, 'the repository is flipped');
+  assert.ok(add >= 0 && add < flip, 'the key is registered before the flip');
+  assert.ok(origin >= 0 && origin < flip, 'origin points at the plain GitHub URL before the flip');
+  assert.ok(sshCmd >= 0 && sshCmd < flip, 'core.sshCommand uses the project key before the flip');
+  assert.equal(r.timeline.filter(isFlip).length, 1, 'exactly one flip');
+  assert.equal(r.timeline[flip][2], 'example-owner/demo', 'the flip targets the project repository');
+});
+
+await ta('the wiring is a PRE-flip wiring — it runs although GitHub still reports the repository public', async () => {
+  const r = recorder();
+  await repoPrivateInstance(liveStandalone, r.deps);
+  // Without intendedPrivate, ensurePrivateRepoAccess reads private:false and registers nothing.
+  const add = r.timeline.find((e) => e[0] === 'gh' && e[1] === 'add');
+  assert.ok(add, 'a key was registered for a repo GitHub still calls public');
+  assert.equal(add[2], true, 'and it is read-only');
+});
+
+await ta('the flip records an event on the project, after it happens', async () => {
+  const r = recorder();
+  await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(r.events.length, 1);
+  assert.equal(r.events[0].event, 'repo-private');
+  assert.equal(r.events[0].instanceId, 18);
+  assert.equal(r.events[0].ownerBuilderId, 7);
+  assert.equal(r.events[0].actor, 'runner');
+  assert.match(r.events[0].detail, /example-owner\/demo made private/);
+});
+
+console.log('\nrunner leg — a failure before the flip leaves the repository alone:');
+
+await ta('no stored credential: ok:false, no key and NO flip — the repository stays public', async () => {
+  const r = recorder({ token: null });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /cannot be made private[\s\S]*credential/i);
+  assert.equal(r.at(isFlip), -1, 'nothing was flipped');
+});
+
+await ta('GitHub unreachable during the wiring: ok:false (a retry), never a throw, and NO flip', async () => {
+  const r = recorder({ getFails: new Error('ECONNRESET') });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /could not be reached/);
+  assert.equal(r.at(isFlip), -1);
+});
+
+await ta('the flip itself refused (403): ok:false, says the repository is STILL public and a retry is safe', async () => {
+  const e = Object.assign(new Error('GitHub refused the change for this account'), { code: 'not_repo_admin', status: 403 });
+  const r = recorder({ flipFails: e });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /still public/);
+  assert.match(out.error, /cannot change this repository/);
+  assert.match(out.error, /trying again is safe/);
+  assert.equal(r.events.length, 0, 'no "made private" event for a flip that did not happen');
+});
+
+console.log('\nrunner leg — refusals that never reach GitHub:');
+
+for (const [label, inst, why] of [
+  ['a co-tenant project', { ...liveStandalone, hosting_shape: 'co-tenant' }, /shares its code checkout/],
+  ['a project that is not live yet', { ...liveStandalone, status: 'provisioning' }, /is provisioning, not running/],
+  ['a project with no repository on record', { ...liveStandalone, target_ref: null }, /no GitHub repository on record/],
+]) {
+  await ta(`${label}: ok:false with a plain reason, and no shell or GitHub call at all`, async () => {
+    const r = recorder();
+    const out = await repoPrivateInstance(inst, r.deps);
+    assert.equal(out.ok, false);
+    assert.match(out.error, why);
+    assert.deepEqual(r.timeline, []);
+  });
+}
+
+await ta('dry-run: plans the wire and the flip, and calls neither GitHub nor the shell', async () => {
+  const r = recorder({ apply: false });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, true);
+  assert.equal(out.planned, true);
+  assert.deepEqual(r.timeline, []);
+  assert.ok(r.logs.some((l) => /ABOUT TO BE MADE PRIVATE/.test(l)), 'the plan names the pre-flip wiring');
+  assert.ok(r.logs.some((l) => /would then make example-owner\/demo private/.test(l)), 'and the flip after it');
+});
+
+console.log('\nrun-intents dispatch:');
+
+function drainDeps({ flipFails = null } = {}) {
+  let claims = 0; const resolved = [], statusWrites = [], updates = [];
+  const r = recorder({ flipFails });
+  const deps = {
+    ...r.deps, sleep: async () => {},
+    db: { query: async (sql, params) => { if (/UPDATE provisioning_intents/.test(sql)) updates.push({ sql, params }); return { rows: [] }; } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 31, instance_id: 18, action: 'repo-private', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...liveStandalone }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  return { deps, r, resolved, statusWrites, updates };
+}
+
+await ta("cmdRunIntents (--apply) routes 'repo-private' to the leg and resolves it done", async () => {
+  const d = drainDeps();
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 0, JSON.stringify(out));
+  assert.deepEqual(d.resolved, [{ id: 31, state: 'done', err: null }]);
+  assert.equal(d.r.timeline.filter(isFlip).length, 1, 'it really reached the flip');
+});
+
+await ta('cmdRunIntents: a flip that fails re-pends with the reason, and never marks the running project broken', async () => {
+  const d = drainDeps({ flipFails: Object.assign(new Error('boom'), { code: 'github_error' }) });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 1);
+  assert.equal(d.resolved.length, 0, 'not resolved — it re-pends for a later tick');
+  assert.match(d.updates[0].sql, /state='pending'/);
+  assert.match(d.updates[0].params[1], /still public/, 'the owner-facing reason rides last_error');
+  assert.equal(d.statusWrites.length, 0, 'a running project is not relabelled error');
+});
+
+console.log('\nqueue seam — modules/provisioning/repo-private.js:');
+
+async function withEnqueue(fake, fn) {
+  const orig = provisioning.enqueueIntent;
+  provisioning.enqueueIntent = fake;
+  try { await fn(); } finally { provisioning.enqueueIntent = orig; }
+}
+
+await ta('a fresh request is queued as repo-private, carrying the actor', async () => {
+  const calls = [];
+  await withEnqueue(async (_db, id, action, by) => { calls.push({ id, action, by }); return { intent: { id: 1, action }, created: true }; }, async () => {
+    const out = await enqueueRepoPrivate({}, 18, 'api:self');
+    assert.equal(out.created, true);
+    assert.equal(out.conflict, undefined);
+    assert.deepEqual(calls, [{ id: 18, action: 'repo-private', by: 'api:self' }]);
+  });
+});
+
+await ta('an open repo-private makes a repeat idempotent — not a conflict', async () => {
+  await withEnqueue(async () => ({ intent: { id: 1, action: 'repo-private', state: 'running' }, created: false }), async () => {
+    const out = await enqueueRepoPrivate({}, 18, 'api:self');
+    assert.equal(out.created, false);
+    assert.equal(out.conflict, undefined);
+  });
+});
+
+await ta('any OTHER open intent refuses it with open_intent — it never races a teardown or standup', async () => {
+  for (const action of ['teardown', 'provision', 'settings-apply', 'disconnect']) {
+    await withEnqueue(async () => ({ intent: { id: 2, action, state: 'pending' }, created: false }), async () => {
+      const out = await enqueueRepoPrivate({}, 18, 'api:self');
+      assert.equal(out.conflict, 'open_intent', action);
+    });
+  }
+});
+
+await ta('a teardown supersedes a PENDING repo-private — a queued flip must never hold the owner\'s delete hostage', async () => {
+  // Arrange — every intent shares one open slot per project, so an un-superseded pending
+  // flip would refuse the teardown until the runner worked through it (the 1002691 class).
+  const calls = [];
+  const db = { query: async (sql, params) => {
+    calls.push(sql);
+    if (/UPDATE provisioning_intents/.test(sql)) return { rows: [{ id: 5 }] };
+    return { rows: [{ id: 6, action: 'teardown', state: 'pending', instance_id: params[0] }] };
+  } };
+  // Act
+  const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
+  // Assert
+  assert.equal(r.superseded, true);
+  assert.match(calls[0], /'repo-private'/, 'repo-private is on the supersedable list');
+  assert.match(calls[0], /state = 'pending'/, 'pending only — a RUNNING flip is mid-wiring and never yanked');
+});
+
+console.log(`\nprovision_repo_private: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_settings_apply.mjs

@@ -131,7 +131,7 @@ await ta('enqueueTeardown supersedes a PENDING settings push (a push into a proj
   const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.superseded, true, 'the queued push was cancelled so the teardown could take the slot');
-  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
+  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
 });
 
 // ── the route, over a real mounted router (stubbed data access) ─────────────────

package/tests/provisioning_teardown_intent.mjs

@@ -31,7 +31,7 @@ const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
 
 // The actions a teardown supersedes, mirroring enqueueTeardown's SQL.
-const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart']);
+const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private']);
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -79,7 +79,7 @@ function fakeIntentDb(seed = []) {
         // dead work in front of a teardown (task 1003140 widened it to the settings
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
-        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart'\) AND state = 'pending'/);
+        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/);
         const hit = rows.filter((r) =>
           String(r.instance_id) === String(params[0]) && SUPERSEDABLE.has(r.action) && r.state === 'pending');
         for (const r of hit) { r.state = 'error'; r.last_error = 'superseded: teardown requested'; }