@bongos/core 1.19.999 → 1.19.1001

package/tests/provisioning_paid_shape_gate.mjs

@@ -3,13 +3,18 @@
 // The paid-shape gate on POST /provisioning/instances (task 1003682).
 //
 // Before this, the create route's only gate was requireBuilder, and `hosting_shape` was
-// caller-supplied and validated only against the allowed set. `dedicated` is the ONE shape
-// whose runner leg creates a real DigitalOcean droplet (scripts/gds/provision.js — billed
-// monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos included —
-// could queue recurring infrastructure spend the owner never approved. The route that
-// SPENDS was less gated than force-teardown, which stops spending and sits behind
+// caller-supplied and validated only against the allowed set. `dedicated` was then the ONE
+// shape whose runner leg created a real DigitalOcean droplet (scripts/gds/provision.js —
+// billed monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos
+// included — could queue recurring infrastructure spend the owner never approved. The route
+// that SPENDS was less gated than force-teardown, which stops spending and sits behind
 // provisioning.fleet.manage.
 //
+// THAT SHAPE IS GONE (ADR 0327 decision 4, task 1004182, migration provisioning_027): on the
+// owner's own platform account a bigger plan is a setting they choose, not a shape we model.
+// Its rows folded into 'cloud-host'. The gate's reasoning did not move with it — see the
+// 'dedicated is no longer requestable' case below, which is what holds the removal.
+//
 // The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
 // so the front door — `byo-host` since ADR 0323, `co-tenant` before it — stays open to any
 // authenticated builder. Everything else
@@ -21,10 +26,10 @@
 // subject. The original gate named the one shape it refused and admitted the rest, and two
 // shapes stayed open underneath that reasoning:
 //
-//   standalone    — judged harmless because it costs $0. True of the invoice; false of the
-//                   trust. The unit's WorkingDirectory is the caller's own checkout and the
-//                   loader discovers modules from process.cwd(), so the platform require()s
-//                   a repo the caller named.
+//   cloud-host    — then stored as 'standalone'. Judged harmless because it costs $0. True
+//                   of the invoice; false of the trust. The unit's WorkingDirectory is the
+//                   caller's own checkout and the loader discovers modules from
+//                   process.cwd(), so the platform require()s a repo the caller named.
 //   control-plane — did not exist when the gate was written, and was permitted by omission
 //                   the moment task 1003159 added it. A probe returned 201 and a second
 //                   control-plane row, while this file's own comment asserted it could not.
@@ -173,41 +178,41 @@ await ta('the refusal speaks WIRE vocabulary — no owner-facing label is transl
     const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
     assert.equal(res.status, 403, `expected 403 for ${shape}, got ${res.status} ${res.raw}`);
     const message = res.body.error.message || '';
-    for (const label of ['bring your own host', 'cloud host', 'dedicated cloud host']) {
+    for (const label of ['bring your own host', 'your own host', 'shared server']) {
       assert.ok(!message.toLowerCase().includes(label),
         `the ${shape} refusal translates a stored value into the owner-facing label "${label}" — that map lives only in projects.html's SHAPE_LABEL (ADR 0323): ${message}`);
     }
   }
   // And the caller is still told what they CAN ask for, in the vocabulary they sent.
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant', no_address: true });
-  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'dedicated', 'standalone'],
+  assert.deepEqual([...res.body.error.details.requestable].sort(), ['byo-host', 'cloud-host'],
     'a refusal that names no alternative is a dead end — the stored values are the alternative');
 });
 
-// ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
+// ── cloud-host runs the caller's OWN code on the platform's box (task 1003370) ────
 
-await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
+await ta('cloud-host: REFUSED for a builder without provisioning.fleet.manage', async () => {
   // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
   // nothing. That is true of the invoice and false of the trust: the systemd unit's
   // WorkingDirectory is the caller's own checkout and the module loader discovers
-  // `modules/` from process.cwd(), so a standalone request is "please require() this
+  // `modules/` from process.cwd(), so a cloud-host request is "please require() this
   // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
   // it does not make the default acceptable.
   held = [];
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
   assert.equal(res.body.error.code, 'permission_forbidden');
   assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
   assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
 });
 
-await ta('standalone: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+await ta('cloud-host: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
   held = ['provisioning.fleet.manage'];
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'cloud-host');
 });
 
 // ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
@@ -239,45 +244,46 @@ await ta('control-plane: still refused for a builder holding EVERY permission',
   assert.equal(lastCreateArgs, null, 'no row is created');
 });
 
-// ── dedicated is the metered one ──────────────────────────────────────────────────
-
-await ta('dedicated: REFUSED for a builder without provisioning.fleet.manage', async () => {
-  held = [];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
-  assert.equal(res.body.error.code, 'permission_forbidden');
-  // requirePermission reports the gate's literal list under `details` (the same envelope
-  // requireRank uses), so the denial names the atom a caller has to be granted.
-  assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
-  assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
-});
+// ── the removed shape stays removed ───────────────────────────────────────────────
 
-await ta('dedicated: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
-  held = ['provisioning.fleet.manage'];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
-  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'dedicated');
+await ta('dedicated is no longer requestable AT ALL — not by permission, not by anyone', async () => {
+  // This is the assertion that holds ADR 0327 decision 4. 'dedicated' used to be the metered
+  // shape: refused without provisioning.fleet.manage, ADMITTED with it. Task 1004182 removed
+  // the value from HOSTING_SHAPES and migration provisioning_027 folded its rows into
+  // 'cloud-host', so it is now an unknown shape — the gate DEFERS it and the validator
+  // refuses it, whatever the caller holds.
+  //
+  // Asserted for BOTH permission states deliberately. Testing only the unprivileged case
+  // would still pass if the shape had merely gone back to being gated, which is exactly the
+  // state this removal is distinguishable from.
+  for (const permissions of [[], ['provisioning.fleet.manage']]) {
+    held = permissions;
+    lastCreateArgs = null;
+    const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'dedicated', no_address: true });
+    assert.ok(res.status === 400 || res.status === 403,
+      `holding ${JSON.stringify(permissions)}: expected a refusal, got ${res.status} ${res.raw}`);
+    assert.equal(lastCreateArgs, null,
+      `holding ${JSON.stringify(permissions)}: a removed shape must never reach createInstance`);
+  }
 });
 
-await ta('the gate refuses BEFORE the row exists — a denied dedicated create leaves nothing behind', async () => {
+await ta('the gate refuses BEFORE the row exists — a denied create leaves nothing behind', async () => {
   // The denial must land ahead of createInstance, not after it: a refused-but-inserted row
   // would still be drained by the runner, which reads the column, not the HTTP status.
   held = [];
   lastCreateArgs = null;
-  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'dedicated', tier: 's-4vcpu-8gb' });
+  await post('/provisioning/instances', { slug: 'spendy', hosting_shape: 'cloud-host', no_address: true });
   assert.equal(lastCreateArgs, null);
 });
 
 // ── the gate cannot be walked around ──────────────────────────────────────────────
 
-await ta('a case-variant shape does not slip past the gate INTO a dedicated row', async () => {
+await ta('a case-variant shape does not slip past the gate INTO a privileged row', async () => {
   // The gate matches the exact wire value, and so does the shape validator — so a variant
-  // is refused as a bad shape rather than admitted as a cheap one and stored as dedicated.
-  // The property that matters is not WHICH error comes back, it is that no dedicated row
+  // is refused as a bad shape rather than admitted as a cheap one and stored as a gated
+  // shape. The property that matters is not WHICH error comes back, it is that no gated row
   // is ever created without the permission.
-  for (const shape of ['DEDICATED', 'Dedicated', ' dedicated', 'dedicated ']) {
+  for (const shape of ['CLOUD-HOST', 'Cloud-Host', ' cloud-host', 'cloud-host ']) {
     held = [];
     lastCreateArgs = null;
     const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: shape, no_address: true });
@@ -307,8 +313,15 @@ await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision abo
   // no caller may request: the value stays storable so one torn-down row remains
   // readable, and the door is shut in UNREQUESTABLE_SHAPES instead. Dropping it from
   // HOSTING_SHAPES would make that historical row violate its own CHECK constraint.
+  //
+  // It fired a THIRD time at task 1004182, which is the first time it fired for a shape
+  // going AWAY rather than arriving. 'dedicated' left the set entirely (ADR 0327 decision 4)
+  // and 'standalone' was renamed to 'cloud-host' so the stored value matches the
+  // owner-facing word; migration provisioning_027 moved both. A shape LEAVING needs the same
+  // written decision as one arriving, and more care: the rows carrying the old value have to
+  // land somewhere legal before the CHECK constraint narrows under them.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
-    ['byo-host', 'co-tenant', 'control-plane', 'dedicated', 'standalone']);
+    ['byo-host', 'cloud-host', 'co-tenant', 'control-plane']);
 });
 
 await ta('an unknown shape is answered by the validator, not by the gate', () => {

package/tests/provisioning_repo_private_route.mjs

@@ -83,7 +83,7 @@ function post(path, body) {
   });
 }
 
-const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', target_ref: 'example-owner/spike' };
+const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', target_ref: 'example-owner/spike' };
 const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
 function reset(patch = {}) {
   instance = { ...LIVE, ...patch };

package/tests/provisioning_restart.mjs

@@ -89,10 +89,17 @@ t('RESTART_FROM is exactly {active} — every other state is already served by t
   }
 });
 
-t('RESTART_SHAPES is the runner-reachable pair — dedicated is out, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['co-tenant', 'standalone']);
-  assert.ok(!provisioning.RESTART_SHAPES.has('dedicated'));
+t('RESTART_SHAPES is the runner-reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
+  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['cloud-host', 'co-tenant']);
   for (const s of provisioning.RESTART_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), `${s} is a real shape`);
+  // Was `!has('dedicated')`. Task 1004182 removed that value from HOSTING_SHAPES, which made
+  // the assertion vacuously true — it would now pass against any set at all. Name the shapes
+  // that still EXIST and are still unreachable, and assert they are real first, so this
+  // cannot rot the same way twice.
+  for (const unreachable of ['byo-host', 'control-plane']) {
+    assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
+    assert.ok(!provisioning.RESTART_SHAPES.has(unreachable), unreachable);
+  }
 });
 
 await ta('enqueueRestart: a free slot creates the intent', async () => {
@@ -190,7 +197,7 @@ function post(path) {
   });
 }
 
-const ACTIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com', settings: {} };
+const ACTIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com', settings: {} };
 function reset(patch = {}) {
   instance = { ...ACTIVE, ...patch };
   enqueueCalls = []; enqueueResult = null; events = [];

package/tests/provisioning_settings_apply.mjs

@@ -72,10 +72,17 @@ t('SETTINGS_APPLY_FROM is exactly {active} — the provision intent cannot stand
   assert.ok(!provisioning.PROVISION_ENQUEUE_FROM.has('active'), 'the premise the gate rests on');
 });
 
-t('SETTINGS_APPLY_SHAPES is the reachable pair — dedicated is out, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['co-tenant', 'standalone']);
+t('SETTINGS_APPLY_SHAPES is the reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
+  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['cloud-host', 'co-tenant']);
   for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), s);
-  assert.ok(!provisioning.SETTINGS_APPLY_SHAPES.has('dedicated'));
+  // The exclusion this used to assert was 'dedicated', which task 1004182 removed from
+  // HOSTING_SHAPES entirely — so that assertion became vacuously true and stopped testing
+  // anything. Name the shapes that DO exist and are still deliberately unreachable: nothing
+  // of ours runs a byo-host, and the control plane is not pushed settings by this path.
+  for (const unreachable of ['byo-host', 'control-plane']) {
+    assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
+    assert.ok(!provisioning.SETTINGS_APPLY_SHAPES.has(unreachable), unreachable);
+  }
 });
 
 await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carries the settings-apply action', async () => {
@@ -208,7 +215,7 @@ function patch(path, body) {
   });
 }
 
-const ACTIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'standalone', domain: 'spike.cloudbongos.com', settings: {} };
+const ACTIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', domain: 'spike.cloudbongos.com', settings: {} };
 function reset({ inst, as } = {}) {
   instance = inst !== undefined ? inst : { ...ACTIVE };
   builder = as || { id: 7, github_login: 'owner', rank: 'thetes' };
@@ -230,7 +237,7 @@ function receiptShape(push, { queued, restart, reachable }) {
 
 console.log('\nPATCH /provisioning/instances/:id/settings — the enqueue:');
 
-await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply intent queues; the receipt says a restart is coming', async () => {
+await ta('ACTIVE cloud-host: the row is written FIRST, then a settings-apply intent queues; the receipt says a restart is coming', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);

package/tests/provisioning_settings_env.mjs

@@ -168,7 +168,7 @@ t('the runner writes them into web.env alongside PORT and PGDATABASE', () => {
   const provision = require('../scripts/gds/provision.js');
   const body = provision.webEnvBody(
     { slug: 'spike-harbor', port: 3010, db_name: 'spike-harbor', target_ref: 'jaxri/spike-harbor',
-      hosting_shape: 'standalone', settings: { platform_visibility: 'gated' } }, {});
+      hosting_shape: 'cloud-host', settings: { platform_visibility: 'gated' } }, {});
   assert.match(body, /_PLATFORM_VISIBILITY=gated/);
   assert.match(body, /_JOINABILITY=apply/);
   assert.match(body, /PORT=3010/, 'the rest of the file is untouched');

package/tests/provisioning_teardown_intent.mjs

@@ -250,7 +250,7 @@ console.log('\nPOST /provisioning/instances — no provision intent for an insta
 await ta('re-requesting an ACTIVE instance does NOT enqueue a provision intent (the enabling misstep, fixed)', async () => {
   createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'active' }, created: false };
   enqueueIntentCalls = [];
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(enqueueIntentCalls.length, 0, 'no provision intent was enqueued');
   assert.equal(res.body.queued, false);
@@ -260,7 +260,7 @@ await ta('re-requesting an ACTIVE instance does NOT enqueue a provision intent (
 await ta('re-requesting an ERRORED instance still enqueues (the retry path is preserved)', async () => {
   createResult = { instance: { id: 42, owner_builder_id: 7, slug: 'spike', status: 'error' }, created: false };
   enqueueIntentCalls = [];
-  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'standalone' });
+  const res = await post('/provisioning/instances', { slug: 'spike', hosting_shape: 'cloud-host' });
   assert.equal(res.status, 200, res.raw);
   assert.equal(enqueueIntentCalls.length, 1, 'the provision retry was enqueued');
   assert.equal(enqueueIntentCalls[0].action, 'provision');
@@ -269,7 +269,7 @@ await ta('re-requesting an ERRORED instance still enqueues (the retry path is pr
 await ta('a FRESH instance always enqueues its provision intent (unchanged happy path)', async () => {
   createResult = { instance: { id: 43, owner_builder_id: 7, slug: 'fresh', status: 'requested' }, created: true };
   enqueueIntentCalls = [];
-  const res = await post('/provisioning/instances', { slug: 'fresh', hosting_shape: 'standalone' });
+  const res = await post('/provisioning/instances', { slug: 'fresh', hosting_shape: 'cloud-host' });
   assert.equal(res.status, 201, res.raw);
   assert.equal(enqueueIntentCalls.length, 1);
   assert.equal(enqueueIntentCalls[0].action, 'provision');

package/tests/public_landing_projects.mjs

@@ -193,14 +193,21 @@ test('the manual-repo step states placement and visibility — the owner never h
   assert.match(body, /public or private/i, 'visibility must be stated in our copy, not first seen on GitHub');
 });
 
-test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
+test('teardown copy states what the runner actually does (F17)', async () => {
   const { body } = await request('/projects', 'game.test.local');
-  // the DECIDED policy: shared shapes keep the database; a dedicated machine
-  // takes its database with it — the copy branches on the shape field
-  assert.match(body, /The database is kept/, 'the kept-shape promise is present');
-  assert.match(body, /database goes with (it|the machine)/, 'the dedicated branch exists');
-  assert.match(body, /hosting_shape === 'dedicated'/, 'shape-driven, not flat prose');
+  // The DECIDED policy is unchanged — teardown keeps the database — but it is no longer a
+  // PER-SHAPE claim. This used to branch: every shared shape kept the database while a
+  // 'dedicated' machine took its database with it. ADR 0327 decision 4 removed that shape
+  // and task 1004182 folded its rows into 'cloud-host', so the branch could never be taken
+  // again and the page now states the surviving outcome flatly.
+  //
+  // The important part is the NEGATIVE: the copy must no longer offer the other outcome at
+  // all. A conditional that can't fire is not merely dead here — it is a promise to owners
+  // about a machine none of them have.
+  assert.match(body, /The database is kept/, 'the kept promise is present');
   assert.match(body, /repository is untouched|repository stays yours|repository is still yours/i);
+  assert.doesNotMatch(body, /database goes with (it|the machine)/, 'the removed shape\'s copy is gone with it');
+  assert.doesNotMatch(body, /hosting_shape === 'dedicated'/, 'and so is the branch that selected it');
   // the pre-walk over-claim can never come back
   assert.doesNotMatch(body, /server and database go away/i);
   assert.doesNotMatch(body, /database (is|will be) (deleted|dropped|destroyed|removed)/i);

package/tests/upgrade.mjs

@@ -1621,7 +1621,7 @@ t('pinnedDeployKey / remoteGithubRepo: read the ADR 0176 wiring off the checkout
 });
 
 t('resolvePinPushAuth: the owner token is spent only when one is stored AND the provisioning row names the remote repo', async () => {
-  const inst = { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'standalone' };
+  const inst = { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'cloud-host' };
   const at = (url) => pinRun({ remote: { status: 0, stdout: `${url}\n` } });
   const dir = { instanceDir: '/srv/bongos/acme' };
 
@@ -1683,7 +1683,7 @@ t('runUpgrade --commit-pin: on a wired private instance the pin lands via the ow
       materialize: () => ({ skills: 35, settings: true, hooks: 3 }),
       regenerateApiArtifacts: () => ({ ok: true, ran: ['gen-api-docs.js', 'gen-api-client.js'] }),
       databaseUrl: '', pgDatabase: '',
-      instance: { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'standalone' },
+      instance: { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'cloud-host' },
       getGithubToken: async () => ({ token, scope: 'read:user,repo' }),
     },
   );