@bongos/core 1.20.15 → 1.20.17

package/scripts/gds/provision-units.js

@@ -87,7 +87,7 @@ function backupUnitName(inst) { return `${inst.slug}-db-backup`; }
 function backupServicePath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.service`; }
 function backupTimerPath(inst) { return `/etc/systemd/system/${backupUnitName(inst)}.timer`; }
 // The consumer-layout-correct absolute path to db-backup-nightly.sh. Standalone runs
-// it from the instance's own pinned core; co-tenant/dedicated from this checkout's
+// it from the instance's own pinned core; co-tenant from this checkout's
 // scripts/gds/ — mirrors serviceUnit's execStart resolution so they can't diverge.
 function backupScriptPath(inst) {
   const rel = 'scripts/gds/db-backup-nightly.sh';
@@ -269,9 +269,8 @@ GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
     : '';
   // The pool cap (task 1003928, ADR 0285 §3): a co-located instance shares the box's
   // Postgres with every sibling and the control plane, so its pool may not take pg's
-  // default 10 of the server's 97. src/bongos/pool.js reads it bare. A dedicated
-  // droplet has its own server and keeps the default — the line is not written.
-  const poolLine = inst.hosting_shape === 'dedicated' ? '' : `PGPOOL_MAX=${CONFIG.instancePoolMax}\n`;
+  // default 10 of the server's 97. src/bongos/pool.js reads it bare.
+  const poolLine = `PGPOOL_MAX=${CONFIG.instancePoolMax}\n`;
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}

package/scripts/gds/provision.js

@@ -13,7 +13,7 @@
 // composes the docs/recipes/cloudbongos-standup.md runbook into ONE idempotent,
 // dry-run-default, drift-reconciling flow (ADR 0016 / ADR 0031 §9.4 trust boundary):
 //
-//   server (co-tenant process OR dedicated droplet)
+//   server (a process on an allocated port — co-tenant or cloud-host)
 //     → createdb + GDS-only migrate (MEDUSA_GDS_ONLY=1)
 //     → write config + per-instance /etc/<inst>/web.env
 //     → install + enable a per-instance systemd unit (+ allocate a port)
@@ -31,16 +31,14 @@
 //     default OFF = bare commands (root / test / co-tenant-legacy contexts unchanged).
 //   • Injectable executor. `makeExec` returns a `run(cmd)` that is a pure logger
 //     in dry-run and child_process in --apply; tests pass a recording fake, so the
-//     whole runbook composition is unit-tested with no droplet / DB / network.
+//     whole runbook composition is unit-tested with no box / DB / network.
 //   • Idempotent. Re-running a half-done provision is safe (createdb tolerates
 //     "already exists"; unit/Caddy writes are overwrites; healthz is a poll).
-//   • The step-command generators are PURE functions (exported) → the SAME command
-//     strings drive local exec (co-tenant) AND the dedicated droplet's cloud-init.
+//   • The step-command generators are PURE functions (exported), tested directly.
 //
 // This is control-plane ops tooling (scripts/), so it may require the core + a
 // module's data slice directly (a module may not, but a CLI may). It
-// reuses modules/provisioning/provisioning.js (the intent queue + state) and
-// scripts/gds/do-api.js (the shared DO client extracted in task #1943).
+// reuses modules/provisioning/provisioning.js (the intent queue + state).
 
 const fs = require('node:fs');
 const os = require('node:os');
@@ -49,7 +47,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { accountPreflight, appGroupExpr, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
@@ -222,7 +220,7 @@ async function allocatePort(db, provisioning, { exec } = {}) {
 
 // ---------------------------------------------------------------------------
 // Compose + run the standup runbook for ONE instance (idempotent, dry-run-safe).
-// deps: { db, provisioning, doApi, exec, writeFile, log, apply, privileged }
+// deps: { db, provisioning, exec, writeFile, log, apply, privileged }
 // ---------------------------------------------------------------------------
 async function provisionInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
@@ -235,7 +233,7 @@ async function provisionInstance(inst, deps) {
   // (code sync, migrate, /etc writes, systemd, Caddy, healthz) must run on the SAME
   // box — NOT the remote co-hosting box that PROVISION_REMOTE_HOST routes co-tenant
   // steps to (that box never had the dir; ADR 0130's remote-exec was co-tenant-only).
-  // So a standalone uses the control-plane executors; co-tenant + dedicated are
+  // So a standalone uses the control-plane executors; co-tenant is
   // unchanged (boxExec === exec, boxWriteFile === writeFile). When no remoteHost is
   // set, controlExec === exec anyway, so this is a no-op for the all-local default.
   const standalone = inst.hosting_shape === 'cloud-host';
@@ -252,7 +250,7 @@ async function provisionInstance(inst, deps) {
 
   if (isByoHost(inst.hosting_shape)) return recordByoHost(inst, deps); // stand up NOTHING, ABOVE every preflight — reasoning in provision-byo-host.js's header (ADR 0323)
   // ── preflight: DNS token scope (task 1980) ─────────────────────────────────
-  // BEFORE committing to the address (allocating a port / creating a droplet / the
+  // BEFORE committing to the address (allocating a port / the
   // step-5 DNS UPSERT), verify the control-plane Cloudflare token can actually reach
   // the domain's zone. Turns the Emersonian standup's confusing mid-flow step-5 DNS
   // failure into an up-front, actionable stop with no half-done provision. Read-only.
@@ -275,13 +273,13 @@ async function provisionInstance(inst, deps) {
   // before any mutation: ingress asks whether this plane has a proxy AT ALL, 0303 below whether
   // that proxy is wired for THIS domain. Deliberately NOT domain-gated — a domainless child
   // skipped 0303 entirely, reached step 6 and died on the snippet write.
-  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap });
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, probe: deps.ingressPlaneGap });
   if (ingressGap) return { ok: false, error: ingressGap };
   // Account preflight (task 1004018, ADR 0317). The third and last PLANE question — can this
   // box give the child its own unix account? — before 0303 below asks the per-DOMAIN one. A
   // plane that cannot would run every child as one uid, the ADR 0281 vector, and step 1c's
   // useradd would crash mid-provision instead of refusing.
-  const accountGap = accountPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, privileged, probe: deps.accountPlaneGap });
+  const accountGap = accountPreflight({ exec: boxExec, apply, log, privileged, probe: deps.accountPlaneGap });
   if (accountGap) return { ok: false, error: accountGap };
   // App-user preflight (task 1002719): steps below name the app user, and appUser() refuses
   // root or an unusable name. Refuse HERE, before the status flip, not midway through.
@@ -289,7 +287,7 @@ async function provisionInstance(inst, deps) {
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
-  if (inst.domain && inst.hosting_shape !== 'dedicated' && apply) {
+  if (inst.domain && apply) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });
     if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
   }
@@ -328,68 +326,39 @@ async function provisionInstance(inst, deps) {
   //                  else PROVISION_PUBLIC_IP (all-local: one and the same machine).
   //                  Remote-exec set but no control-plane IP configured → null, which
   //                  makes step 5 fail loud rather than point the domain at the wrong box.
-  //   • dedicated  → the droplet's own IP (captured once it settles, below).
-  let recordIp;
-  if (inst.hosting_shape === 'dedicated') recordIp = null;
-  else if (standalone) recordIp = CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp);
-  else recordIp = CONFIG.publicIp;
-  if (inst.hosting_shape === 'dedicated') {
-    // Dedicated droplet: create it + settle its public IP via the shared DO client
-    // (do-api, dry-run-default). The on-droplet app standup rides cloud-init
-    // user-data built from the SAME step commands below. For the
-    // dry-run plan we surface the intent; --apply creates the droplet.
-    const doApi = deps.doApi;
-    log('  [server] dedicated droplet');
-    if (apply && doApi) {
-      const { droplet } = await doApi.createDroplet({
-        name: `cb-${inst.slug}`, region: CONFIG.region, size: inst.tier || 's-2vcpu-4gb',
-        image: CONFIG.baseImage, tags: [CONFIG.tag], sshKeys: CONFIG.sshKeyIds,
-        userData: dedicatedUserData(inst),
-      });
-      const settled = await doApi.settleDroplet(droplet.id);
-      patch.error_note = null;
-      recordIp = settled.ip || null;   // the droplet's own IP is this instance's A-record target
-      log(`    droplet ${droplet.id} @ ${settled.ip || '(pending)'} — app standup rides cloud-init`);
-    } else {
-      log('    would createDroplet + settle IP, baking cloud-init that runs the standup steps');
-    }
+  const recordIp = standalone ? CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp) : CONFIG.publicIp;
+  // Co-tenant OR standalone: a process bound to an allocated port on the box it runs
+  // on. Co-tenant shares that box's checkout ($0, cloudbongos.com model — under
+  // remote-exec, the co-hosting box); standalone (ADR 0108) runs from its OWN repo
+  // dir with a pinned @bongos/core (synced in step 2) on the CONTROL PLANE.
+  // Allocate against the ports of whichever box it runs on (boxExec: remote for a
+  // co-tenant, local for a standalone — task 2074), then run the rest there.
+  if (!inst.port) {
+    const port = await allocatePort(db, provisioning, { exec: boxExec });
+    patch.port = port;
+    inst = { ...inst, port };
+    log(`  [server] ${inst.hosting_shape} — allocated port ${port}`);
   } else {
-    // Co-tenant OR standalone: a process bound to an allocated port on the box it runs
-    // on. Co-tenant shares that box's checkout ($0, cloudbongos.com model — under
-    // remote-exec, the co-hosting box); standalone (ADR 0108) runs from its OWN repo
-    // dir with a pinned @bongos/core (synced in step 2) on the CONTROL PLANE.
-    // Allocate against the ports of whichever box it runs on (boxExec: remote for a
-    // co-tenant, local for a standalone — task 2074), then run the rest there.
-    if (!inst.port) {
-      const port = await allocatePort(db, provisioning, { exec: boxExec });
-      patch.port = port;
-      inst = { ...inst, port };
-      log(`  [server] ${inst.hosting_shape} — allocated port ${port}`);
-    } else {
-      log(`  [server] ${inst.hosting_shape} — port ${inst.port}`);
-    }
-    // Standalone: SCAFFOLD its own repo if absent — clone the (empty) target_ref →
-    // materialize config/ + .claude/ + file:-pinned core + lockfile → commit + push
-    // (ADR 0108 / 0125, task 2055). Replaces the old "repo must already be cloned"
-    // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
-    if (inst.hosting_shape === 'cloud-host') {
-      await scaffoldStandaloneRepo(inst, deps);
-      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's `git pull
-      // --ff-only origin main`, which failed unauthenticated on every private standup (N4; ADR 0176).
-      await ensurePrivateRepoAccess(inst, deps);
-      await require('./provision-pin-key.js').ensurePinWriteKey(inst, deps); // the hub's WRITE key for later pin pushes, public repos too (task 1004291, ADR 0350)
-    }
+    log(`  [server] ${inst.hosting_shape} — port ${inst.port}`);
+  }
+  // Standalone: SCAFFOLD its own repo if absent — clone the (empty) target_ref →
+  // materialize config/ + .claude/ + file:-pinned core + lockfile → commit + push
+  // (ADR 0108 / 0125, task 2055). Replaces the old "repo must already be cloned"
+  // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
+  if (inst.hosting_shape === 'cloud-host') {
+    await scaffoldStandaloneRepo(inst, deps);
+    // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's `git pull
+    // --ff-only origin main`, which failed unauthenticated on every private standup (N4; ADR 0176).
+    await ensurePrivateRepoAccess(inst, deps);
+    await require('./provision-pin-key.js').ensurePinWriteKey(inst, deps); // the hub's WRITE key for later pin pushes, public repos too (task 1004291, ADR 0350)
   }
   if (!inst.db_name) { patch.db_name = inst.slug; inst = { ...inst, db_name: inst.slug }; }
 
-  // The remaining steps run on the instance's box for co-tenant + standalone (boxExec/
-  // boxWriteFile — remote for co-tenant under remote-exec, control-plane-local for
-  // standalone; task 2074); for dedicated they are baked into cloud-init (above) and
-  // re-asserted here as idempotent no-ops on the box.
-  const local = inst.hosting_shape !== 'dedicated';
+  // The remaining steps run on the instance's box (boxExec/boxWriteFile — remote for
+  // co-tenant under remote-exec, control-plane-local for standalone; task 2074).
 
   // ── step 2: code sync (standalone) + database ─────────────────────────────
-  if (local && standalone) {
+  if (standalone) {
     // Standalone (ADR 0108 / deploy-instance.sh steps 1-2): sync the instance's own
     // repo + install the pinned @bongos/core, so the migrate + service below run
     // from the INSTANCE root, not this control-plane checkout. cwd = standaloneRoot.
@@ -412,86 +381,74 @@ async function provisionInstance(inst, deps) {
   // ── step 1c: the instance's OWN unix account (task 1003369, audit B3) ─────
   // Idempotent; the group-add is what lets a fresh system account READ the checkout it runs
   // from — without it the unit fails at exec with EACCES. Rationale: provision-repo.js.
-  if (local) {
-    log(`  [user] ensure unix account ${instanceUser(inst)} + its state dir`);
-    boxExec(ensureInstanceUserCmd(inst, { privileged }));
-    boxExec(grantInstanceRepoReadCmd(inst, { privileged }));
-  } else { log('    (instance unix account created via cloud-init on the droplet)'); }
+  log(`  [user] ensure unix account ${instanceUser(inst)} + its state dir`);
+  boxExec(ensureInstanceUserCmd(inst, { privileged }));
+  boxExec(grantInstanceRepoReadCmd(inst, { privileged }));
 
   log('  [db] create + GDS-only migrate');
-  if (local) {
-    boxExec(dbCreateCmd(inst, { privileged }), { allowFail: true });   // "already exists" is fine
-    if (standalone) boxExec(standaloneMigrateCmd(inst, { privileged }), { cwd: standaloneRoot(inst) });  // instance-root migrate
-    else boxExec(migrateCmd(inst, { privileged }));
-    // Seed the first version so the instance can take tasks from minute one (task 2119,
-    // goal 35). Only fires if the versions table is empty — idempotent, never disturbs an
-    // existing project. NOT allowFail: a re-run is a clean 0-row no-op, so a real failure
-    // here should surface. Dedicated bakes the same step into cloud-init (dedicatedUserData).
-    log('  [seed] first version (only if versions is empty)');
-    boxExec(seedFirstVersionCmd(inst, { privileged }));
-    // Regenerate the whole-file navigation docs from the pinned core so a fresh/redeployed
-    // standalone instance's docs/ stays live (ADR 0110 §2, task 1002314) — the deploy-regen the
-    // bespoke pull scripts were missing. Best-effort: regen-instance-docs.js exits 0 even on a
-    // generator hiccup (LOUD ::ERROR::), so a stale nav doc never fails a provision.
-    if (standalone) {
-      log('  [docs] regenerate whole-file navigation docs (session-log index)');
-      boxExec(standaloneRegenDocsCmd(), { cwd: standaloneRoot(inst), allowFail: true });
-    }
-  } else { log('    (db create + migrate + first-version seed run via cloud-init on the droplet)'); }
+  boxExec(dbCreateCmd(inst, { privileged }), { allowFail: true });   // "already exists" is fine
+  if (standalone) boxExec(standaloneMigrateCmd(inst, { privileged }), { cwd: standaloneRoot(inst) });  // instance-root migrate
+  else boxExec(migrateCmd(inst, { privileged }));
+  // Seed the first version so the instance can take tasks from minute one (task 2119,
+  // goal 35). Only fires if the versions table is empty — idempotent, never disturbs an
+  // existing project. NOT allowFail: a re-run is a clean 0-row no-op, so a real failure
+  // here should surface.
+  log('  [seed] first version (only if versions is empty)');
+  boxExec(seedFirstVersionCmd(inst, { privileged }));
+  // Regenerate the whole-file navigation docs from the pinned core so a fresh/redeployed
+  // standalone instance's docs/ stays live (ADR 0110 §2, task 1002314) — the deploy-regen the
+  // bespoke pull scripts were missing. Best-effort: regen-instance-docs.js exits 0 even on a
+  // generator hiccup (LOUD ::ERROR::), so a stale nav doc never fails a provision.
+  if (standalone) {
+    log('  [docs] regenerate whole-file navigation docs (session-log index)');
+    boxExec(standaloneRegenDocsCmd(), { cwd: standaloneRoot(inst), allowFail: true });
+  }
 
   // ── step 2b: the instance's OWN password-authed PG role (task 1003369, audit B3) ──
   // AFTER the migrate: it runs as `postgres`, which therefore OWNS the tables it creates.
-  if (local) {
-    log('  [db] create/rotate the per-instance role + revoke PUBLIC connect');
-    // `shown` is MANDATORY: dbRoleCmd embeds the password, and run() logs the raw command
-    // on BOTH the dry-run and success paths — the exact leak this task exists to prevent
-    // (makeWriteFile passes `shown` for the web.env body for the same reason, and a `shown`
-    // call site also suppresses stderr). The GRANTS carry no secret and log in full.
-    boxExec(dbRoleCmd(inst, { password: dbPassword, privileged }), { shown: dbRoleCmdShown(inst) });
-    boxExec(dbRoleGrantsCmd(inst, { privileged }));
-  } else { log('    (per-instance DB role created via cloud-init on the droplet)'); }
+  log('  [db] create/rotate the per-instance role + revoke PUBLIC connect');
+  // `shown` is MANDATORY: dbRoleCmd embeds the password, and run() logs the raw command
+  // on BOTH the dry-run and success paths — the exact leak this task exists to prevent
+  // (makeWriteFile passes `shown` for the web.env body for the same reason, and a `shown`
+  // call site also suppresses stderr). The GRANTS carry no secret and log in full.
+  boxExec(dbRoleCmd(inst, { password: dbPassword, privileged }), { shown: dbRoleCmdShown(inst) });
+  boxExec(dbRoleGrantsCmd(inst, { privileged }));
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db), dbPassword }), { mode: 0o600, sudo: true });
-  else log('    (baked into cloud-init)');
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db), dbPassword }), { mode: 0o600, sudo: true });
 
   // ── step 4: install + enable the instance's service ───────────────────────
   const pm = pmFor(deps);
   log(`  [service] install + enable the ${pm.key} service`);
-  if (local) {
-    pm.installService(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
-  } else { log('    (unit baked into cloud-init)'); }
+  pm.installService(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
 
   // ── step 4b: nightly DB backup — dir + consumer-layout timer/service (task 2213) ──
   // Every instance must be born WITH backups (the task-2210 gap: cloudbongos was
   // provisioned without any). Create the app-user-owned backup dir, install the
   // per-instance timer/service (correct db + consumer-layout script path), enable
   // the timer. Idempotent: `install -d` no-ops on an existing dir, unit writes are
-  // overwrites, `enable --now` is idempotent. Dedicated bakes the same into cloud-init.
+  // overwrites, `enable --now` is idempotent.
   log('  [backup] create backup dir + install + enable nightly DB backup timer');
-  if (local) {
-    pm.installBackup(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
-  } else { log('    (backup dir + units baked into cloud-init)'); }
+  pm.installBackup(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
 
   // ── step 5: DNS — Cloudflare A-record UPSERT for the instance's domain (P4) ──
   // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
   // record pointing the domain at its target IP (recordIp), in the domain's own
   // zone, proxied=false so Caddy's on-demand ACME challenge (step 6) reaches the
-  // origin (dnsUpsertEnv). It runs on the CONTROL PLANE for BOTH shapes: the hook
-  // needs the Cloudflare token, which never leaves the control plane, so a dedicated
-  // instance's DNS is upserted from here (not baked into the droplet's cloud-init).
+  // origin (dnsUpsertEnv). It runs on the CONTROL PLANE for every shape: the hook
+  // needs the Cloudflare token, which never leaves the control plane.
   // Unlike P3's best-effort allowFail, a DNS FAILURE now SURFACES (the task-1180
   // lesson: never report provision success while the A record silently didn't land).
   if (inst.domain && CONFIG.dnsHook) {
     if (!recordIp) {
       const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
-      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env, or the droplet must settle an IP (dedicated)`);
+      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env`);
       log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
     } else {
       // Standalone runs control-plane-local under the *.cloudbongos.com wildcard origin
-      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant +
-      // dedicated stay proxied=false so their on-demand ACME challenge reaches the origin.
+      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant
+      // stays proxied=false so their on-demand ACME challenge reaches the origin.
       const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
       log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
       // controlExec, NOT exec: the DNS hook needs the Cloudflare token, which lives
@@ -528,12 +485,10 @@ async function provisionInstance(inst, deps) {
   // setup) — verified after the write, since only a written snippet proves the import
   // reaches it. The reload is loud: Caddy keeps its old config when it rejects the new one.
   log('  [caddy] write site snippet + reload');
-  if (local) {
-    boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-    const gap = inst.domain && apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
-    if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
-    boxExec(`${sudoP}systemctl reload caddy`);
-  } else { log('    (Caddy on the droplet via cloud-init)'); }
+  boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
+  const gap = inst.domain && apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+  if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+  boxExec(`${sudoP}systemctl reload caddy`);
 
   // ── step 7: healthz ───────────────────────────────────────────────────────
   // The probe RESULT is recorded, not discarded (task 1002720 / QA-walk F15: a
@@ -545,17 +500,15 @@ async function provisionInstance(inst, deps) {
   // what tells the owner the truth.
   log('  [healthz] verify the instance answers');
   const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
-  let healthy = null;                     // null = not observed (dry-run / dedicated)
-  if (local) {
-    const tries = apply ? 10 : 1;
-    for (let i = 0; i < tries; i++) {
-      const res = boxExec(healthzCmd(inst), { allowFail: true });
-      if (!apply) break;                  // dry-run: exactly one plan line
-      if (res && !res.softFailed) { healthy = true; break; }
-      healthy = false;
-      if (i < tries - 1) await sleep(1000);
-    }
-  } else log('    (verified post-boot)');
+  let healthy = null;                     // null = not observed (dry-run)
+  const tries = apply ? 10 : 1;
+  for (let i = 0; i < tries; i++) {
+    const res = boxExec(healthzCmd(inst), { allowFail: true });
+    if (!apply) break;                  // dry-run: exactly one plan line
+    if (res && !res.softFailed) { healthy = true; break; }
+    healthy = false;
+    if (i < tries - 1) await sleep(1000);
+  }
 
   // ── step 7b: identity ─────────────────────────────────────────────────────
   // Does it answer as ITSELF? A live instance that serves the platform's name instead of its own
@@ -563,7 +516,7 @@ async function provisionInstance(inst, deps) {
   // (task 1003740, which went unnoticed across every hosted instance for months). A WARNING, never
   // a failure: an owner may legitimately name a project after the platform, and a name must not
   // fail a working standup.
-  if (local && apply && healthy !== false) {
+  if (apply && healthy !== false) {
     const res = boxExec(identityCmd(inst), { allowFail: true });
     const raw = res && !res.softFailed ? (res.stdout || '') : '';
     let manifest = null;
@@ -613,42 +566,6 @@ async function provisionInstance(inst, deps) {
   return { ok: true, port: inst.port, healthy };
 }
 
-// The cloud-init user-data for a dedicated droplet: run the co-tenant standup
-// steps on first boot. Kept small (well under DO's 64 KiB cap). Built from the
-// SAME pure command generators so local + dedicated never diverge.
-function dedicatedUserData(inst) {
-  const i = { ...inst, db_name: inst.db_name || inst.slug };
-  // task 2213: a dedicated droplet gets the same nightly backup as local shapes —
-  // write the per-instance unit pair (base64-encoded to sidestep YAML block-scalar
-  // escaping of the multi-line bodies), create the app-user-owned backup dir, and
-  // enable the timer alongside the web unit. Mirrors provisionInstance's step 4b.
-  const svcB64 = Buffer.from(backupService(i), 'utf8').toString('base64');
-  const timerB64 = Buffer.from(backupTimer(i), 'utf8').toString('base64');
-  // task 1003369: the same role the local leg creates at step 2b, same position around the
-  // migrate, but PASSWORD-LESS (peerOnly) — DO retains user-data and serves it back, and a
-  // dedicated droplet is single-tenant. Whole argument on dbRoleCmd.
-  const roleLines = `  - [ bash, -lc, "${dbRoleCmd(i, { peerOnly: true })}" ]\n  - [ bash, -lc, "${dbRoleGrantsCmd(i)}" ]\n`;
-  return `#cloud-config
-write_files:
-  - path: ${backupServicePath(i)}
-    encoding: b64
-    permissions: '0644'
-    content: ${svcB64}
-  - path: ${backupTimerPath(i)}
-    encoding: b64
-    permissions: '0644'
-    content: ${timerB64}
-runcmd:
-  - [ bash, -lc, "${ensureInstanceUserCmd(i)}" ]
-  - [ bash, -lc, "${grantInstanceRepoReadCmd(i)}" ]
-  - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
-  - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
-  - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
-${roleLines}  - [ bash, -lc, "install -d -o ${appUser()} -g ${appGroupExpr()} -m 0750 ${CONFIG.backupDir}" ]
-  - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug} ${backupUnitName(i)}.timer" ]
-`;
-}
-
 // The addresses a re-point left behind and this run still owes a release on
 // (task 1003237). The one guard this tier can make on its own, and the one that
 // matters: the address the instance is CURRENTLY on is never released, so a row
@@ -754,10 +671,6 @@ async function domainAttachInstance(inst, deps) {
     log(`  instance is '${inst.status}' — nothing to wire now (provision owns pre-active domains)`);
     return { ok: true, noop: true };
   }
-  if (inst.hosting_shape === 'dedicated') {
-    return { ok: false, error: `domain-attach for a dedicated instance is not automated yet — point an A record for ${inst.domain} at the droplet's IP and reload its Caddy` };
-  }
-
   // DNS preflight (the task-1980 stance): verify token reach BEFORE touching the box.
   if (CONFIG.dnsHook && apply) {
     const scope = await (deps.checkDnsTokenScope || checkDnsTokenScope)(inst.domain);
@@ -766,7 +679,7 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
-  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap, before: 're-writing the Caddy snippet' });
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, probe: deps.ingressPlaneGap, before: 're-writing the Caddy snippet' });
   if (ingressGap) return { ok: false, error: ingressGap };   // Ingress preflight (task 1004017, ADR 0315)
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
   if (apply) {
@@ -891,13 +804,6 @@ async function settingsApplyInstance(inst, deps) {
     log(`  instance is '${inst.status}' — nothing to push now (standup writes the same values)`);
     return { ok: true, noop: true };
   }
-  // A dedicated droplet is stood up by cloud-init and the runner has no post-hoc
-  // exec path to it (the placeManifestCreds refusal) — say so rather than report a
-  // push that never landed. The route refuses to enqueue for this shape too.
-  if (inst.hosting_shape === 'dedicated') {
-    return { ok: false, error: `settings push is not automated for a dedicated droplet — set ${shown} in its ${webEnvPath(inst)} and restart the ${inst.slug} service there` };
-  }
-
   // Read the file as it stands so ONLY the settings lines change. Dry-run runs no
   // command, so it has no file to patch — it PLANS the patch instead of writing a
   // synthetic two-line body (which would read as the exact overwrite this leg
@@ -1003,11 +909,6 @@ async function restartInstance(inst, deps) {
     log(`  instance is '${inst.status}' — nothing running to restart`);
     return { ok: true, noop: true };
   }
-  // A dedicated droplet has no runner exec path (the placeManifestCreds refusal).
-  // The route refuses to enqueue for this shape too; this is the second gate.
-  if (inst.hosting_shape === 'dedicated') {
-    return { ok: false, error: `restart is not automated for a dedicated droplet — run 'systemctl restart ${inst.slug}' on that machine` };
-  }
   if (!apply) {
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
     boxExec(healthzCmd(inst), { allowFail: true });
@@ -1115,14 +1016,9 @@ async function convertManifestCode(code, { fetchImpl = globalThis.fetch, userAge
 
 // Convert one manifest row's code → creds and PLACE them (rewrite web.env + restart +
 // verify /healthz). Uses the SAME executors provisionInstance does, so co-tenant (local
-// or remote-cohost) and standalone (control-plane-local) are handled identically. A
-// dedicated droplet bakes web.env into cloud-init and has no post-hoc exec path here, so
-// it is refused with guidance. Returns { ok, appId, appSlug } | { ok:false, error }.
+// or remote-cohost) and standalone (control-plane-local) are handled identically. Returns { ok, appId, appSlug } | { ok:false, error }.
 async function placeManifestCreds(inst, mrow, deps) {
   const { log, apply } = deps;
-  if (inst.hosting_shape === 'dedicated') {
-    return { ok: false, error: 'GitHub App Manifest cred placement is not supported for a dedicated droplet yet — run oauth-secret.js on the droplet instead' };
-  }
   if (!mrow.github_code) return { ok: false, error: 'manifest row carries no github_code to convert' };
   const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? (deps.controlExec || deps.exec) : deps.exec;
@@ -1324,7 +1220,7 @@ async function cmdRunIntents(deps) {
 
 // A light drift reconcile: surface instances stuck mid-flight (provisioning /
 // tearing_down) with no open intent — a runner died mid-op. Reports; --apply
-// re-enqueues a fresh intent so the next tick retries. (Full droplet-vs-DB drift
+// re-enqueues a fresh intent so the next tick retries. (Full box-vs-DB drift
 // is a later hardening.)
 async function cmdReconcile(deps) {
   const { db, provisioning, log, apply } = deps;
@@ -1421,8 +1317,8 @@ async function main() {
   const slug = args[1] && !args[1].startsWith('--') ? args[1] : null;
   if ((cmd === 'provision' || cmd === 'teardown') && !slug) { console.error(`${cmd} needs a <slug>`); process.exit(2); }
 
-  let pool, provisioning, DoApi, platformIdentity, hubKeys, projectCatalog;
-  try { ({ pool, provisioning, DoApi, platformIdentity, hubKeys, projectCatalog } = loadDeps()); }
+  let pool, provisioning, platformIdentity, hubKeys, projectCatalog;
+  try { ({ pool, provisioning, platformIdentity, hubKeys, projectCatalog } = loadDeps()); }
   catch (e) { console.error(`cannot load DB layer (run this on the control plane): ${e.message}`); process.exit(1); }
 
   // Box-target executor (remote over SSH when PROVISION_REMOTE_HOST is set, else
@@ -1433,14 +1329,11 @@ async function main() {
   if (CONFIG.remoteHost && !CONFIG.remoteCwd) { console.error('PROVISION_REMOTE_HOST is set but PROVISION_REMOTE_CHECKOUT is not — name the co-hosting box\'s checkout dir (the old hardcoded default was removed, task 1002756).'); process.exit(2); }
   const exec = makeExec({ apply, remoteHost: CONFIG.remoteHost, remoteCwd: CONFIG.remoteCwd, sshOpts: CONFIG.sshOpts });
   const controlExec = makeExec({ apply });
-  let doApiClient = null;
   const deps = {
     db: pool, provisioning, apply, privileged: CONFIG.privileged, log: console.log,
     exec, controlExec,
     writeFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec, remoteHost: CONFIG.remoteHost }),
     controlWriteFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec: controlExec }),
-    // Built on first READ (task 1002718 F6): an --apply tick whose intents never call DO needs no DO_API_TOKEN.
-    get doApi() { return DoApi ? (doApiClient = doApiClient || new DoApi({ dryRun: !apply, token: CONFIG.doToken, log: (m) => console.log('    ' + m) })) : null; },
     // Cross-site identity (ADR 0141 §4). Null on a non-hub control plane → federation
     // dormant; shouldFederate() then skips and the instance owns its auth (as today).
     platformIdentity, hubKeys,
@@ -1484,7 +1377,7 @@ module.exports = {
   // private-repo deploy key (ADR 0176, task 1002735)
   resolveOwnerGithubToken, deployKeyTitle, deployKeyPath, ensurePrivateRepoAccess,
   zoneForDomain, dnsUpsertEnv, classifyZoneScope, checkDnsTokenScope,
-  caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
+  caddyBlock, caddySnippetPath, healthzCmd, nextFreePort,
   // executors + orchestration (injectable deps for tests)
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
   domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');