@bongos/core 1.21.125 → 1.21.127

package/modules/provisioning/routes/provisioning.js

@@ -67,10 +67,12 @@ const { callbackPage } = require('./callback-page'); const githubSetup = require
 const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
+const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');   // the owner-or-archon gate (task 1004159, ADR 0328)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
+const loadInstance = (id) => provisioning.getInstanceById(pool, id);
 
 // How long a GitHub-App-Manifest `state` token is valid — the owner must click the
 // pre-filled link + approve on GitHub within this window (task 2080). Comfortably
@@ -634,27 +636,18 @@ module.exports = function provisioningRoutes() {
     }
   });
 
-  // Own-scoped with an Archon override: an owner manages their own project; an
-  // Archon may act on any (fleet support). 404 for everyone else — no existence
-  // leak. Guards the per-id read (the manage page, task 1003041) and both
-  // settings routes (task 1003040).
-  function instanceAccessDenied(inst, builder) {
-    if (!inst) return true;
-    if (builder.rank === 'archon') return false;
-    return String(inst.owner_builder_id) !== String(builder.id);
-  }
+  // Every own-scoped /provisioning/instances/:id route below mounts requireProjectOwner
+  // (../route-helpers.js): the owner, or an Archon on any project (fleet support), and the
+  // same 404 for everyone else — no existence leak. The row rides on req.project.
 
   // GET /provisioning/instances/:id — read one instance (the manage page's read).
   // rank: any authenticated builder (own resource; archon may read any — task
   // 1003041). 404 otherwise — does not leak another owner's instance existence.
-  router.get('/provisioning/instances/:id', auth.requireBuilder, async (req, res) => {
+  router.get('/provisioning/instances/:id', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) {
-        return res.fail('instance_not_found', 404);
-      }
+      const inst = req.project;
       // SELF-HEAL THE CATALOG PROJECTION (task 1003581). ADR 0246's projection is
       // write-triggered, so an instance older than it has no catalog row and its owner's
       // invites 404 until they happen to save something. This own-scoped read — the manage
@@ -730,7 +723,7 @@ module.exports = function provisioningRoutes() {
   // the answer moved moves back. Only null does it — an empty string or any other
   // value is still refused as off-vocabulary, and `detail: {}` still changes nothing,
   // because a form that collected no answers is not asking for any to be erased.
-  router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, async (req, res) => {
+  router.patch('/provisioning/instances/:id/detail', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, {
@@ -757,9 +750,8 @@ module.exports = function provisioningRoutes() {
         message: 'The body carries nothing to change — send description, detail, modules, type, or any mix.' });
     }
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
-      const actor = String(inst.owner_builder_id) === String(req.builder.id) ? 'api:self' : `api:archon:${req.builder.id}`;
+      const inst = req.project;
+      const actor = projectActor(req);
       // An empty description is CLEARING it, not a no-op string: normalize here so
       // the column never holds '' — a blank string would read as answered to a
       // `description IS NOT NULL` publish check and put an empty husk on the map.
@@ -810,7 +802,7 @@ module.exports = function provisioningRoutes() {
   // purpose: ranking builders is a directory read the pure engine may not run.
   // This is the resolution, and ADR 0251 is why it looks like this.
   //
-  // rank: any authenticated builder, own resource — `instanceAccessDenied`, the
+  // rank: any authenticated builder, own resource — `requireProjectOwner`, the
   // same gate and the same 404 as the manage read above. That is deliberate and
   // not a new authorization idea: REACHING this route IS the ownership answer
   // (ADR 0249 §4), so the surface never re-derives "is this theirs" and can never
@@ -821,12 +813,9 @@ module.exports = function provisioningRoutes() {
   // nobody on purpose (ADR 0239 §6), which is a different statement from an empty
   // list nobody filled — so that answer returns its own reason and never touches
   // the directory at all.
-  router.get('/provisioning/instances/:id/invite-suggestions', auth.requireBuilder, async (req, res) => {
-    const id = parseId(req, res);
-    if (!id) return;
+  router.get('/provisioning/instances/:id/invite-suggestions', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      const inst = req.project;
 
       const detail = provisioning.projectDetail(inst) || {};
       const { invites } = recommendationsForDetails({ type: inst.type, ...detail });
@@ -862,18 +851,15 @@ module.exports = function provisioningRoutes() {
   // ── Per-project settings (task 1003040, goal 1000058) ─────────────────────
   // The foundation the manage-page wave hangs off: effective settings are the
   // DEFAULTS (today's behavior — public surfaces, apply-to-join) overlaid with
-  // the instance's stored keys. Access: instanceAccessDenied above (own-scoped,
+  // the instance's stored keys. Access: requireProjectOwner (own-scoped,
   // Archon override, 404 otherwise — no existence leak).
 
   // GET /provisioning/instances/:id/settings — read a project's effective
   // settings + the allowed values (so a form can render its choices).
   // rank: any authenticated builder (own resource; archon may read any).
-  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, async (req, res) => {
-    const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
-    if (!id) return;
+  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      const inst = req.project;
       // `planet` rides beside `settings` (task 1003347): the same row, read by a
       // different rule — no defaults, null = the platform's own pick.
       res.json({ ok: true, settings: provisioning.effectiveSettings(inst), planet: provisioning.planetChoice(inst),
@@ -902,7 +888,7 @@ module.exports = function provisioningRoutes() {
   // did not get carried (that 409, or an enqueue that threw) marks the push OWED,
   // which is what makes the "send it again" both of those name actually re-queue
   // instead of hitting the no-op "No change" branch (task 1003524).
-  router.patch('/provisioning/instances/:id/settings', auth.requireBuilder, async (req, res) => {
+  router.patch('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     // The schema IS the vocabularies, not a copy of them (task 1003352): strict
@@ -927,11 +913,10 @@ module.exports = function provisioningRoutes() {
         message: `The body carries no settings to change — send any of: ${settingKeys.join(', ')}.` });
     }
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      const inst = req.project;
       // The archon override carries WHICH archon (the force-teardown convention) on
       // both the event and the intent it may enqueue below.
-      const actor = String(inst.owner_builder_id) === String(req.builder.id) ? 'api:self' : `api:archon:${req.builder.id}`;
+      const actor = projectActor(req);
       // A save that changes nothing writes nothing and restarts nothing — a
       // whole-form save or a retried request must not bounce a live project. The
       // one exception is the owner re-kick (the domain route's F19 shape): the same
@@ -983,32 +968,32 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances/:id/teardown — request teardown of the caller's
-  // OWN instance. rank: any authenticated builder (own resource). Enqueues a
-  // 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when
-  // the id isn't the caller's; 409 when the instance isn't in a teardownable state.
-  router.post('/provisioning/instances/:id/teardown', auth.requireBuilder, async (req, res) => {
+  // OWN instance. rank: any authenticated builder (own resource; archon may tear down
+  // any — the override is audited via the actor). Enqueues a 'teardown' intent; the
+  // runner executes it (web tier holds no tokens). 404 when the id isn't the caller's;
+  // 409 when the instance isn't in a teardownable state.
+  router.post('/provisioning/instances/:id/teardown', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
-        return res.fail('instance_not_found', 404);
-      }
+      const inst = req.project;
+      const actor = projectActor(req);
       if (refusedAsTornDown(inst, res)) return;
       // enqueueTeardown supersedes a stale pending provision intent and reports each
       // outcome distinctly, so "already queued" is only ever said when it is TRUE
       // (task 1002691 — the old blind enqueue lied here and the instance leaked).
-      const r = await provisioning.enqueueTeardown(pool, id, 'api:self');
+      const r = await provisioning.enqueueTeardown(pool, id, actor);
       if (r.conflict) {
         return res.fail('intent_conflict', { status: 409,
           message: `A '${r.intent.action}' run is currently ${r.intent.state} for this instance — the teardown could not be queued; retry in a moment.`,
           details: { action: r.intent.action, state: r.intent.state } });
       }
       if (r.created) {
+        const who = isProjectOwner(inst, req.builder) ? 'owner' : `archon ${req.builder.github_login || req.builder.id}`;
         await provisioning.recordEvent(pool, {
-          instanceId: id, ownerBuilderId: req.builder.id, event: 'teardown',
-          detail: r.superseded ? 'teardown requested by owner (superseded a stale provision intent)' : 'teardown requested by owner',
-          actor: 'api:self',
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'teardown',
+          detail: `teardown requested by ${who}${r.superseded ? ' (superseded a stale provision intent)' : ''}`,
+          actor,
         }).catch(() => {});
       }
       res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
@@ -1034,14 +1019,13 @@ module.exports = function provisioningRoutes() {
   // Every refusal names the action that IS available in that state rather than
   // hiding behind a code, and no branch promises a duration — a restart's downtime
   // is exactly what this route cannot know (the F16 rule, ADR 0190 §7).
-  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
+      const inst = req.project;
       // The archon override carries WHICH archon (the force-teardown convention).
-      const actor = String(inst.owner_builder_id) === String(req.builder.id) ? 'api:self' : `api:archon:${req.builder.id}`;
+      const actor = projectActor(req);
       if (!provisioning.RESTART_FROM.has(inst.status)) {
         const offline = inst.status === 'torn_down' || inst.status === 'tearing_down';
         return res.fail('not_restartable', { status: 409, details: { status: inst.status }, message: offline
@@ -1086,8 +1070,9 @@ module.exports = function provisioningRoutes() {
   // (re)provision run wires the domain itself. A bring-your-own address may be
   // RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies
   // decide it, and the address it moved off is queued for release.
-  // Body: { domain (required) }.
-  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, domainWriteRateLimit, async (req, res) => {
+  // Body: { domain (required) }. An archon may set any project's address; the
+  // override is audited via the actor.
+  router.post('/provisioning/instances/:id/domain', auth.requireBuilder, domainWriteRateLimit, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { domain: { required: true, type: 'string', maxLength: 253 } })) return;
@@ -1104,10 +1089,8 @@ module.exports = function provisioningRoutes() {
           message: `${domain} is a platform-reserved address — bring a domain of your own instead.`,
         });
       }
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
-        return res.fail('instance_not_found', 404);
-      }
+      const inst = req.project;
+      const actor = projectActor(req);
       // Same rule as create: inside the platform apex the only address an instance
       // can hold is its own <slug>.<apex> — anything else is a squat (task 1002704).
       const apexZone = provisioning.normalizeHostname(instanceApex());
@@ -1129,11 +1112,11 @@ module.exports = function provisioningRoutes() {
         // idempotent no-op below.
         const needsRewire = provisioning.ownsErrorNote(inst, 'domain-attach') || inst.last_verified_up === false;
         if (inst.status === 'active' && needsRewire && !(await provisioning.getOpenIntent(pool, id))) {
-          const { created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
+          const { created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', actor);
           if (created) {
             await provisioning.recordEvent(pool, {
-              instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
-              detail: `domain ${domain} re-attach queued (owner re-kick)`, actor: 'api:self',
+              instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'domain',
+              detail: `domain ${domain} re-attach queued (${isProjectOwner(inst, req.builder) ? 'owner' : 'archon'} re-kick)`, actor,
             }).catch(() => {});
           }
           // created:false = a racing enqueue got there first — still truthful.
@@ -1176,7 +1159,7 @@ module.exports = function provisioningRoutes() {
       await catalogBridge.publishInstanceToCatalog(pool, rewired, { retireOrigin: current }).catch(() => {});
       let queued = false;
       if (inst.status === 'active') {
-        const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', 'api:self');
+        const { intent, created } = await provisioning.enqueueIntent(pool, id, 'domain-attach', actor);
         if (!created && intent.action !== 'domain-attach') {
           // The open slot is held by other work (e.g. a teardown). The address IS
           // recorded — say exactly what happened and what to do.
@@ -1188,8 +1171,8 @@ module.exports = function provisioningRoutes() {
         if (!created) {
           // an identical attach is already open — idempotent
           await provisioning.recordEvent(pool, {
-            instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
-            detail: `domain ${domain} recorded (attach already queued)`, actor: 'api:self',
+            instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'domain',
+            detail: `domain ${domain} recorded (attach already queued)`, actor,
           }).catch(() => {});
           return res.json({ ok: true, changed: true, queued: false, domain, replaced: releasing,
             message: 'That address is already being wired for this instance.' });
@@ -1197,9 +1180,9 @@ module.exports = function provisioningRoutes() {
       }
       const moved = releasing ? ` (moved off ${releasing}, queued for release)` : '';
       await provisioning.recordEvent(pool, {
-        instanceId: id, ownerBuilderId: req.builder.id, event: 'domain',
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'domain',
         detail: (queued ? `domain ${domain} recorded + attach queued` : `domain ${domain} recorded (wired at provision)`) + moved,
-        actor: 'api:self',
+        actor,
       }).catch(() => {});
       // State-only sentences (task 1002720 / F16): the web tier holds no cloud
       // tokens and cannot know whether a DNS hook exists on the runner, so "it
@@ -1225,7 +1208,7 @@ module.exports = function provisioningRoutes() {
 
   // POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding
   // link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated
-  // builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target
+  // builder (own resource; archon may mint for any — audited via the actor). Returns the pre-filled manifest + the GitHub form-POST target
   // (personal + org variants) + a one-time `state`; the browser POSTs the manifest to
   // GitHub, the owner approves, and GitHub redirects back to the public callback below.
   // The web tier only RECORDS the attempt (state token) — the control-plane runner does
@@ -1237,7 +1220,7 @@ module.exports = function provisioningRoutes() {
   // whether the founder may make an app there is GitHub's to enforce on its own page
   // (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than
   // account 'org' is the founder's personal account, exactly as before.
-  router.post('/provisioning/instances/:id/github-app', auth.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/github-app', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { account: { type: 'string', maxLength: 12 }, org: { type: 'string', maxLength: 39 } })) return;
@@ -1247,10 +1230,8 @@ module.exports = function provisioningRoutes() {
       return res.fail('bad_org', { status: 400, message: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' });
     }
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
-        return res.fail('instance_not_found', 404);
-      }
+      const inst = req.project;
+      const actor = projectActor(req);
       // A domain is required: it is the App's homepage + the sign-in callback host. No
       // domain ⇒ there is nothing to point "Login with GitHub" at yet.
       if (!inst.domain) {
@@ -1274,17 +1255,19 @@ module.exports = function provisioningRoutes() {
       if (guard && guard.refuse) return res.fail(guard.refuse, { status: 409, message: guard.message });
       const state = guard ? guard.reuse : crypto.randomBytes(32).toString('hex');
       const expiresAt = guard ? guard.expiresAt : new Date(Date.now() + MANIFEST_STATE_TTL_MS).toISOString();
-      if (!guard) await provisioning.createOAuthManifest(pool, { instanceId: id, state, requestedBy: req.builder.id, expiresAt });
+      // requested_by is read downstream as the project's owner (every later manifest event's
+      // ownerBuilderId); an archon's mint is named by the actor on the event below instead
+      if (!guard) await provisioning.createOAuthManifest(pool, { instanceId: id, state, requestedBy: inst.owner_builder_id, expiresAt });
       await provisioning.recordEvent(pool, {
-        instanceId: id, ownerBuilderId: req.builder.id, event: 'oauth-manifest-start',
-        detail: guard ? 'GitHub App Manifest link reopened (same attempt)' : 'GitHub App Manifest link minted', actor: 'api:self',
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'oauth-manifest-start',
+        detail: guard ? 'GitHub App Manifest link reopened (same attempt)' : 'GitHub App Manifest link minted', actor,
       }).catch(() => {});
       // which account owns this attempt's app, so the page can link its settings there
       // from any tab or device (github-setup.js reads it back as app_org)
       if (account === 'org') {
         await provisioning.recordEvent(pool, {
-          instanceId: id, ownerBuilderId: req.builder.id, event: githubSetup.SETUP_EVENTS.appOrg,
-          detail: orgLogin, actor: 'api:self',
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: githubSetup.SETUP_EVENTS.appOrg,
+          detail: orgLogin, actor,
         }).catch(() => {});
       }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.125",
+  "version": "1.21.127",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.125",
+      "version": "1.21.127",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.125",
+  "version": "1.21.127",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9728,6 +9728,14 @@
     }
   ],
   "1.21.125": [
+    {
+      "id": "1004460",
+      "text": "Store modules' own tests can now run on GitHub's free test machines, away from the server holding our secrets. It switches on once the owner does three short GitHub setup steps."
+    },
+    {
+      "id": "1004159",
+      "text": "Project owners' controls now share one access check, and Archons can help with teardown, address and GitHub setup on any project — every such action is logged under the Archon's name."
+    },
     {
       "id": "1004632",
       "text": "When a project updates its Bongos core, the next task's ship now uses the new core automatically instead of the old one, so it no longer fails for no visible reason."
@@ -9736,5 +9744,21 @@
       "id": "1004627",
       "text": "Bongos now has a 27-step plain-language how-to guide that an AI can walk a new person through inside their session, from where to start to their first ship."
     }
+  ],
+  "1.21.126": [
+    {
+      "id": "1004738",
+      "text": "A goal's page is much shorter now: task dependencies sit in a small card at the top where Conflicts used to be, and the full dependency picture and conflict list are one click away."
+    }
+  ],
+  "1.21.127": [
+    {
+      "id": "1004637",
+      "text": "Projects now count each store module's errors per day and send the count to the store, so a module's reliability score comes from real use. It sends with a builder's sign-in on that machine and respects the reporting switch in"
+    },
+    {
+      "id": "1004414",
+      "text": "Each hosted project now has a memory and CPU limit, so one runaway project can no longer slow down every other project or the hub."
+    }
   ]
 }

package/scripts/gds/exec-path-guard.js

@@ -103,7 +103,7 @@ const EXEMPTIONS = [
        + 'absorbed into this check.',
   },
   {
-    at: 'src/module-loader/loader.js:347',
+    at: 'src/module-loader/loader.js:350',
     why: 'The poller twin of the route require at :196 — same DEFAULT_ROOTS bound, same plugin-by-'
        + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
        + 'change to either call re-opens only that one.',

package/scripts/gds/fitness.js

@@ -524,6 +524,7 @@ const KERNEL_FILES = [
   'src/module-loader/loader.js',          // the disk loader (discover → validate → mount)
   'src/module-loader/manifest-schema.js', // the manifest validator
   'src/module-loader/semver.js',          // coreVersion compatibility
+  'src/module-loader/error-tally.js',     // per-module runtime-error counts the loader feeds (task 1004637)
   'src/bongos/module-scope-map.js',          // the module→path registry (it NAMES every module — exempt below)
   // trust primitives (ADR 0091 §1) — the authz boundary + data substrate
   'src/bongos/auth.js',                      // authz gates (requireBuilder/requireRank, ADR 0016)

package/scripts/gds/module-assess-tests.js

@@ -33,13 +33,16 @@
 // (owner, 2026-09-30): never on the control plane, where the secrets live. The
 // store path (recordTestsSignal) refuses unless the process declares it is that
 // environment with MODULE_TEST_SANDBOX=1 — set only on the isolated test box, no
-// secrets on disk, which is its own task. `--dir` stays open: it runs a module
+// secrets on disk: GitHub's free runners, driven by module-test-runner.js (task 1004460). `--dir` stays open: it runs a module
 // from your own checkout, i.e. code you already chose to run.
 //
 //   node scripts/gds/module-assess-tests.js <store_module_versions.id>   run + record
 //   node scripts/gds/module-assess-tests.js --dir modules/<key>          dry run on a
 //                                                                        local module
 //                                                                        (prints; no DB)
+//   node scripts/gds/module-assess-tests.js --tarball <f> --key <k> --version-id N --nonce X --json
+//                                    the testing environment's mode: no DB, prints the
+//                                    signal JSON (module-test-runner.js; task 1004460)
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -177,6 +180,18 @@ async function insertSignal(versionId, s, { db }) {
   return row;
 }
 
+const notScored = (e) => ({ outcome: 'not_scored', score: null, sample_size: null, reason: `the tests could not run (${e.code || 'error'})`, detail: {} });
+
+// Verify a tarball and run its tests: the signal fields, with a tarball that fails
+// verification as not_scored. No DB — this is what the separate testing
+// environment runs (`--tarball`, module-test-runner.js); assessTests keeps the gate.
+async function assessTarball(tgz, key, opts = {}) {
+  const { verifyModuleArtifact } = require('./module-artifact');
+  const v = await verifyModuleArtifact(tgz, { key, includeFiles: true });
+  if (!v.ok) return { outcome: 'not_scored', score: null, sample_size: null, reason: `the tarball failed verification (${v.code}): ${v.message}`, detail: {} };
+  return assessTests(key, v.files, opts);
+}
+
 // Read, verify and test one published version, then record the result. A tarball
 // that is missing or fails verification is recorded as not_scored — the part could
 // not be measured, which is not the same as the module failing its tests.
@@ -185,21 +200,16 @@ async function recordTestsSignal(versionId, { db, storeDir, root, timeoutMs, exe
   if (refused) return { ok: false, ...refused };
   const pool = db || require('../../src/bongos/pool').pool;
   const { versionArtifactFile } = require('../../src/bongos/module-store');
-  const { verifyModuleArtifact } = require('./module-artifact');
   const { rows: [ver] } = await pool.query(
     'SELECT id, module_key, version, artifact_path FROM store_module_versions WHERE id = $1', [versionId]);
   if (!ver) return { ok: false, code: 'version_not_found', message: `no store_module_versions row ${versionId}` };
 
   let signal;
   try {
-    const file = versionArtifactFile(ver, storeDir ? { dir: storeDir } : {});
-    const tgz = await fs.promises.readFile(file);
-    const v = await verifyModuleArtifact(tgz, { key: ver.module_key, includeFiles: true });
-    signal = v.ok
-      ? await assessTests(ver.module_key, v.files, { root, timeoutMs, exec, env })
-      : { outcome: 'not_scored', score: null, sample_size: null, reason: `the tarball failed verification (${v.code}): ${v.message}`, detail: {} };
+    const tgz = await fs.promises.readFile(versionArtifactFile(ver, storeDir ? { dir: storeDir } : {}));
+    signal = await assessTarball(tgz, ver.module_key, { root, timeoutMs, exec, env });
   } catch (e) {
-    signal = { outcome: 'not_scored', score: null, sample_size: null, reason: `the tests could not run (${e.code || 'error'})`, detail: {} };
+    signal = notScored(e);
   }
   const row = await insertSignal(ver.id, signal, { db: pool });
   return { ok: true, version: ver, signal: row };
@@ -220,7 +230,26 @@ function readModuleDir(dir) {
   return out;
 }
 
+// The value after a flag, or null.
+const flag = (argv, name) => { const i = argv.indexOf(name); return i === -1 ? null : (argv[i + 1] || ''); };
+
 async function main(argv) {
+  // DB-free, for the separate testing environment: verify + run + print the signal
+  // JSON (with the run's version id and nonce, which the control plane checks when
+  // it pulls the result). The gate still applies: without MODULE_TEST_SANDBOX=1 and
+  // a secret-free environment this refuses before anything is read.
+  const tarball = flag(argv, '--tarball');
+  if (tarball !== null) {
+    const key = flag(argv, '--key');
+    if (!tarball || !key) { console.error('usage: --tarball <file> --key <module key> [--version-id N --nonce X] --json'); return 2; }
+    const refused = runRefusal();
+    if (refused) { console.error(refused.message); return 1; }
+    let s;
+    try { s = await assessTarball(fs.readFileSync(tarball), key); }
+    catch (e) { s = notScored(e); }
+    console.log(JSON.stringify({ version_id: flag(argv, '--version-id'), nonce: flag(argv, '--nonce'), ...s }));
+    return 0;
+  }
   const i = argv.indexOf('--dir');
   if (i !== -1) {
     const dir = path.resolve(argv[i + 1] || '');
@@ -231,7 +260,7 @@ async function main(argv) {
   }
   const id = argv[0];
   if (!/^\d+$/.test(String(id || ''))) {
-    console.error('usage: node scripts/gds/module-assess-tests.js <store_module_versions.id> | --dir modules/<key>');
+    console.error('usage: node scripts/gds/module-assess-tests.js <store_module_versions.id> | --dir modules/<key> | --tarball <file> --key <k> --json');
     return 2;
   }
   const res = await recordTestsSignal(id);
@@ -246,4 +275,4 @@ if (require.main === module) {
   main(process.argv.slice(2)).then((code) => process.exit(code), (e) => { console.error(e.stack || e.message); process.exit(1); });
 }
 
-module.exports = { discoverTestFiles, assessTests, recordTestsSignal, insertSignal, runRefusal, testEnv, SANDBOX_PREFIX };
+module.exports = { discoverTestFiles, assessTests, assessTarball, recordTestsSignal, insertSignal, runRefusal, testEnv, SANDBOX_PREFIX };

package/scripts/gds/module-assess-version.js

@@ -7,6 +7,8 @@
 // this after it answers the author. Tests is recorded `pending`, and only when the
 // version has no Tests result yet: a published module's tests run only in the
 // separate test environment, never on the control plane (module-assess-tests.js).
+// When the runner is configured (module-test-runner.js) the tests are dispatched to
+// it here, and its result is pulled back into the row later.
 // The Security gate reads the tarball and asks npm about the declared dependencies
 // — it never runs the module's code, so it is safe here. Docs is one Sonnet call over
 // the HOWTO.md text (module-assess-docs.js) — also no module code. Then the score is
@@ -27,12 +29,18 @@ const { recomposeScore } = require('./module-assess-score');
 // the score. `recordSecurity` / `recordDocs` are injectable so tests need no npm
 // and no model. Never throws for a failed measurement — that is recorded as the signal's outcome — and resolves
 // { ok: false, code } only when the version does not exist.
-async function assessVersion(versionId, { db, recordSecurity, recordDocs } = {}) {
+async function assessVersion(versionId, { db, recordSecurity, recordDocs, dispatchTests } = {}) {
   const pool = db || require('../../src/bongos/pool').pool;
   const { rows: [ver] } = await pool.query(
-    'SELECT id, module_key, version FROM store_module_versions WHERE id = $1', [versionId]);
+    'SELECT id, module_key, version, artifact_path FROM store_module_versions WHERE id = $1', [versionId]);
   if (!ver) return { ok: false, code: 'version_not_found', message: `no store_module_versions row ${versionId}` };
 
+  // When the separate test environment is configured, send the run there first
+  // (module-test-runner.js; task 1004460): it records a pending row carrying the
+  // run's nonce, so the plain pending below then has nothing to add. Unconfigured
+  // (or a failed dispatch), nothing is sent and Tests stays plain pending.
+  await (dispatchTests || require('./module-test-runner').maybeDispatch)(ver, { db: pool });
+
   // Only a version with no Tests result yet: a re-assess must never hide a real
   // score behind a newer "pending".
   await pool.query(