@bongos/core 1.21.14 → 1.21.16

package/scripts/gds/upgrade.js

@@ -31,6 +31,9 @@ const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
 const { parseSemver, compareSemver, isStable, listAvailableVersions } = require('./update-channel');
 const { checkArtistGate } = require('./upgrade-artist-gate');
+// The database side of a move: which command migrates, as which account, and whether that
+// account can reach the database (tasks 1004274, 1002712, 1004512).
+const { preflightDbIdentity, asAccount, ACCOUNT_RE } = require('./upgrade-migrate');
 
 const CORE_PKG = '@bongos/core';
 const ARTIFACT = 'bongos-core';
@@ -130,7 +133,14 @@ function restorePin(instanceDir, depString, fsImpl = fs) {
 // `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump. -uall (task 1004188): a bare status collapses a NEW untracked dir to one '?? dir/' entry the file-path waiver never matches.
 function gitTreeClean(instanceDir, run = spawnSync, ignore = []) {
   const r = run('git', ['status', '--porcelain', '-uall'], { cwd: instanceDir, encoding: 'utf8' });
-  if (!r || r.error || r.status !== 0) return { ok: false, reason: 'git status failed (not a git repo?)' };
+  // git's OWN words, not a guess at them (task 1004512). `not a git repo?` was the only
+  // explanation ever offered, and the failure that actually happens in the field is
+  // `detected dubious ownership` — a repo git can see perfectly well and refuses to read
+  // for the account asking. Swallowing the reason is what let that read as dirt.
+  if (!r || r.error || r.status !== 0) {
+    const said = String((r && (r.stderr || r.stdout)) || (r && r.error && r.error.message) || '').trim().split('\n').slice(0, 4).join('\n');
+    return { ok: false, reason: said || 'git status failed (not a git repo?)' };
+  }
   const skip = new Set(ignore), all = (r.stdout || '').split('\n').filter((l) => l.trim());
   const kept = all.filter((l) => !skip.has(l.slice(3).trim()));
   return { ok: !kept.length, dirty: kept.join('\n'), ignored: all.length - kept.length };
@@ -509,37 +519,12 @@ function npmInstall(instanceDir, run = spawnSync) {
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
 
-// migrate.sh reaches Postgres over the local socket as the CURRENT OS USER (peer
-// auth) — so running an upgrade under `sudo` connects as `root`, which usually has
-// no Postgres role. The failure surfaces mid-run as a raw
-// `FATAL: role "root" does not exist`, AFTER the pin has already moved, which then
-// triggers the whole auto-rollback dance for what is really an operator mistake.
-// This names it up front instead (task 1002712).
-function preflightDbIdentity({ instanceDir, db }, run = spawnSync) {
-  const r = run('psql', ['-tAc', 'select 1'], {
-    cwd: instanceDir, encoding: 'utf8',
-    env: { ...process.env, ...(db ? { PGDATABASE: db } : {}) },
-  });
-  if (!r || r.error) return { ok: true, skipped: 'psql not on PATH — leaving it to migrate' };
-  if (r.status === 0) return { ok: true };
-
-  const out = `${r.stderr || ''}${r.stdout || ''}`;
-  const m = out.match(/role "([^"]+)" does not exist/i);
-  if (!m) return { ok: true, skipped: 'psql failed for another reason — leaving it to migrate' };
-  return {
-    ok: false,
-    role: m[1],
-    reason: `Postgres has no role "${m[1]}" — migrate would fail after the pin moved.\n`
-      + `    migrate.sh connects over the local socket as the CURRENT OS USER. Running the\n`
-      + `    upgrade under sudo connects as root, which is almost never a Postgres role.\n`
-      + `    Re-run as the user that owns the instance (e.g. sudo -u <owner> …), passing the\n`
-      + `    npm token through if the core comes from the registry.`,
-  };
-}
-
-function runMigrate(instanceDir, run = spawnSync) {
+function runMigrate(instanceDir, run = spawnSync, account = null) {
   const { cmd, args, env } = require('./upgrade-migrate').migratePlan(instanceDir); // its own migrate script, else the core's migrate.sh (task 1004274)
-  const r = run(cmd, args, { cwd: instanceDir, stdio: 'inherit', ...(env ? { env } : {}) });
+  // `account`: the project's own unix+Postgres identity when the move itself is running as
+  // the account that owns the CHECKOUT instead (--migrate-as; upgrade-migrate.js, task 1004512).
+  const q = asAccount(account, cmd, args, env ? { INIT_CWD: instanceDir } : {});
+  const r = run(q.cmd, q.args, { cwd: instanceDir, stdio: 'inherit', ...(env ? { env } : {}) });
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
 
@@ -787,7 +772,7 @@ function ledgerInsert({ fromVersion, toVersion, sourceCommit, note, requestedByB
 // Skips silently only when NEITHER is present (a local rehearsal with no DB pointed at) — the bump's
 // verification never depends on the ledger. An attempted-but-failed insert returns skipped:false so
 // the caller can surface it (the manual-INSERT footgun from 1976), never lose it.
-async function recordLedger({ fromVersion, toVersion, sourceCommit, note, requestedByBuilderId, source }, deps = {}) {
+async function recordLedger({ fromVersion, toVersion, sourceCommit, note, requestedByBuilderId, source, account = null }, deps = {}) {
   const url = deps.databaseUrl !== undefined ? deps.databaseUrl : process.env.DATABASE_URL;
   const database = deps.pgDatabase !== undefined ? deps.pgDatabase : process.env.PGDATABASE;
   if (!url && !database) return { ok: false, skipped: true, reason: 'no DATABASE_URL or PGDATABASE' };
@@ -828,12 +813,11 @@ async function recordLedger({ fromVersion, toVersion, sourceCommit, note, reques
   const sql = `${stmt.sql.slice(0, stmt.sql.indexOf(' VALUES '))}\n  VALUES (${stmt.cols.map(psqlValue).join(', ')});\n`;
   const sets = [];
   for (let i = 0; i < stmt.cols.length; i++) sets.push('--set', `${stmt.cols[i]}=${stmt.vals[i] == null ? '' : stmt.vals[i]}`);
-  const r = run('psql', [
-    '-d', database,
-    '-v', 'ON_ERROR_STOP=1',
-    '-q', '--no-psqlrc',
-    ...sets,
-  ], { encoding: 'utf8', input: sql });
+  // Through the project's own account when the move is not running as it (task 1004512):
+  // this psql peer-auths exactly as migrate does, so it must be the same identity or the
+  // ledger row silently stops being written on every own-account project.
+  const q = asAccount(account, 'psql', ['-d', database, '-v', 'ON_ERROR_STOP=1', '-q', '--no-psqlrc', ...sets]);
+  const r = run(q.cmd, q.args, { encoding: 'utf8', input: sql });
   if (!r || r.error) {
     const enoent = !!(r && r.error && r.error.code === 'ENOENT');
     return { ok: false, skipped: enoent, reason: enoent ? 'psql not found' : (r && r.error ? r.error.message : 'psql spawn failed') };
@@ -1065,7 +1049,7 @@ async function rollback({ instanceDir, snapshot, fromVersion, toVersion, opts },
   // 5. record the reversal in the ledger via the always-present `note` column (no schema
   //    dependency — so it records even when a FAILED migrate means a newer column wouldn't exist).
   const note = `rolled_back: ${reason} (attempted ${fromVersion || '(none)'} → ${toVersion}, restored ${snapshot.prevVersion || 'previous'})`;
-  const ledger = await recordLedger({ fromVersion, toVersion, sourceCommit: opts.sourceCommit, note, requestedByBuilderId: opts.requestedBy, source: opts.upgradeSource }, deps);
+  const ledger = await recordLedger({ fromVersion, toVersion, sourceCommit: opts.sourceCommit, note, requestedByBuilderId: opts.requestedBy, source: opts.upgradeSource, account: opts.migrateAs || null }, deps);
   if (ledger.ok) log('  ✓ recorded rollback in core_upgrades ledger');
   else if (ledger.skipped) log(`  • rollback ledger skipped (${ledger.reason})`);
   else err(`  ! rollback ledger insert failed (${ledger.reason}) — record it manually`);
@@ -1094,6 +1078,9 @@ async function runUpgrade(opts, deps = {}) {
   // failure AFTER that point (install / migrate / health) can revert. null until then = nothing to undo.
   let snapshot = null;
   if (!targetVersion) return { ok: false, error: 'missing --to <version> (the target core version)' };
+  // Checked once, here, rather than at each of the three places it is spent: an account
+  // name that reaches `sudo` is refused outright, never quoted into shape (task 1004512).
+  if (opts.migrateAs && !ACCOUNT_RE.test(opts.migrateAs)) return { ok: false, error: `--migrate-as ${JSON.stringify(opts.migrateAs)} is not a unix account name` };
 
   const pinnedVersion = readPinnedCoreVersion(instanceDir, fsImpl);
   const fromVersion = readInstalledCoreVersion(instanceDir, fsImpl) || pinnedVersion;
@@ -1118,7 +1105,13 @@ async function runUpgrade(opts, deps = {}) {
     // Step 5's own output is not dirt (task 1004122) — but only when step 5 is going to run.
     const preview = opts.skipMaterialize ? () => [] : (deps.willRewrite || require('./claude-materialize').materializeWillRewrite);
     const tree = gitTreeClean(instanceDir, run, preview({ instanceDir, materialize }, err));
-    if (!tree.ok) return { ok: false, error: `working tree not clean — commit/stash first, or pass --force.\n${tree.dirty || tree.reason || ''}` };
+    // TWO DIFFERENT FAILURES, TWO DIFFERENT SENTENCES (task 1004512). git ANSWERING with a
+    // list of dirty paths is a dirty tree, which the self-heal chain knows how to fix. git
+    // REFUSING to answer is not: committing anything would be committing a guess. They used
+    // to share one message, so a `dubious ownership` refusal was classified dirty_tree, the
+    // runner committed a tree that was never dirty, and the retry failed identically.
+    if (!tree.ok && tree.reason) return { ok: false, error: `git could not read the working tree in ${instanceDir} — the clean-tree pre-flight never ran, so this is NOT a report of uncommitted work.\n${tree.reason}` };
+    if (!tree.ok) return { ok: false, error: `working tree not clean — commit/stash first, or pass --force.\n${tree.dirty || ''}` };
     if (tree.ignored) log(`  • pre-flight: ignored ${tree.ignored} dirty path(s) this upgrade rewrites from the core (.claude/ materialization)${opts.commitPin ? ' — they are committed with the pin' : ' — pass --commit-pin to commit them'}.`);
   }
   const mods = preflightModules({ instanceDir, targetVersion }, deps);
@@ -1139,10 +1132,10 @@ async function runUpgrade(opts, deps = {}) {
         + '    Checked BEFORE the pin moves: migrate runs after the install, so a name that\n'
         + '    cannot be resolved there costs a full rollback to discover (task 1002755).' };
     }
-    const dbId = (deps.preflightDbIdentity || preflightDbIdentity)({ instanceDir, db }, run);
+    const dbId = (deps.preflightDbIdentity || preflightDbIdentity)({ instanceDir, db, account: opts.migrateAs || null }, run);
     if (!dbId.ok) return { ok: false, error: dbId.reason };
     if (dbId.skipped) log(`  • db identity pre-check${db ? ` (${db})` : ''}: ${dbId.skipped}`);
-    else log(`  ✓ pre-flight: database${db ? ` "${db}"` : ''} reachable as the current user`);
+    else log(`  ✓ pre-flight: database${db ? ` "${db}"` : ''} reachable as ${opts.migrateAs || 'the current user'}`);
     const { note: migrateNote } = require('./upgrade-migrate').migratePlan(instanceDir); if (migrateNote) log(`  ✓ pre-flight: ${migrateNote}`);
   }
 
@@ -1231,7 +1224,7 @@ async function runUpgrade(opts, deps = {}) {
 
   // 4. migrate (additive core_* migrations).
   if (!opts.skipMigrate) {
-    const mig = runMigrate(instanceDir, run);
+    const mig = runMigrate(instanceDir, run, opts.migrateAs || null);
     if (!mig.ok) {
       const error = `migrate failed (${mig.reason || 'exit ' + mig.code})`;
       if (rollbackOnFailure && snapshot) {
@@ -1366,7 +1359,7 @@ async function runUpgrade(opts, deps = {}) {
     return { ok: false, error: `${why} — rolled back to ${snapshot.prevVersion || 'the previous core'}`, fromVersion, toVersion: targetVersion, versionOk, healthOk, servedOk, servedVersion, rolledBack: true, rollback: rb };
   }
 
-  const ledger = await recordLedger({ fromVersion, toVersion: targetVersion, sourceCommit: opts.sourceCommit, note: isDowngrade ? `downgrade (--allow-downgrade)${opts.note ? `: ${opts.note}` : ''}` : opts.note, requestedByBuilderId: opts.requestedBy, source: opts.upgradeSource }, deps);
+  const ledger = await recordLedger({ fromVersion, toVersion: targetVersion, sourceCommit: opts.sourceCommit, note: isDowngrade ? `downgrade (--allow-downgrade)${opts.note ? `: ${opts.note}` : ''}` : opts.note, requestedByBuilderId: opts.requestedBy, source: opts.upgradeSource, account: opts.migrateAs || null }, deps);
   if (ledger.ok) log('  ✓ recorded in core_upgrades ledger');
   else if (ledger.skipped) log(`  • ledger skipped (${ledger.reason})`);
   else err(`  ! ledger insert failed (${ledger.reason}) — record it manually`);
@@ -1422,6 +1415,7 @@ function parseArgs(argv) {
     requestedBy: arg('--requested-by', argv),
     upgradeSource: arg('--upgrade-source', argv),
     pinPath: arg('--pin-path', argv),
+    migrateAs: arg('--migrate-as', argv), // task 1004512: the project's own unix+Postgres identity, when the move itself runs as the account that owns the checkout
     registry: hasFlag('--registry', argv), // ADR 0134: pull @bongos/core@<--to> from the npm registry instead of vendoring
     commitPin: hasFlag('--commit-pin', argv), // task 1002712: commit + push package.json/-lock so a pull-deploy reset cannot revert the bump
     pinNoPush: hasFlag('--pin-no-push', argv), // task 1003521 co-tenant mode: commit the pin but leave the customer's own remote alone
@@ -1458,6 +1452,7 @@ async function main(argv = process.argv.slice(2)) {
       '  --version-url <url>  read the RUNNING process\'s coreVersion back after restart and require it to equal --to (default: /version on the --health-url origin). A health check alone cannot tell a new core from an old one that never went down.',
       '  --no-health-check    explicitly skip the post-restart health confirmation (default: the check is ON — a bump that restarts the service must confirm it serves); also skips the served-version read-back',
       '  --skip-migrate       do not migrate (the default runs the instance\'s `migrate` script, else the core\'s scripts/migrate.sh)',
+      '  --migrate-as <user>  run the database steps (identity pre-check, migrate, ledger) as this unix account via `sudo -n -u`. For a project whose checkout is owned by the operator account but whose database is owned by its OWN account: the move needs the first to write files, the migration needs the second to connect. Omit it and everything runs as the current user, as before',
       '  --skip-materialize   do not refresh .claude/',
       '  --skip-regen-docs    do not regenerate the OpenAPI spec + typed client from the new core',
       '  --skip-pin-verify    do not verify the integrity pin (tree_sha256 + tarball.sha256) after install',

package/scripts/gds/wedge-remedy.js

@@ -34,7 +34,7 @@
 
 const { CONFIG } = require('./provision-config.js');
 const { dbName, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
-const { migratePlan, CORE_MIGRATE_SCRIPT } = require('./upgrade-migrate.js');
+const { migratePlan, CORE_MIGRATE_SCRIPT, ACCOUNT_RE } = require('./upgrade-migrate.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const outcome = require('./upgrade-outcome.js');
 const { DEFAULT_RETRY_DELAY_MS } = require('./intent-retry.js');
@@ -48,7 +48,10 @@ const REMEDY_EVENT = 'core-upgrade-remedy';
 // purpose: anything outside it is refused, never quoted.
 const SHELL_SAFE_RE = /^[A-Za-z0-9._/-]{1,200}$/;
 const DB_NAME_RE = /^[A-Za-z0-9_-]{1,63}$/;
-const ACCOUNT_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+// ACCOUNT_RE is imported, not re-declared: this file and upgrade-migrate.js check the same
+// value for the same reason (it reaches `sudo -u`), and two copies of a security predicate
+// drift one edit at a time. provision-repo.js keeps its own UNIX_ACCOUNT_RE deliberately —
+// importing from here would point the provisioner at the upgrade CLI, the wrong direction.
 
 /**
  * The fix for one known snag, as a command to run on the box. PURE.
@@ -105,9 +108,12 @@ function planRemedy(inst, reason, o = {}) {
   return { reason, cwd: dir, env: { PGDATABASE: db, ...(initCwd ? { INIT_CWD: dir } : {}) }, cmd: run, describe: `migrated ${db} to match the code it is running` };
 }
 
-// The account the project runs as, probed the way the move itself probes (task 1004128).
+// The account the project's DATABASE belongs to, probed the way the move itself probes
+// (task 1004128). `migrateAs`, not `runAs`: since task 1004512 those are two different
+// answers, and this remedy is a migration — it needs the Postgres login role, which the
+// account that owns the checkout is not.
 function runAsFor(inst, deps) {
-  try { return require('./provision-core-upgrade.js').resolveRunAs(inst, deps).runAs; } catch { return null; }
+  try { return require('./provision-core-upgrade.js').resolveRunAs(inst, deps).migrateAs; } catch { return null; }
 }
 
 /**

package/src/bongos/db.js

@@ -253,16 +253,17 @@ async function getBuilderRoleChoices(builderIds) {
 
 // ---- GitHub OAuth repo token, encrypted at rest (core_192 / task 1002099) ----
 //
-// The onboarding wizard (public-landing/create.html) opts into `public_repo` at
-// sign-in so it can list + create the user's repos. That user-to-server GitHub
-// token is held here BRIEFLY: encrypted with secret-box (master key in server env
-// only — the plaintext never touches the DB) and given a short TTL (one wizard
-// sitting), read back by the repo picker/creator, then deleted on use. It is the
+// The hub's sign-in doors opt into `repo` at sign-in so the create wizard can list +
+// create the user's repos. That user-to-server GitHub token is held here: encrypted
+// with secret-box (master key in server env only — the plaintext never touches the
+// DB) for as long as the web session it arrived with (the callback passes the
+// session's remaining life as ttlMs; task 1004549, ADR 0364), and deleted on web
+// sign-out, on offboarding, or when GitHub says it was revoked. It is the
 // auth system's OWN handshake token (distinct from a feature's third-party key
 // like the art module's Gemini key, ADR 0102), so it lives in core auth. secret-box
 // is the gate: with no master key configured we NEVER store a plaintext token —
 // capture no-ops and the wizard degrades to manual repo entry (ADR 0143).
-const GITHUB_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h — one wizard sitting.
+const GITHUB_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h — the fallback when no session expiry is known.
 
 // Store (or replace) the builder's GitHub repo token. `token` is the raw
 // user-to-server access token; it is encrypted here so the plaintext never touches

package/src/bongos/routes/auth.js

@@ -878,13 +878,18 @@ module.exports = function buildAuthRouter() {
       // every older name and the legacy apex-scoped copy, so a browser arriving
       // with either leaves holding only the host-only cookie.
       setSessionCookie(req, res, token, expiresAt);
-      // Persist the wizard's repo token (task 1002099 / ADR 0143): encrypted at rest,
-      // short-TTL, keyed to the builder — the repo picker/creator reads it back over
-      // the next few minutes. Gated on secret-box being configured (upsertGithubToken
+      // Persist the repo token (task 1002099 / ADR 0143): encrypted at rest, keyed to
+      // the builder. It lives exactly as long as the session it rode in on (task
+      // 1004549, ADR 0364) — a builder who stays signed in is never asked again, and
+      // signing out drops it. Gated on secret-box being configured (upsertGithubToken
       // no-ops when it isn't). Best-effort: a capture failure must NEVER break sign-in.
       if (wantsRepos && githubToken) {
         try {
-          await db.upsertGithubToken({ builderId: builder.id, token: githubToken, scope: githubScope });
+          const sessionLeft = expiresAt ? new Date(expiresAt).getTime() - Date.now() : 0;
+          await db.upsertGithubToken({
+            builderId: builder.id, token: githubToken, scope: githubScope,
+            ...(sessionLeft > 0 ? { ttlMs: sessionLeft } : {}),
+          });
         } catch (e) {
           log.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
         }
@@ -1157,6 +1162,14 @@ module.exports = function buildAuthRouter() {
     const token = (req.headers['authorization'] || '').replace(/^Bearer\s+/, '')
       || sessionCookieToken(req);
     if (token) await db.revokeSession(token);
+    // A WEB sign-out also drops the stored repo token (task 1004549, ADR 0364): it is
+    // held for as long as the builder stays signed in, and no longer. A CLI logout
+    // (bearer header) leaves it — the browser session that granted it is still live.
+    if (!req.headers['authorization'] && sessionCookieToken(req)) {
+      await db.deleteGithubToken({ builderId: req.builder.id }).catch((e) => {
+        log.error('[gds] auth/logout: repo-token delete failed (non-blocking):', e.message);
+      });
+    }
     // Clear every session name, host-only AND the legacy apex-scoped form — a
     // clearCookie only matches the cookie whose domain attribute it names, and a
     // sign-out that left one behind would re-authenticate the next request.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.14'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.16'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/core_upgrade_runner.mjs

@@ -507,12 +507,20 @@ await t('the control plane upgrades as the operator account, never as root', asy
   assert.doesNotMatch(cmd, /sudo node /, 'a bare `sudo node` is the bug — it lands on root');
 });
 
-await t('a tenant upgrades as its OWN account, which is also its Postgres login role', async () => {
+await t('a tenant MOVES as the account that owns its checkout and MIGRATES as its own (task 1004512)', async () => {
+  // The move writes: the pin, node_modules, .claude/, the pin commit — and before any of
+  // that, `git status`. Those belong to the app user, which is who scaffolded the
+  // checkout; the instance account only has group READ on it, so running the move as that
+  // account made git refuse with "detected dubious ownership" and the clean-tree pre-flight
+  // report dirt that did not exist. The DATABASE is the opposite: it is owned by the
+  // instance's own Postgres login role with CONNECT revoked from PUBLIC, so only that
+  // account can migrate it. Hence one move, two accounts.
   const d = { ...makeDeps({ served: '1.19.762' }), privileged: true };
   await R.coreUpgradeInstance(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), d, intent());
   const cmd = upgradeCall(d);
-  assert.match(cmd, /sudo -u bongos-test4 /, 'the instance account, not the operator and not root');
-  assert.doesNotMatch(cmd, /sudo -u appsvc /, 'one tenant must never be upgraded under another account');
+  assert.match(cmd, /sudo -u appsvc /, 'the move runs as the account that owns the checkout');
+  assert.match(cmd, /--migrate-as bongos-test4\b/, 'and hands the database steps to the instance account');
+  assert.doesNotMatch(cmd, /sudo -u bongos-test4 /, 'the instance account must not be asked to write a checkout it can only read');
 });
 
 await t('the database is NAMED, not discovered — an adopted repo has no core at its root to ask', async () => {
@@ -568,7 +576,9 @@ await t('ONE builder serves both legs — the preview and the move cannot drift
   const box = { id: 7, slug: 'test4', port: 3006, hosting_shape: 'cloud-host', db_name: 'test4' };
   const move = R.upgradeInvocation(box, '1.19.921', { privileged: true, requestedBy: '42' });
   const peek = R.upgradeInvocation(box, '1.19.921', { privileged: true, dryRun: true });
-  for (const shared of ['sudo -u bongos-test4 ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry']) {
+  // --migrate-as is SHARED, not tail: the dry run's own database pre-check connects as that
+  // account too, so a preview that omitted it would test a different identity than the move.
+  for (const shared of ['sudo -u appsvc ', 'env PGDATABASE=test4 ', '--to 1.19.921', '--registry', '--migrate-as bongos-test4']) {
     assert.ok(move.cmd.includes(shared), `move carries ${shared}`);
     assert.ok(peek.cmd.includes(shared), `preview carries the same ${shared}`);
   }
@@ -746,12 +756,15 @@ function acctDeps({ accountExists = true, dryRunStdout = '', dryRunStderr = '',
   return d;
 }
 
-await t('a tenant WITH its own account runs as that account — the security model is kept', () => {
+await t('a tenant WITH its own account MIGRATES as that account — the security model is kept', () => {
   // task 1003369: a distinct uid per instance is what stops a co-tenant reading a
-  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it.
+  // sibling's /proc/<pid>/environ. Falling back everywhere would quietly undo it. Task
+  // 1004512 moved the file half of the work to the checkout's owner and left this half
+  // exactly where it was: the database is where the per-instance identity does its job.
   const d = acctDeps({ accountExists: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'bongos-test4', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'bongos-test4', fellBack: false });
 });
 
 await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
@@ -762,6 +775,7 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.equal(r.runAs, 'appsvc');
+  assert.equal(r.migrateAs, 'appsvc', 'both halves land on the app user — the shape that was already working');
   assert.equal(r.fellBack, true);
   assert.equal(r.wanted, 'bongos-test4', 'and names the account that is missing');
 });
@@ -769,7 +783,8 @@ await t('a tenant WITHOUT one falls back to the app user, and says so', () => {
 await t('the control plane is never probed — it has no instance account by design', () => {
   const d = acctDeps({ accountExists: false });
   const r = R.resolveRunAs(inst({ hosting_shape: 'control-plane', slug: 'cloudbongos' }), d);
-  assert.deepEqual({ runAs: r.runAs, fellBack: r.fellBack }, { runAs: 'appsvc', fellBack: false });
+  assert.deepEqual({ runAs: r.runAs, migrateAs: r.migrateAs, fellBack: r.fellBack },
+    { runAs: 'appsvc', migrateAs: 'appsvc', fellBack: false });
   assert.equal(d.ranWith.filter((c) => /^id -u /.test(c.cmd)).length, 0, 'no probe was spent');
 });
 
@@ -796,7 +811,7 @@ await t('an INCONCLUSIVE probe keeps the isolated account rather than quietly wi
   const d = makeDeps({ served: '1.19.762' });
   d.exec = () => ({ ok: true, stdout: '', stderr: 'id: cannot connect to name service\n', softFailed: true });
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
-  assert.equal(r.runAs, 'bongos-test4', 'the intended account is kept');
+  assert.equal(r.migrateAs, 'bongos-test4', 'the intended account is kept');
   assert.equal(r.fellBack, false);
   assert.equal(r.probeInconclusive, true, 'and the caller can tell it was not a clean answer');
 });
@@ -813,7 +828,7 @@ await t('the probe uses the SAME executor the upgrade will use', () => {
   const r = R.resolveRunAs(inst({ hosting_shape: 'cloud-host', slug: 'test4' }), d);
   assert.deepEqual(asked.remote, [], 'the remote executor was not asked');
   assert.equal(asked.control.length, 1, 'the control-plane executor was');
-  assert.equal(r.runAs, 'bongos-test4', 'and its answer is the one that counts');
+  assert.equal(r.migrateAs, 'bongos-test4', 'and its answer is the one that counts');
 });
 
 await t('a planning tick probes ONCE, not twice', async () => {
@@ -860,9 +875,18 @@ await t('a fallback is recorded on the verdict the owner reads', async () => {
   const d = acctDeps({ accountExists: false, dryRunStdout: '  ✓ pre-flight: ok\n' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
   assert.equal(v.ran_as, 'appsvc');
+  assert.equal(v.migrated_as, 'appsvc', 'the verdict names BOTH accounts — since task 1004512 there are two');
   assert.match(v.account_note, /no bongos-test4 account yet/);
 });
 
+await t('a project WITH its own account has its two accounts named separately (task 1004512)', async () => {
+  const d = acctDeps({ accountExists: true, dryRunStdout: '  ✓ pre-flight: ok\n' });
+  const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);
+  assert.equal(v.ran_as, 'appsvc', 'the files are written by the account that owns the checkout');
+  assert.equal(v.migrated_as, 'bongos-test4', 'the database is touched by the account that owns it');
+  assert.equal(v.account_note, null, 'and nothing is missing, so there is nothing to report');
+});
+
 await t('and a silent failure STILL refuses rather than inventing a pass', async () => {
   const d = acctDeps({ softFail: true, dryRunStdout: '', dryRunStderr: '' });
   const v = await R.preflightUpgrade(inst({ hosting_shape: 'cloud-host', slug: 'test4', port: 3006 }), '1.19.762', d);

package/tests/github_token_session_life.mjs

@@ -0,0 +1,110 @@
+// tests/github_token_session_life.mjs — the repo token lives as long as the sign-in (task 1004549).
+//
+// Owner decision 2026-10-02 (ADR 0364): repo access is asked once, at sign-in, and stays with
+// the builder for as long as they stay signed in. It used to be held for one hour, so an owner
+// still signed in was sent back to GitHub from the middle of the create wizard for a grant
+// GitHub already held. Two halves, both over the REAL auth router:
+//   - the callback stores the token with the session's remaining life as its TTL;
+//   - a web sign-out deletes it; a CLI logout (bearer header) leaves it alone.
+// Only the GitHub code exchange, the session lookup and the token store are stubbed.
+//
+// Run:  node --test tests/github_token_session_life.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// RFC 2606 reserved — synthetic, never routable, no host brand in this file.
+const APEX = 'bongos-test.example';
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-gh-token-life-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'GHTOKLIFE_FIXTURE',
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}`, oauthOrigin: `https://${APEX}` },
+}));
+process.env.BONGOS_BRANDING_FILE = brandFile;
+process.env.GHTOKLIFE_FIXTURE_GITHUB_CLIENT_ID = 'fixture-client';
+process.env.GHTOKLIFE_FIXTURE_GITHUB_CLIENT_SECRET = 'fixture-secret';
+const require = createRequire(import.meta.url);
+for (const p of ['BONGOS', ...require('../src/instance-config.js').LEGACY_ENV_PREFIXES]) delete process.env[`${p}_PUBLIC_ORIGIN`];
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const db = require('../src/bongos/db');
+
+const SESSION_MS = 30 * 24 * 60 * 60 * 1000;
+const stored = [];
+const deleted = [];
+const real = {
+  completeWebFlow: auth.completeWebFlow, requireBuilder: auth.requireBuilder,
+  upsertGithubToken: db.upsertGithubToken, deleteGithubToken: db.deleteGithubToken, revokeSession: db.revokeSession,
+};
+auth.completeWebFlow = async () => ({
+  token: 'tok' + 'a'.repeat(40),
+  expiresAt: new Date(Date.now() + SESSION_MS),
+  builder: { id: 7 },
+  githubToken: 'gho_fixture',
+  githubScope: 'read:user,repo',
+});
+// The router binds requireBuilder when it is BUILT, so it is swapped before the require below.
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_id: '1', github_login: 'probe' }; next(); };
+db.upsertGithubToken = async (args) => { stored.push(args); return { stored: true }; };
+db.deleteGithubToken = async (args) => { deleted.push(args); return { deleted: true }; };
+db.revokeSession = async () => {};
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+
+let server, port;
+before(async () => {
+  const app = express();
+  app.set('trust proxy', true);
+  app.use('/api/bongos', buildAuthRouter());
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(() => { server.close(); Object.assign(auth, { completeWebFlow: real.completeWebFlow, requireBuilder: real.requireBuilder }); Object.assign(db, { upsertGithubToken: real.upsertGithubToken, deleteGithubToken: real.deleteGithubToken, revokeSession: real.revokeSession }); });
+
+function request(method, path, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, method, headers: { host: APEX, 'x-forwarded-proto': 'https', ...headers } }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, setCookies: [].concat(res.headers['set-cookie'] || []), body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+const pairs = (setCookies) => setCookies.map((c) => c.split(';')[0]).join('; ');
+
+test('a repo sign-in stores the token for the life of the session, not one hour', async () => {
+  stored.length = 0;
+  const start = await request('GET', '/api/bongos/auth/web/start?return=/projects&repos=1');
+  assert.equal(start.status, 302);
+  const state = (start.setCookies.find((c) => c.startsWith('gds_oauth_state=')) || '').split(';')[0].split('=')[1];
+  assert.ok(state, 'the start set a state cookie');
+  const cb = await request('GET', `/api/bongos/auth/web/callback?code=x&state=${state}`, { cookie: pairs(start.setCookies) });
+  assert.equal(cb.status, 302, cb.body);
+  assert.equal(stored.length, 1, 'the repo token was stored');
+  const ttl = stored[0].ttlMs;
+  assert.ok(ttl > SESSION_MS - 60_000 && ttl <= SESSION_MS, `the TTL follows the 30-day session (got ${ttl}ms)`);
+});
+
+test('a web sign-out deletes the repo token', async () => {
+  deleted.length = 0;
+  const out = await request('POST', '/api/bongos/auth/logout', { cookie: auth.SESSION_COOKIE_NAMES[0] + '=tok' + 'a'.repeat(40) });
+  assert.equal(out.status, 200, out.body);
+  assert.deepEqual(deleted, [{ builderId: 7 }]);
+});
+
+test('a CLI logout (bearer) leaves the browser session’s repo token alone', async () => {
+  deleted.length = 0;
+  const out = await request('POST', '/api/bongos/auth/logout', { authorization: 'Bearer cli' + 'b'.repeat(40) });
+  assert.equal(out.status, 200, out.body);
+  assert.deepEqual(deleted, []);
+});

package/tests/hub_account_page.mjs

@@ -74,7 +74,7 @@ test('the script builds no markup from strings, and the controls are real markup
 });
 
 test('the door returns here, and the page calls only its own-scoped routes', () => {
-  assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account"/, 'sign-in lands back on /account');
+  assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
   const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
   assert.deepEqual([...new Set(calls)].sort(), ['GET /me', 'GET /me/cross-project','PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile'].sort());
   assert.match(SCRIPT, /fetch\(API \+ '\/auth\/logout', \{ method: 'POST'/, 'sign out is the hub logout POST');
@@ -107,7 +107,7 @@ test('the bar is the hub’s own: the same markup as /projects, no header of its
     assert.ok(HUB.includes(piece), `projects.html no longer carries: ${piece}`);
     assert.ok(PAGE.includes(piece), `account.html does not carry the hub's: ${piece}`);
   }
-  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/account">Sign in<\/a>/, 'signed out, the door in the chip’s slot returns here');
+  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/account&amp;repos=1">Sign in<\/a>/, 'signed out, the door in the chip’s slot returns here');
   assert.match(PAGE, /<a class="skip vh" href="#acct">/);
   assert.match(PAGE, /<main class="acct" id="acct">/, 'the skip link has its landmark');
 });

package/tests/instance_db_migrated_on_code_move.mjs

@@ -32,7 +32,7 @@ const tenant = { slug: 'charter', db_name: 'charter_db', hosting_shape: 'co-tena
 
 test('bongos upgrade migrates before it restarts, and only --skip-migrate opts out', () => {
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/upgrade.js'), 'utf8');
-  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run);');
+  const migrate = src.indexOf('const mig = runMigrate(instanceDir, run, opts.migrateAs || null);');
   const restart = src.lastIndexOf('restartService({ service: opts.service, restartCmd: opts.restartCmd }');
   assert.ok(migrate > 0, 'the upgrade flow runs migrate');
   assert.ok(restart > migrate, 'the restart that makes new code live comes AFTER migrate');
@@ -42,14 +42,32 @@ test('bongos upgrade migrates before it restarts, and only --skip-migrate opts o
   // no scripts is migrated rather than rolled back. tests/upgrade_migrate.mjs exercises both.
   assert.match(src, /function runMigrate\([^)]*\) \{\n\s*const \{ cmd, args, env \} = require\('\.\/upgrade-migrate'\)\.migratePlan\(instanceDir\)/,
     'the migrate step spawns what migratePlan decides');
+  // …and as the account that OWNS the database, when the move itself runs as the one that
+  // owns the checkout (task 1004512). Those are two different accounts on every project
+  // provisioned since task 1003369, and the wrong one cannot connect at all: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC.
+  // Asserting the CALL SITE, not just the helper — the helper was never the gap.
+  assert.match(src, /const mig = runMigrate\(instanceDir, run, opts\.migrateAs \|\| null\);/,
+    'the migrate step is handed --migrate-as, not left on whoever the move happens to be');
   assert.equal(`bash ${CORE_MIGRATE_SCRIPT}`, INSTANCE_MIGRATE_SCRIPT, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
 });
 
 test('the control-plane runner targets the instance database, not its own', () => {
-  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc' });
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'appsvc' });
   assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `));
   assert.match(cmd, /upgrade\.js/);
   assert.doesNotMatch(cmd, /--skip-migrate/, 'the Deploy door never skips the schema');
+  assert.doesNotMatch(cmd, /--migrate-as/, 'one account for both halves emits no flag — unchanged from before task 1004512');
+});
+
+test('a project with its OWN account is migrated as it, whoever the move runs as (task 1004512)', () => {
+  // Naming the right database is only half of reaching it; the other half is connecting as
+  // a role that may. The runner used to solve both by running the WHOLE move as the
+  // project's account — which can only READ its checkout, so the move died at `git status`
+  // and the schema moved nowhere. Splitting the two keeps the database leg where it was.
+  const { cmd } = upgradeInvocation(tenant, '1.19.940', { privileged: true, runAs: 'appsvc', migrateAs: 'bongos-charter' });
+  assert.match(cmd, new RegExp(`PGDATABASE=${dbName(tenant)} `), 'still the instance database');
+  assert.match(cmd, /--migrate-as bongos-charter\b/, 'and now also the account that owns it');
 });
 
 test('provisioning migrates the new instance database at stand-up', () => {

package/tests/landing_page.mjs

@@ -291,7 +291,7 @@ test('the page reads without JavaScript: the spine is markup, not script-built',
     assert.ok(body.includes(copy), `"${copy}" is only reachable with scripting on`);
   }
   // the sign-in door is markup; the script only UPGRADES it to the signed-in chip
-  assert.match(body, /class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/">Sign in</);
+  assert.match(body, /class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1">Sign in</);
 });
 
 // ── (4) the motion kill switch ─────────────────────────────────────────────
@@ -543,7 +543,7 @@ test('the bar is markup: the mark, the Projects trigger, the sign-in door — an
   assert.match(body, /<span class="mark-word">\{\{productName\}\}<\/span>/, 'the product name as plain type, folded away under 900');
   assert.match(body, /<button class="trig" type="button" id="projTrig" data-menu="projects" aria-expanded="false" aria-controls="menuProjects">Projects<svg class="cv"/);
   assert.doesNotMatch(body, /modeBtn|id="mode"|class="moon"|class="sun"/, 'the mode glyph left the bar — the apex is dark only (task 1003336)');
-  assert.match(body, /<span class="whoSlot" id="who">\s*<a class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/">Sign in<\/a>\s*<\/span>/, 'the door stands in the identity slot until the session resolves');
+  assert.match(body, /<span class="whoSlot" id="who">\s*<a class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1">Sign in<\/a>\s*<\/span>/, 'the door stands in the identity slot until the session resolves');
   // what left with the pill bar
   assert.doesNotMatch(body, /class="pill nav-pill"|class="right-pills"|class="pill mark-pill"|data-nav="home"/, 'no nav pill, no right pills, no Home');
   assert.doesNotMatch(body.slice(body.indexOf('<header'), body.indexOf('</header>')), /data-link-hall/, 'the bar carries no hall link — the footer does');

package/tests/projects_hub_pre_uat.mjs

@@ -226,7 +226,8 @@ test('the wizard’s 401 recoveries keep the repo scope they already granted', (
   assert.equal(plain, 0, 'no wizard redirect drops the scope');
   assert.ok((SCRIPT.match(/\/auth\/web\/start\?return=\/projects%3Fview%3Dnew&repos=1'\); throw new Error\('signing in'\)/g) || []).length >= 2, 'create + manifest');
   assert.match(SCRIPT, /projects%3Fview%3Dnew&amp;repos=1">sign in again<\/a> to keep watching/, 'the progress watch');
-  assert.match(fn('signInAgain'), /currentView === 'new' \? '\/projects%3Fview%3Dnew&amp;repos=1'/, 'signInAgain from the wizard');
+  // every hub sign-in door asks for repo access since task 1004549, so signInAgain does too
+  assert.match(fn('signInAgain'), /\(currentView === 'new' \? '\/projects%3Fview%3Dnew' : '\/projects'\) \+ '&amp;repos=1'/, 'signInAgain from the wizard');
 });
 
 test('a resumed draft past the code row still probes repo access before Create', () => {