@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/provision-auto-upgrade.js

@@ -1,162 +1,6 @@
+// scripts/gds/provision-auto-upgrade.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-auto-upgrade.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-// scripts/gds/provision-auto-upgrade.js — the hub moves each hosted project's core on
-// its own, by that project's update rule (task 1004729, ADR 0381).
-//
-// WHY THIS EXISTS. Every runner tick, snapshotAllCoreVersions works out `recommended`
-// for every active cloud-host under its own rule (pinned / patch / minor, follow
-// released) — and then stopped. A move only happened when someone pressed the button on
-// /deploy, so a project on `patch` sat on 1.21.20 for 11 days while 1.21.69 was out
-// (toast, 2026-10). The rule already IS the owner's decision about taking updates; this
-// step acts on it, with the same two steps the button uses:
-//
-//   1. behind, not pinned, no open intent, target not held → queue a
-//      `core-upgrade-preflight` for `recommended` (the dry run; changes nothing);
-//   2. that preflight PASSED for that same target → queue the `core-upgrade` to it.
-//
-// Every intent goes through provisioning.enqueueIntent, exactly as the runner's own
-// reconcile does, so the control-plane guard and the single-open-intent slot apply, and
-// /deploy shows these moves like any other (requested_by 'runner:auto-upgrade').
-//
-// MINIMAL FAILURE HOLD. A passing preflight does not run migrations (toast's 1.21.115
-// passed its preflight and failed at migrate, intent 267), so without a hold this would
-// re-queue a target that already failed, every tick, forever. A target is held for an
-// instance when it already has, FOR THAT TARGET: a core-upgrade that ended (error, or
-// done but the box is still behind), a preflight intent that errored, or a stored
-// preflight verdict that refused. A newer release is a new target and is not held.
-//
-// BY FAILURE CLASS (task 1004730). A failed intent records WHAT KIND of failure it was
-// (upgrade-outcome.js classifyFailure, stored by the drain loop). A `transient` one (a
-// registry blip, an install that could not download) already waited out its own
-// 15m/1h/6h backoff inside the intent (intent-retry.js) before it was retired, so this
-// path may try that same target once more after TRANSIENT_HOLD_MS. Every other class (a
-// known wedge whose one fix did not hold, a rule refusing it, an unknown, a failed
-// rollback, which move-escalation.js already took to a person) stays held until a newer
-// release. The project's own hall tells its owner: src/bongos/upgrade-hold.js.
-//
-// Carved into its own file because provision.js and provision-core-upgrade.js sit at
-// the size ratchet. Best-effort: nothing here may fail the tick.
-
-const { resolveEnv } = require('../../src/instance-config');
-
-// At most this many automatic intents per tick, across ALL projects, so a release never
-// restarts every hosted project at once. The tick runs every few minutes; one is plenty.
-const AUTO_MOVES_PER_TICK = 1;
-
-// How long a target whose failure was classed transient waits before this path tries it
-// again (task 1004730): a day, the hold the self-host sweep gives a failed version
-// (update-sweep.js REFUSAL_HOLD_MS).
-const TRANSIENT_HOLD_MS = 24 * 60 * 60 * 1000;
-
-const REQUESTED_BY = 'runner:auto-upgrade';
-const OPEN_STATES = new Set(['pending', 'running']);
-const OFF_VALUES = new Set(['off', '0', 'false', 'no', 'disabled']);
-
-/**
- * The platform-wide off switch: `<PREFIX>_AUTO_CORE_UPGRADE` (BONGOS_AUTO_CORE_UPGRADE on
- * a vanilla hub) in the runner's environment. Unset means ON — the owner asked for this
- * behaviour (2026-10-14). off / 0 / false / no / disabled stops every automatic move; the
- * per-project `pinned` rule stays the project-level off switch. PURE over `env`.
- */
-function autoUpgradeEnabled(env = process.env) {
-  const v = resolveEnv('AUTO_CORE_UPGRADE', { env, warn: () => {}, warnPack: () => {} });
-  if (v === undefined || v === null || String(v).trim() === '') return true;
-  return !OFF_VALUES.has(String(v).trim().toLowerCase());
-}
-
-function parseVerdict(p) {
-  if (!p) return null;
-  if (typeof p === 'string') { try { return JSON.parse(p); } catch { return null; } }
-  return p;
-}
-
-// Does this failed intent still hold its target at `now`? A transient error holds for
-// TRANSIENT_HOLD_MS from when it was retired; anything else holds until a newer release
-// (task 1004730). An unreadable time reads as "just now", the safe direction. PURE.
-function stillHolds(i, now) {
-  if (i.failure_class !== 'transient' || i.state !== 'error') return true;
-  const at = Date.parse(i.updated_at);
-  return !Number.isFinite(at) || now - at < TRANSIENT_HOLD_MS;
-}
-
-/**
- * What, if anything, to queue for one project. PURE.
- * @param {object} inst     provisioning_instances row joined with its core-version snapshot
- * @param {object[]} intents that instance's intents (open ones + core-upgrade history)
- * @param {object} channelMod update-channel.js
- * @returns {{ action: string, to: string } | { skip: string }}
- */
-function decideAutoMove(inst, intents, channelMod, now = Date.now()) {
-  if (inst.hosting_shape !== 'cloud-host') return { skip: 'not a hosted project' }; // never the control-plane row
-  if (inst.status !== 'active') return { skip: 'not active' };
-  if (channelMod.normalizeChannel(inst.update_channel) === 'pinned') return { skip: 'pinned' };
-  const served = inst.served_version;
-  const to = inst.recommended;
-  if (!served || !to || channelMod.compareSemver(to, served) <= 0) return { skip: 'current' };
-  if (intents.some((i) => OPEN_STATES.has(i.state))) return { skip: 'open intent' };
-  const same = (i) => String(i.target_version || '') === String(to);
-  const held = intents.some((i) => same(i) && (
-    (i.action === 'core-upgrade' && (i.state === 'error' || i.state === 'done'))
-    || (i.action === 'core-upgrade-preflight' && i.state === 'error')) && stillHolds(i, now));
-  const verdict = parseVerdict(inst.preflight);
-  const verdictForTarget = verdict && String(verdict.target || '') === String(to) ? verdict : null;
-  if (held || (verdictForTarget && verdictForTarget.ok !== true)) return { skip: `held: ${to} already failed here` };
-  if (verdictForTarget) return { action: 'core-upgrade', to };
-  return { action: 'core-upgrade-preflight', to };
-}
-
-/**
- * Queue at most AUTO_MOVES_PER_TICK automatic core intents. Runs after the snapshot on an
- * --apply tick. Never throws.
- */
-async function autoUpgradeTick(deps) {
-  const { db, provisioning, log = () => {} } = deps;
-  if (!autoUpgradeEnabled(deps.env || process.env)) {
-    log('auto core-upgrade: off (AUTO_CORE_UPGRADE) — no automatic moves');
-    return { queued: 0, off: true };
-  }
-  const channelMod = deps.updateChannel || require('./update-channel.js');
-  let queued = 0;
-  const now = (deps.now || Date.now)();
-  try {
-    const { rows } = await db.query(
-      `SELECT i.id, i.slug, i.owner_builder_id, i.hosting_shape, i.status, i.update_channel,
-              s.served_version, s.recommended, s.preflight
-         FROM provisioning_instances i
-         JOIN provisioning_core_version_snapshot s ON s.instance_id = i.id
-        WHERE i.status = 'active' AND i.hosting_shape = 'cloud-host' AND s.recommended IS NOT NULL
-        ORDER BY i.id`);
-    if (!rows.length) return { queued };
-    const { rows: intents } = await db.query(
-      `SELECT instance_id, action, state, target_version, failure_class, updated_at FROM provisioning_intents
-        WHERE instance_id = ANY($1)
-          AND (state IN ('pending', 'running')
-               OR (action IN ('core-upgrade', 'core-upgrade-preflight') AND target_version IS NOT NULL))`,
-      [rows.map((r) => r.id)]);
-    for (const inst of rows) {
-      if (queued >= AUTO_MOVES_PER_TICK) break;
-      const mine = intents.filter((i) => String(i.instance_id) === String(inst.id));
-      const d = decideAutoMove(inst, mine, channelMod, now);
-      if (d.skip) { if (d.skip.startsWith('held')) log(`  auto core-upgrade: ${inst.slug} ${d.skip}`); continue; }
-      try {
-        const r = await provisioning.enqueueIntent(db, inst.id, d.action, REQUESTED_BY, d.to);
-        if (!r || !r.created) continue; // lost a race for the open slot — not spent
-        queued++;
-        log(`  auto core-upgrade: ${inst.slug} ${inst.served_version} → ${d.to} (${d.action} queued)`);
-        if (provisioning.recordEvent) {
-          await provisioning.recordEvent(db, {
-            instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: d.action, actor: REQUESTED_BY,
-            detail: d.action === 'core-upgrade' ? `automatic core move to ${d.to} (update rule)` : `automatic pre-flight check for ${d.to} (update rule)`,
-          }).catch(() => {});
-        }
-      } catch (e) {
-        log(`  auto core-upgrade: ${inst.slug} not queued (${(e && e.message) || e})`);
-      }
-    }
-  } catch (e) {
-    log(`  auto core-upgrade skipped (${(e && e.message) || e})`);
-  }
-  return { queued };
-}
-
-module.exports = { AUTO_MOVES_PER_TICK, TRANSIENT_HOLD_MS, autoUpgradeEnabled, autoUpgradeTick };
+require('../bongos/forwarder.js').forward(module, 'provision-auto-upgrade.js');

package/scripts/gds/provision-byo-host.js

@@ -1,68 +1,6 @@
+// scripts/gds/provision-byo-host.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-byo-host.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-// scripts/gds/provision-byo-host.js — the runner's answer for a 'byo-host' instance:
-// stand up NOTHING (ADR 0323, task 1004141).
-//
-// "Bring your own host" means the OWNER runs the instance — their machine, their VPS,
-// their own platform account. The platform's only job is to hold the record, so the
-// runner's job here is defined ENTIRELY BY WHAT IT MUST NOT DO: no port allocation, no
-// database or role, no `web.env` under /etc, no systemd unit, no Caddy snippet, no DNS
-// record, no cloud API call, no shell on anybody's box.
-//
-// WHY IT IS A GUARD AND NOT A CASE IN THE SWITCH. `provisionInstance` runs four
-// preflights before it mutates anything — box capacity, ingress, unix accounts, Caddy
-// wiring — and every one of them asks a question about a machine the platform owns. On
-// a byo-host row the honest answer to each is not "pass" or "fail" but "not ours to
-// ask", so the shape has to return ABOVE them, not be handled after them. That is why
-// the caller's line sits immediately under the already-active idempotency check.
-//
-// WHAT IT PREVENTED. Before this existed the shape fell through to the shared
-// co-tenant/standalone standup. `standalone` is false for it, so boxExec was the
-// CONTROL PLANE's own shell: the runner would have allocated a port, run createdb,
-// written env under /etc, installed a unit and a Caddy snippet and reloaded the proxy —
-// standing up, on our box, the one shape whose entire promise is that we never do.
-// Nothing would have errored. A silent success is the failure mode, which is why the
-// proof (`tests/provision_byo_host.mjs`) asserts ABSENCE — no exec, no write, no port,
-// no database — instead of asserting that the right steps ran.
-//
-// WHY THE ROW STILL GOES 'active'. `active` records that the platform has nothing left
-// to do, not that the platform is running it. Liveness for this shape is the ADR 0252
-// pull against the owner-supplied origin: the ~5-minute liveness sweep probes it by
-// domain and only ever writes the overlay columns, never `status`, so the card earns its
-// verdict from an observation rather than from our runner's say-so.
-//
-// Its own file because scripts/gds/provision.js sits at the 1500-line oversized-file
-// ratchet — the same reason provision-net.js, provision-units.js and
-// provision-core-upgrade.js were carved out.
-
-// The stored value. A literal, not a regex or a prefix match: a near-miss must reach the
-// standup's own validation rather than be quietly treated as the shape we skip.
-const BYO_HOST_SHAPE = 'byo-host';
-
-function isByoHost(hostingShape) {
-  return hostingShape === BYO_HOST_SHAPE;
-}
-
-// Record a byo-host instance as provisioned without touching any box. Reaches the
-// database ONLY through the injected `provisioning` port (the status flip + the audit
-// event) — it takes no executor and no writeFile, so there is nothing here that could
-// mutate a machine even by mistake.
-async function recordByoHost(inst, { db, provisioning, log, apply }) {
-  log('  [byo-host] the owner runs this one — no port, no database, no unit, no Caddy snippet, no DNS');
-  if (!apply) {
-    log('  [byo-host] would mark it active without touching any box');
-    return { ok: true, byoHost: true, stoodUp: false };
-  }
-  // error_note: null — a stale note from an earlier failed run must not ride into the
-  // active state (the same clearing the co-tenant/standalone tail does).
-  await provisioning.setInstanceStatus(db, inst.id, 'active', { error_note: null, provisioned_at: new Date().toISOString() });
-  await provisioning.recordEvent(db, {
-    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'active',
-    detail: 'byo-host — the owner supplies the host; the platform stood up nothing',
-    actor: 'runner',
-  });
-  log(`  ✓ ${inst.slug} recorded (byo-host) — nothing was stood up`);
-  return { ok: true, byoHost: true, stoodUp: false };
-}
-
-module.exports = { BYO_HOST_SHAPE, isByoHost, recordByoHost };
+require('../bongos/forwarder.js').forward(module, 'provision-byo-host.js');

package/scripts/gds/provision-capacity.js

@@ -1,79 +1,6 @@
-// scripts/gds/provision-capacity.js — the runner's BOX-CAPACITY preflight
-// (ADR 0285, task 1003927): before a standalone / co-tenant project is placed on a
-// shared box, ask whether it fits, and refuse with an owner-readable reason when it
-// does not. Nothing enforced the ceiling before this — the runner stood up project
-// N+1 on a full box and swap hid the overcommit until a reboot or a fleet upgrade
-// woke every project at once.
-//
-// The arithmetic and the two walls (row ceiling, live MemAvailable floor) live in
-// modules/provisioning/capacity.js, shared with the fleet API so both surfaces show
-// one number. This file is the runner-side composition: it reads /proc/meminfo
-// through the BOX executor — the control plane for a standalone (task 2074), the
-// remote co-hosting box for a co-tenant under remote-exec (ADR 0130) — so an
-// overflow box is measured where the project will actually run. A sibling of
-// provision-config / -repo / -units / -net; provision.js requires it back.
+// scripts/gds/provision-capacity.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-capacity.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { CONFIG } = require('./provision-config.js');
-const capacity = require('../../modules/provisioning/capacity.js');
-
-// The kernel's own two lines, kept small so the journal stays readable. allowFail:
-// a box without procfs (never, on Linux) reads as "unmeasured", and the ceiling
-// then falls to ADR 0285's conservative default rather than aborting the standup.
-const MEMINFO_CMD = "grep -E '^Mem(Total|Available):' /proc/meminfo";
-
-// capacityPreflight — { ok:true, …summary } when the project fits (or the shape has
-// no shared box), { ok:false, error, …summary } when it does not. The refusal is a
-// RETURN, never a throw: the drain loop retries it (a teardown may free a slot), and
-// on retirement writes `error` onto the instance's card without flipping its status
-// — so a project that was never placed is never labelled broken. Dry-run measures
-// and reports but refuses nothing, since it places nothing either way.
-async function capacityPreflight(inst, deps) {
-  const { db, provisioning, exec, log, apply } = deps;
-  const target = capacity.placementBox(inst.hosting_shape, { remoteHost: CONFIG.remoteHost });
-  // No target box = no box of OURS to place this on, so there is no ceiling to ask about.
-  // Today that is 'byo-host' alone: the owner supplies the machine. It also covered
-  // 'dedicated' until ADR 0327 decision 4 removed that shape, which is why the skip reason
-  // is named for the QUESTION rather than for whichever shape happens to answer it — a
-  // reason label that names a shape goes stale the moment the shape does.
-  if (!target) return { ok: true, skipped: 'no-shared-box' };
-  const boxExec = target.box === 'control-plane' ? (deps.controlExec || exec) : exec;
-  let res = null;
-  try { res = boxExec(MEMINFO_CMD, { allowFail: true }); } catch { res = null; }
-  const mem = capacity.parseMeminfo(res && res.stdout);
-  const { ceiling, source } = capacity.ceilingFor({ override: CONFIG.boxCeiling, memTotalMb: mem.memTotalMb, fixedMb: target.fixedMb });
-  const placed = await capacity.countPlaced(db, target.shapes, { excludeId: inst.id });
-  const floorMb = CONFIG.memFloorMb || capacity.DEFAULT_MEM_FLOOR_MB;
-  const summary = capacity.capacitySummary({ box: target.box, placed, ceiling, source, memAvailableMb: mem.memAvailableMb, floorMb });
-  const free = mem.memAvailableMb != null ? `${mem.memAvailableMb} MB free` : 'memory unmeasured';
-  const where = `${target.box} box at ${placed} of ${ceiling} slots (${source}, ${free})`;
-  if (!apply) {
-    log(`  [preflight] ${where} — would refuse if full (dry-run measures nothing and places nothing)`);
-    return { ok: true, dryRun: true, ...summary };
-  }
-  if (source === 'default') log(`  [preflight] ⚠ could not measure the box — using ADR 0285's smallest-tier ceiling (${ceiling}); set PROVISION_BOX_CEILING to override`);
-  if (!summary.verdict.ok) {
-    log(`  ✖ [preflight] ${where} — refusing to place ${inst.slug} (${summary.verdict.wall} wall)`);
-    if (provisioning && provisioning.recordEvent) {
-      await provisioning.recordEvent(db, {
-        instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'placement-refused',
-        detail: summary.verdict.reason, actor: 'runner',
-      }).catch(() => {});
-    }
-    return { ok: false, error: summary.verdict.reason, ...summary };
-  }
-  log(`  [preflight] ${where} ✓${summary.resize_due ? ' — at or past 80%: schedule the resize (task 1003923) or open the next box' : ''}`);
-  return { ok: true, ...summary };
-}
-
-// statusCapacityLine — the "box at N of M" line `provision.js status` prints, read
-// from this host (the CLI runs on the control plane), so the resize is scheduled
-// at 80% rather than discovered at the ceiling.
-async function statusCapacityLine(db) {
-  const c = await capacity.fleetCapacity(db);
-  const free = c.mem_available_mb != null ? `, ${c.mem_available_mb} MB free` : '';
-  const due = c.resize_due ? ' — at or past 80%: resize or open the next box (ADR 0285, task 1003923)' : '';
-  return `  ${c.box} box: ${c.placed} of ${c.ceiling} project slots taken (${c.source}${free})${due}`;
-}
-
-module.exports = { MEMINFO_CMD, capacityPreflight, statusCapacityLine };
+require('../bongos/forwarder.js').forward(module, 'provision-capacity.js');

package/scripts/gds/provision-caps.js

@@ -1,63 +1,6 @@
-// scripts/gds/provision-caps.js — the resource caps every hosted project's service carries
-// (task 1004414). A cloud-host project runs its owner's code on the box that also serves the
-// hub, and ADR 0354 lets any signed-in builder host one, so a runaway project must not be
-// able to starve the others or the hub.
-//
-// The numbers are the owner's (2026-10-15), sized from ADR 0285's measurement: a project
-// idles at ~45-70 MB and peaks at 118-134 MB at boot (page cache included), and uses a
-// fraction of a percent of one core. MemoryHigh throttles and reclaims before MemoryMax
-// kills; a killed project comes back through the unit's Restart=always. Too tight a cap
-// takes a healthy project down, so change these only as a decision.
-//
-// A NEW unit renders them (serviceUnit). An EXISTING unit takes them with `systemctl
-// set-property`, which applies live and persists a drop-in under /etc/systemd/system.control/,
-// so nothing restarts and no unit file is rewritten — rewriting would move a project made
-// before the per-instance accounts (task 1003369) onto an account that does not exist.
-// systemd only: the supervisord image has no cgroups to cap.
-
+// scripts/gds/provision-caps.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-caps.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const RESOURCE_CAPS = Object.freeze({
-  MemoryHigh: '160M',
-  MemoryMax: '256M',
-  CPUQuota: '50%',
-  TasksMax: '256',
-});
-
-function capDirectives() {
-  return Object.entries(RESOURCE_CAPS).map(([key, value]) => `${key}=${value}`);
-}
-
-// The slug is interpolated into a root shell command, so it is held to the create route's
-// charset here too rather than trusted from the row.
-const SAFE_SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
-
-function setCapsCmd(inst, { sudoP = '' } = {}) {
-  if (!SAFE_SLUG.test(String(inst.slug))) throw new Error(`refusing to cap an unsafe slug: ${JSON.stringify(inst.slug)}`);
-  return `${sudoP}systemctl set-property ${inst.slug}.service ${capDirectives().join(' ')}`;
-}
-
-// `provision.js apply-caps [--apply]` — cap every running hosted project now. A cloud-host
-// always runs on the control plane (capacity.placementBox), so this uses controlExec. One
-// project that refuses never stops the rest; the result names it.
-async function cmdApplyCaps(deps) {
-  const { db, log, privileged } = deps;
-  const exec = deps.controlExec || deps.exec;
-  const sudoP = privileged ? 'sudo ' : '';
-  const { rows } = await db.query(
-    `SELECT slug FROM provisioning_instances
-      WHERE hosting_shape = 'cloud-host' AND status = 'active'
-      ORDER BY slug`);
-  const capped = [], failed = [];
-  for (const { slug } of rows) {
-    // makeExec answers an allowFail'd failure ok:true + softFailed:true (softFailResult)
-    let r;
-    try { r = exec(setCapsCmd({ slug }, { sudoP }), { allowFail: true }); } catch { r = null; }
-    (!r || r.ok === false || r.softFailed ? failed : capped).push(slug);
-  }
-  log(`${deps.apply ? 'capped' : 'would cap (dry-run — add --apply)'} ${capped.length} of ${rows.length} active hosted project(s) at ${capDirectives().join(' ')}`);
-  if (failed.length) log(`  ✖ could not cap: ${failed.join(', ')} — re-run once each unit is loaded`);
-  return { ok: failed.length === 0, capped, failed };
-}
-
-module.exports = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };
+require('../bongos/forwarder.js').forward(module, 'provision-caps.js');

package/scripts/gds/provision-config.js

@@ -1,233 +1,6 @@
-// scripts/gds/provision-config.js — the provisioner's CONFIG block, its env
-// readers and the lazy dependency loader. Extracted FIRST so every other piece
-// can share it without requiring provision.js back (the split must stay a DAG).
-//
-// Carved out of scripts/gds/provision.js by task 1003206 (goal 1000079, the R03
-// de-monolith plan) to bring the control-plane CLI under the 1,500-line ratchet.
-// A STRUCTURAL move: bodies unchanged, provision.js requires every name back, so
-// the intent runner and its unit templates behave exactly as before.
-
+// scripts/gds/provision-config.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-config.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const path = require('node:path');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// The verified OAuth-cred placement helpers (task 1979) — reused by the GitHub App
-// Manifest flow (task 2080) to VALIDATE the creds GitHub returns before writing them
-// and to PARSE the post-restart /healthz auth_configured probe. A sibling script; a
-// plain require (its require.main guard means importing it runs no CLI).
-const oauthSecret = require('./oauth-secret');
-
-// The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
-// requires a UA). Overridable so a fork can identify itself; not secret.
-const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
-
-// The running core version (no caret) — for naming the vendored tarball the standalone
-// scaffold pins. Fail-soft (a partial checkout returns null; the scaffold then errors
-// with guidance rather than pinning a `…-null.tgz`). Mirrors init.js coreVersionSafe().
-function coreVersionSafe() {
-  try { return require(path.join(REPO_ROOT, 'src/module-api')).CORE_VERSION; } catch { return null; }
-}
-
-// What an allowFail step returns when its command failed (task 1004128). It KEEPS the
-// output: a caller that opts into allowFail needs the reason, and returning an empty
-// string made every upgrade pre-flight report a generic "the dry run did not complete"
-// while `sudo: unknown user …` sat in the journal. WITHHELD when the step is
-// secret-bearing (a `shown` call site), where only an exit status may ever surface.
-function softFailResult(e, secretBearing) {
-  if (secretBearing) return { ok: true, stdout: '', softFailed: true };
-  return { ok: true, stdout: (e.stdout || '').toString(), stderr: (e.stderr || '').toString(), softFailed: true };
-}
-
-function numEnv(name, dflt) {
-  const v = process.env[name];
-  if (v == null || v === '') return dflt;
-  const n = Number(v);
-  return Number.isFinite(n) && n > 0 ? n : dflt;
-}
-// A boolean env flag: '1'/'true'/'yes'/'on' (case-insensitive) → true, else false.
-function boolEnv(name) {
-  return /^(1|true|yes|on)$/i.test(String(process.env[name] || '').trim());
-}
-function hasFlag(args, name) { return args.includes(name); }
-
-const CONFIG = {
-  // The port range a CO-TENANT instance process binds on the shared box. 3000 (OTB)
-  // and 3002 (cloudbongos.com) are taken; new co-tenant instances start at 3003.
-  portBase: numEnv('PROVISION_PORT_BASE', 3003),
-  reservedPorts: (process.env.PROVISION_RESERVED_PORTS || '3000,3001,3002')
-    .split(',').map((s) => Number(s.trim())).filter(Number.isFinite),
-  // Where a per-instance secrets file lives: /etc/<slug>/web.env (the standup
-  // runbook's /etc/cloudbongos/web.env shape). chmod 600, OUTSIDE the repo.
-  etcBase: process.env.PROVISION_ETC_BASE || '/etc',
-  // The dir holding per-instance Caddy site snippets. Each instance gets its OWN
-  // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
-  // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
-  caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
-  // The base Caddyfile the running Caddy loads — read (never written) to prove it imports
-  // the snippets and carries the on-demand TLS ask (task 1002860, ADR 0303).
-  caddyfile: process.env.PROVISION_CADDYFILE || '/etc/caddy/Caddyfile',
-  // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
-  // default). Shared across co-tenant instances on one box — dumps are named
-  // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to
-  // its own DB. Owned by the app user, mode 0750. (task 2213, productizes 2210.)
-  backupDir: process.env.PROVISION_BACKUP_DIR || '/var/backups/gds',
-  // Where supervisord program configs land when supervision is supervisord rather than
-  // systemd (ADR 0306). Unused on a systemd box. No sudo is applied to writes here: the
-  // planes that select supervisord run unprivileged and already own this dir.
-  supervisorConfDir: process.env.PROVISION_SUPERVISOR_CONF_DIR || '/etc/supervisor/conf.d',
-  // The DigitalOcean token. No runner leg spends it since the dedicated droplet path went
-  // (task 1004185); the read stays because it is what makes this file a registered
-  // credential reader (modules/government/protected-surfaces.json + the tripwire in
-  // tests/government_protected_surfaces.mjs). Dropping it is a governance change of its own.
-  doToken: process.env.DO_API_TOKEN || null,
-  // The Cloudflare DNS hook (the instance's infra/box-dns-cloudflare.sh).
-  // P4 (#1945) formalizes the UPSERT: point the instance's domain at the target
-  // public IP (below), in the domain's OWN Cloudflare zone, proxied=false (see
-  // dnsUpsertEnv). No hook configured → DNS is skipped (a co-tenant instance is
-  // still reachable by IP; TLS then can't be issued until DNS lands).
-  dnsHook: process.env.BOX_DNS_HOOK || null,
-  // This box's PUBLIC IP — the A-record target for a CO-TENANT instance's domain.
-  // Set in the control-plane /etc/<inst>/box.env (never the web tier). Under
-  // remote-exec (PROVISION_REMOTE_HOST) this is the CO-HOSTING box's IP — where the
-  // co-tenant actually runs (ADR 0130).
-  publicIp: process.env.PROVISION_PUBLIC_IP || process.env.BOX_PUBLIC_IP || null,
-  // The CONTROL PLANE's OWN public IP — the A-record target for a STANDALONE instance
-  // (task 2074). A standalone runs control-plane-LOCAL (its scaffolded repo dir lives
-  // here, not on the remote co-hosting box), so its domain must point at THIS box, not
-  // at publicIp (which, under remote-exec, is the co-hosting box). Only needed when
-  // remote-exec splits the two boxes; all-local (no remoteHost) falls back to publicIp
-  // since the control plane and the run box are then the same machine.
-  controlPlaneIp: process.env.PROVISION_CONTROL_PLANE_IP || null,
-  // Parent dir for the OWN repo checkout of an ADR 0108 standalone-topology instance —
-  // today that is the 'cloud-host' hosting shape. Each lives at <standaloneBase>/<slug>
-  // with @bongos/core installed as an npm dep. Distinct from co-tenant, which shares THIS
-  // control-plane checkout. The name stays "standalone" because it describes the TOPOLOGY,
-  // not the shape whose stored value task 1004182 renamed; PROVISION_STANDALONE_BASE is
-  // set on the live box and named in the /new-project skill, so renaming it breaks both.
-  standaloneBase: process.env.PROVISION_STANDALONE_BASE || '/srv/cloudbongos',
-  // ── Privilege escalation (task 2066, ADR 0128) ───────────────────────────
-  // The intent runner runs as a NON-root user (provision-intent-runner.service:
-  // User= the app user) that holds passwordless sudo. That user cannot itself write under
-  // /etc, reload systemd/Caddy, or peer-auth to Postgres as a superuser — so the
-  // runbook steps below FAIL as bare commands (the goal-35 blocker). With
-  // PROVISION_SUDO=1 (alias PROVISION_PRIVILEGED=1) the privileged steps escalate:
-  //   • /etc writes         → temp file (lars-writable) + `sudo install -D -m <mode>`
-  //   • systemctl / rm /etc  → `sudo …`
-  //   • createdb / migrate   → `sudo -u postgres …` (postgres peer-auths as the PG
-  //     superuser — the Ubuntu default — so it never needs `lars` to be a PG role)
-  // OFF (default) preserves the run-as-root / test / co-tenant-legacy behavior
-  // (bare commands, direct fs writes), so nothing outside a sudo context changes.
-  // Dry-run ALWAYS logs the exact command either way. NB: the runner unit must NOT
-  // set NoNewPrivileges=true — it blocks sudo (see infra/provision-intent-runner.service).
-  privileged: boolEnv('PROVISION_SUDO') || boolEnv('PROVISION_PRIVILEGED'),
-  // ── Remote orchestration over SSH (task 2065, ADR 0130) ──────────────────
-  // The token-separation endgame (ADR 0126): run this runner ON the token-holding
-  // control-plane box, and have it drive co-tenant workloads that still LIVE on the
-  // co-hosting box over SSH — so the co-hosting box can hold ZERO cloud tokens.
-  // When PROVISION_REMOTE_HOST is set, the BOX-MUTATING steps (createdb, migrate,
-  // /etc writes, systemctl, Caddy, healthz) run on that host over `ssh`; the
-  // TOKEN step (the Cloudflare DNS hook) + the standalone repo scaffold STAY local
-  // on the control plane, where the token + the packaging tools live. UNSET
-  // (default) = every step runs locally, byte-identical to today.
-  remoteHost: process.env.PROVISION_REMOTE_HOST || null,
-  // The co-hosting box's checkout dir — the remote migrate's cwd. NO baked-in default
-  // (task 1002756: the founder-pinned path was an identity leak, and a silent wrong
-  // cwd aims mutating SSH steps at a dir that may not exist); remote mode requires it
-  // explicitly (guarded at the makeExec call), local mode never reads it.
-  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || null,
-  // ssh options for the control-plane → co-hosting hop. BatchMode so a missing key
-  // fails fast (never hangs on a prompt); accept-new pins the host key on first
-  // connect (the operator can pre-seed known_hosts for strict pinning).
-  sshOpts: process.env.PROVISION_SSH_OPTS || '-o BatchMode=yes -o StrictHostKeyChecking=accept-new',
-  // ── Box capacity (ADR 0285, task 1003927) ─────────────────────────────────
-  // How many projects the box the runner places on may hold. UNSET (default)
-  // derives it from that box's own MemTotal by the ADR's formula (15 on today's
-  // s-1vcpu-2gb, 39 after the resize), so a resize raises it with no knob to
-  // remember; set it only to pin a number the measurement should not decide (a box
-  // that also hosts something the ledger cannot see). The floor is the live
-  // MemAvailable a placement must still find — two warm projects plus margin
-  // (modules/provisioning/capacity.js holds the default). Both live in box.env;
-  // mirror an override into web.env so the fleet API reports the same number.
-  boxCeiling: numEnv('PROVISION_BOX_CEILING', null),
-  memFloorMb: numEnv('PROVISION_MEM_FLOOR_MB', null),
-  // The Postgres pool cap written into a CO-LOCATED instance's web.env as PGPOOL_MAX
-  // (task 1003928, ADR 0285 §3). pg's default is 10 per process and the shared server
-  // allows 97 non-superuser backends, so nine busy projects exhaust it whatever the
-  // RAM headroom. Idle projects hold zero backends, so this bounds bursts, not the
-  // steady state: 3 × 15 slots + the control plane's own 10 stays under the 97. The
-  // control plane keeps pg's default (it is not provisioned by this runner), so it is
-  // not written there.
-  instancePoolMax: numEnv('PROVISION_INSTANCE_PGPOOL_MAX', 3),
-};
-
-// task 1002757 — the provisioner's git identity resolves from the instance's own
-// apex (env → bot@<apex> → neutral), never the hub's address hardcoded.
-const { provisionerBotEmail, provisionerBotName } = require('./instance-apex');
-
-const MAX_INTENT_ATTEMPTS = numEnv('PROVISION_INTENT_MAX_ATTEMPTS', 3);
-
-// Manifest-placement verification budget (task 1002720 / QA-walk F23): a child
-// instance is a full Node boot away from reporting auth_configured=true, and the
-// old 10×1s poll routinely lost that race — recording a failure for a setup that
-// succeeded, then burning the SINGLE-USE manifest code on the retry. ~3 min of
-// patience; the poll runs after the intent loop, so it delays nothing.
-const MANIFEST_VERIFY_TRIES = numEnv('PROVISION_MANIFEST_VERIFY_TRIES', 90);
-const MANIFEST_VERIFY_INTERVAL_MS = numEnv('PROVISION_MANIFEST_VERIFY_INTERVAL_MS', 2000);
-
-// ---------------------------------------------------------------------------
-// Lazy dep load (so --help / arg errors need no Postgres).
-// ---------------------------------------------------------------------------
-let _deps;
-function loadDeps() {
-  if (_deps) return _deps;
-  // eslint-disable-next-line global-require
-  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
-  // eslint-disable-next-line global-require
-  const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning'));
-  // Cross-site identity (ADR 0141 §4, task #1002109). Resolve the hub-side module by a
-  // VARIABLE key, gated on isModuleEnabled — the module-loader's own dynamic-dispatch
-  // pattern (the run-unit-tests.js precedent), NOT a static 'modules/platform-identity/'
-  // literal that would couple this publishable core file to an instance-EXCLUDED module
-  // (fitness Check 16b / task 2135). A vanilla core that neither ships nor enables the
-  // module never resolves it → no MODULE_NOT_FOUND on a fresh boot. Null here → federation
-  // dormant (shouldFederate skips) → the instance owns its auth, byte-identical to today.
-  let platformIdentity = null, hubKeys = null, projectCatalog = null;
-  const PI_KEY = 'platform-identity';
-  let piEnabled = false;
-  try { piEnabled = require(path.join(REPO_ROOT, 'src/modules')).isModuleEnabled(PI_KEY); } catch { piEnabled = false; }
-  if (piEnabled) {
-    const piBase = path.join(REPO_ROOT, 'modules', PI_KEY);
-    try { platformIdentity = require(path.join(piBase, 'platform-identity')); hubKeys = require(path.join(piBase, 'hub-keys')); projectCatalog = require(path.join(piBase, 'project-catalog')); }
-    catch { platformIdentity = null; hubKeys = null; projectCatalog = null; }
-  }
-  _deps = { pool, provisioning, platformIdentity, hubKeys, projectCatalog };
-  return _deps;
-}
-
-// ---------------------------------------------------------------------------
-// PURE step-command generators (exported for tests). Each returns the exact shell
-// command a runbook step runs. Kept pure so the runbook and its tests build from ONE
-// source of truth.
-// ---------------------------------------------------------------------------
-
-// A slug is validated DNS/db-safe upstream (provisioning.isValidSlug), so it is
-// already shell-safe (only [a-z0-9-]). We still never interpolate untrusted text.
-
-module.exports = {
-  CONFIG,
-  MANIFEST_UA,
-  MANIFEST_VERIFY_INTERVAL_MS,
-  MANIFEST_VERIFY_TRIES,
-  MAX_INTENT_ATTEMPTS,
-  REPO_ROOT,
-  coreVersionSafe,
-  hasFlag,
-  loadDeps,
-  numEnv,
-  oauthSecret,
-  provisionerBotEmail,
-  provisionerBotName,
-  softFailResult,
-};
+require('../bongos/forwarder.js').forward(module, 'provision-config.js');