@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/provision-pin-key.js

@@ -1,176 +1,6 @@
+// scripts/gds/provision-pin-key.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-pin-key.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// provision-pin-key.js — the hub's per-project WRITE deploy key (task 1004291, ADR 0350,
-// amending ADR 0176).
-//
-// WHY. A hosted project's upgrade commits a new core pin in the project's checkout, and
-// the hub pushes it to the owner's GitHub repo (task 1004065, pushUpgradePin). The owner's
-// token that would do that is stored for one hour only, and the checkout's own `origin`
-// is a READ-ONLY deploy key (ADR 0176) — so most pushes ended "GitHub was not updated" and
-// the box and the repo drifted. A second deploy key, registered WRITABLE and held by the
-// runner alone, is the lasting credential.
-//
-// WHERE IT LIVES AND WHO CAN READ IT. Outside every project checkout, in a directory of
-// the RUNNER's own account (mode 0700, key 0600). The project's own unix account
-// (bongos-<slug>, ADR 0281) can read neither. A project still running as the shared app
-// user has the SAME uid as the runner and could read it, so it is REFUSED a key
-// ("needs its own account first") rather than handed one.
-//
-// NEVER THROWS. A failure to mint is a missed convenience, not a broken standup: every
-// path returns `{ skipped }` and logs. The read-only pull key (deployKeyPath in
-// provision-repo.js) is untouched by anything here.
-
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { REPO_ROOT } = require('./provision-config.js');
-const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
-const { instanceUser, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo.js');
-
-const NEEDS_OWN_ACCOUNT = 'needs its own account first';
-
-// Both names below reach a shell (ssh-keygen -C/-f, rm -f), so the slug is checked HERE, at
-// the point of use, rather than trusting that some caller validated it first.
-function safeSlug(inst) {
-  const slug = inst && inst.slug;
-  if (!isValidSlug(slug)) throw new Error(`refusing to build a write-key path from an invalid slug ${JSON.stringify(slug)}`);
-  return slug;
-}
-function pinKeyTitle(inst) { return `cloudbongos-pin-${safeSlug(inst)}`; }
-
-// The runner-only directory. PROVISION_PIN_KEY_DIR pins it; otherwise it sits under the
-// runner account's own home. Never under standaloneBase, so it can never ride along with
-// (or be reached through) a project checkout.
-function pinKeyDir(deps = {}) {
-  const pinned = deps.pinKeyDir || process.env.PROVISION_PIN_KEY_DIR;
-  if (pinned) return String(pinned).replace(/\\/g, '/');
-  return path.posix.join(os.homedir().replace(/\\/g, '/'), '.config', 'cloudbongos', 'pin-keys');
-}
-function pinKeyPath(inst, deps = {}) { return path.posix.join(pinKeyDir(deps), `${safeSlug(inst)}.key`); }
-
-const failed = (r) => !r || r.softFailed === true || r.ok === false;
-
-// Does this project have a unix account of its own? Fail CLOSED: only a positive answer
-// counts, because the wrong guess hands a tenant process the key that pushes to the
-// owner's repo.
-function hasOwnAccount(inst, exec) {
-  let account;
-  try { account = instanceUser(inst); } catch { return false; }
-  const r = exec(`id -u ${account}`, { allowFail: true });
-  return !failed(r) && /^\d+$/.test(String((r && r.stdout) || '').trim());
-}
-
-// Create the directory (0700) and mint the key (0600), then PROVE the modes: a key that
-// GitHub trusts to write must never be group- or world-readable.
-function mintLocal(inst, exec, deps) {
-  const dir = pinKeyDir(deps), keyPath = pinKeyPath(inst, deps), title = pinKeyTitle(inst);
-  exec(`(umask 077 && mkdir -p ${dir}) && chmod 700 ${dir}`);
-  exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
-  exec(`(umask 077 && ssh-keygen -q -t ed25519 -N '' -C ${title} -f ${keyPath})`);
-  exec(`chmod 600 ${keyPath}`);
-  const modes = exec(`stat -c '%a' ${dir} ${keyPath}`, { allowFail: true });
-  const got = String((modes && modes.stdout) || '').trim().split(/\s+/);
-  if (failed(modes) || got[0] !== '700' || got[1] !== '600') {
-    exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
-    throw new Error(`the write key's permissions could not be confirmed as 700/600 (saw ${got.join('/') || 'nothing'})`);
-  }
-  return keyPath;
-}
-
-const keyBody = (k) => String(k || '').trim().split(/\s+/).slice(0, 2).join(' ');
-
-/**
- * Make sure a per-project WRITE deploy key exists locally and is registered on the repo
- * with `read_only: false`. `opts.token` is an owner token already in hand. Idempotent
- * (by title; a stale or read-only same-title registration is replaced). NEVER THROWS.
- * Returns `{ minted, keyPath }` or `{ skipped: <why>, note }`.
- */
-async function ensurePinWriteKey(inst, deps, opts = {}) {
-  const log = deps.log || (() => {});
-  const exec = deps.controlExec || deps.exec;
-  if (!inst || inst.hosting_shape !== 'cloud-host') return { skipped: 'shape' };
-  if (!isValidSlug(inst.slug)) return { skipped: 'invalid_slug' };
-  const repo = parseTargetRef(inst.target_ref);
-  if (!repo) return { skipped: 'no_repo' };
-  if (deps.apply === false) {
-    log(`  [pin-key] would mint a writable deploy key "${pinKeyTitle(inst)}" for ${repo.owner}/${repo.name}, held by the runner outside the checkout (ADR 0350)`);
-    return { planned: true };
-  }
-  try {
-    if (!hasOwnAccount(inst, exec)) {
-      log(`  [pin-key] ${inst.slug} ${NEEDS_OWN_ACCOUNT} — no write key minted (it runs as the runner's own user and could read it; ADR 0350)`);
-      return { skipped: 'needs_own_account', note: `This project ${NEEDS_OWN_ACCOUNT}.` };
-    }
-    const token = opts.token || await resolveOwnerGithubToken(inst, deps, { tag: '[pin-key]' });
-    if (!token) return { skipped: 'no_token' };
-    const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
-    const info = await gh.getUserRepo(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
-    if (info && info.admin === false) {
-      log(`  [pin-key] the owner's credential is not admin on ${repo.owner}/${repo.name}; a deploy key needs admin — no write key minted`);
-      return { skipped: 'not_admin' };
-    }
-    const fsImpl = deps.fsImpl || fs;
-    const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
-    const target = { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl };
-    if (!fsImpl.existsSync(keyPath) || !fsImpl.existsSync(`${keyPath}.pub`)) mintLocal(inst, exec, deps);
-    let pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
-    const ours = (await gh.listDeployKeys(token, target)).find((k) => k.title === title);
-    if (ours && keyBody(ours.key) === keyBody(pub) && ours.read_only === false) {
-      return { minted: false, keyPath };
-    }
-    if (ours) await gh.deleteDeployKey(token, { ...target, keyId: ours.id });
-    const add = () => gh.addDeployKey(token, { ...target, title, key: pub, readOnly: false });
-    let added;
-    try { added = await add(); } catch (e) {
-      if (!e || e.code !== 'key_in_use') throw e;
-      mintLocal(inst, exec, deps);
-      pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
-      added = await add();
-    }
-    if (added && added.read_only === true) {
-      // GitHub registered it read-only anyway: it would never write, and a key that looks
-      // like a write key but is not is worse than none.
-      await gh.deleteDeployKey(token, { ...target, keyId: added.id }).catch(() => {});
-      return { skipped: 'registered_read_only' };
-    }
-    log(`  [pin-key] registered writable deploy key "${title}" on ${repo.owner}/${repo.name}`);
-    return { minted: true, keyPath };
-  } catch (e) {
-    log(`  [pin-key] write key not set up for ${inst.slug}: ${(e && e.message) || e}`);
-    return { skipped: 'failed', note: String((e && e.message) || e).slice(0, 160) };
-  }
-}
-
-// The `-c` that points ONE git push at the write key. IdentitiesOnly + -F /dev/null so no
-// agent or ~/.ssh/config identity can answer instead. PURE.
-function pinSshCommand(keyPath) {
-  return `core.sshCommand="ssh -F /dev/null -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`;
-}
-
-/**
- * Remove the write key: the registration (when a token is at hand) and the local files.
- * Best effort, never throws. `keys` is an already-fetched deploy-key list, to save a call.
- */
-async function revokePinWriteKey(inst, deps, { token = null, repo = null, keys = null } = {}) {
-  const log = deps.log || (() => {});
-  const exec = deps.controlExec || deps.exec;
-  const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
-  if (token && repo) {
-    try {
-      const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
-      const list = keys || await gh.listDeployKeys(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
-      const ours = list.find((k) => k.title === title);
-      if (ours) {
-        if (deps.apply === false) log(`  would revoke the "${title}" deploy key on ${repo.owner}/${repo.name} if present`);
-        else {
-          await gh.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
-          log(`  revoked the "${title}" write deploy key on ${repo.owner}/${repo.name}`);
-        }
-      }
-    } catch (e) { log(`  (write-key revoke skipped: ${(e && e.message) || e})`); }
-  } else if (repo) {
-    log(`  (write-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${title}" deploy key, remove it in the repo's settings)`);
-  }
-  if (deps.apply !== false) exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
-}
-
-module.exports = { NEEDS_OWN_ACCOUNT, hasOwnAccount, pinKeyTitle, pinKeyDir, pinKeyPath, ensurePinWriteKey, revokePinWriteKey, pinSshCommand };
+require('../bongos/forwarder.js').forward(module, 'provision-pin-key.js');

package/scripts/gds/provision-pin-replay.js

@@ -1,126 +1,6 @@
+// scripts/gds/provision-pin-replay.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-pin-replay.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// provision-pin-replay.js — when GitHub is AHEAD of a hosted project's box, put the core move's
-// pin commit on top of GitHub's history instead of leaving GitHub on the old core (task 1004733,
-// ADR 0350 amendment).
-//
-// WHY. pushUpgradePin pushes the pin commit the move made on the box. For a project the owner
-// works from a laptop, GitHub almost always has commits the box does not, so that push is
-// refused as non-fast-forward ("behind"). Before this file the move then finished `done` with a
-// repo_not_updated note: the box ran the new core, GitHub still named the old one, and the next
-// deploy from GitHub could quietly roll the core back.
-//
-// WHAT IT DOES. Fetch the branch over the SAME credential that was refused, replay ONLY the pin
-// commit (package.json + package-lock.json, and any generated file upgrade.js committed with it)
-// on top of what was fetched, and push that — an ordinary fast-forward, never forced.
-//
-// THE LIVE BOX IS NOT TOUCHED. The replay happens in a scratch worktree (mode 0700, outside the
-// checkout, removed whatever happened). The box's HEAD, files and running site stay exactly what
-// the move's health check proved, which is why the old "nothing is rebased" rule (changing what
-// the box runs with no restart and no health check) still holds.
-//
-// A REAL CONFLICT STOPS. If the owner changed the same lines of those files, choosing between the
-// two is a person's call: the cherry-pick is aborted, nothing is pushed, and the note names the
-// files ("conflict"). Anything else that goes wrong reports, never retries in a loop.
-//
-// OUT OF SCOPE, ON PURPOSE: the box picking up the owner's OTHER commits. Nothing pulls them onto
-// a hosted box after provisioning (standalonePullCmd runs at provision time only, provision.js);
-// merging them into a live checkout here would deploy the owner's code with no install, migrate,
-// restart or health check — a deploy, not a pin push. ADR 0350's amendment records that ruling.
-//
-// NEVER THROWS: the caller turns a throw into a broken instance, and this instance is running.
-
-const crypto = require('node:crypto');
-const os = require('node:os');
-
-// The subject upgrade.js persistPin gives the pin commit. Anything else at HEAD is not ours to
-// replay onto someone's history.
-const PIN_SUBJECT_RE = /^pin @bongos\/core /;
-const PIN_FILES = ['package.json', 'package-lock.json'];
-const SHA_RE = /^[0-9a-f]{40,64}$/;
-// A scratch path the shell may see unquoted (the tmp dir itself is the runner's, but checked).
-const SAFE_PATH_RE = /^[A-Za-z0-9_./:~-]+$/;
-
-const failedRun = (r) => !r || r.softFailed === true || r.ok === false;
-const out = (r) => String((r && r.stdout) || '').trim();
-
-/**
- * Replay the box's pin commit onto the branch GitHub has, and push it.
- *
- * @param {object} o
- *   exec        the CONTROL PLANE executor (the one pushUpgradePin pushed with)
- *   instanceDir the project's checkout on the hub
- *   branch      the branch pushUpgradePin pushed (already BRANCH_RE-checked)
- *   git         the credentialed, hardened git prefix that was refused as behind
- *   remote      the remote that same push named
- *   env         that push's env (GIT_TERMINAL_PROMPT=0)
- *   slug        the project's (validated) slug, for the scratch path's name
- *   tmpDir      where the scratch worktree goes (default os.tmpdir())
- *   pushFault, gitLine  pushUpgradePin's own readers of a git refusal
- * @returns {{ ok:true, replayed?:true, already?:true } | { ok:false, code:string, extra:string }}
- */
-function replayPinCommit(o) {
-  try { return replay(o); } catch (e) {
-    return { ok: false, code: 'failed', extra: `(the pin could not be replayed: ${String((e && e.message) || e).slice(0, 160)})` };
-  }
-}
-
-function replay({ exec, instanceDir, branch, git, remote, env, slug, tmpDir, pushFault, gitLine, log = () => {} }) {
-  const plain = `git -C ${instanceDir} -c core.hooksPath=/dev/null`;
-  const run = (cmd, extraEnv) => exec(cmd, { allowFail: true, env: { ...env, ...(extraEnv || {}) } });
-
-  // 1. HEAD must be the move's own pin commit, with one parent, or there is nothing of ours to replay.
-  const head = run(`${plain} log -1 --format=%H%n%P%n%cn%n%ce%n%s HEAD`);
-  const [sha, parents, cn, ce, subject] = out(head).split('\n');
-  if (failedRun(head) || !SHA_RE.test(sha || '') || String(parents || '').split(' ').length !== 1 || !PIN_SUBJECT_RE.test(subject || '')) {
-    return { ok: false, code: 'behind', extra: '(the newest change on the server is not the version change, so it was not added on top)' };
-  }
-
-  // 2. What GitHub has now, over the same credential. Only FETCH_HEAD is written for it.
-  const fetched = run(`${git} fetch --no-tags ${remote} ${branch}`);
-  if (failedRun(fetched)) return { ok: false, code: 'behind', extra: gitLine(fetched) };
-  const upR = run(`${plain} rev-parse FETCH_HEAD`);
-  const up = out(upR);
-  if (failedRun(upR) || !SHA_RE.test(up)) return { ok: false, code: 'behind', extra: '(could not read what GitHub has)' };
-
-  // Already pinned the same way upstream (the owner bumped it by hand): nothing to add.
-  const same = run(`${plain} diff --quiet ${up} ${sha} -- ${PIN_FILES.join(' ')}`);
-  if (!failedRun(same)) return { ok: true, already: true };
-
-  // 3. Replay in a private scratch worktree, so the live checkout never moves.
-  const base = String(tmpDir || os.tmpdir()).replace(/\\/g, '/').replace(/\/+$/, '');
-  const wt = `${base}/bongos-pin-replay-${slug}-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
-  if (!SAFE_PATH_RE.test(wt)) return { ok: false, code: 'failed', extra: '(no safe scratch folder to replay the version change in)' };
-  try {
-    const made = run(`umask 077 && mkdir ${wt}`);
-    const added = failedRun(made) ? made : run(`${plain} worktree add --detach ${wt} ${up}`);
-    if (failedRun(added)) return { ok: false, code: 'failed', extra: gitLine(added) };
-    const at = `git -C ${wt} -c core.hooksPath=/dev/null`;
-    // The pin commit keeps its author and message; its committer stays who committed it on the
-    // box (env, not argv — a name is never shell-interpolated).
-    const who = cn && ce ? { GIT_COMMITTER_NAME: cn, GIT_COMMITTER_EMAIL: ce } : {};
-    const picked = run(`${at} cherry-pick ${sha}`, who);
-    if (failedRun(picked)) {
-      const both = out(run(`${at} diff --name-only --diff-filter=U`)).split('\n').filter(Boolean);
-      run(`${at} cherry-pick --abort`);
-      if (both.length) return { ok: false, code: 'conflict', extra: `(changed on both sides: ${both.join(', ').slice(0, 200)})` };
-      return { ok: false, code: 'failed', extra: gitLine(picked) };
-    }
-    const nextR = run(`${at} rev-parse HEAD`);
-    const next = out(nextR);
-    if (failedRun(nextR) || !SHA_RE.test(next)) return { ok: false, code: 'failed', extra: '(the replayed version change could not be read back)' };
-
-    // 4. A plain fast-forward of GitHub's branch to the replayed commit. A second refusal
-    // (someone pushed in between) is reported, not chased.
-    const pushed = run(`${git} push ${remote} ${next}:refs/heads/${branch}`);
-    if (failedRun(pushed)) return { ok: false, code: pushFault(pushed), extra: gitLine(pushed) };
-    log(`  ✓ GitHub had newer commits: the pin was added on top of them (${next.slice(0, 12)})`);
-    return { ok: true, replayed: true };
-  } finally {
-    // Not --force: the abort above leaves it clean, and the rm + prune catch anything left.
-    run(`${plain} worktree remove ${wt}`);
-    run(`rm -rf ${wt}`);
-    run(`${plain} worktree prune`);
-  }
-}
-
-module.exports = { replayPinCommit };
+require('../bongos/forwarder.js').forward(module, 'provision-pin-replay.js');

package/scripts/gds/provision-process.js

@@ -1,170 +1,6 @@
-// scripts/gds/provision-process.js — WHAT SUPERVISES an instance's long-running
-// service, as a seam rather than a hardcoded string (task 1003997, ADR 0306).
-//
-// The standup used to reach for `systemctl` inline at fifteen call sites, which is fine
-// on a systemd box and impossible anywhere else: the self-host image runs USER node with
-// no sudo and boots no systemd at all. Pointing the unit path somewhere writable does not
-// help — what varies is not where the unit file goes, it is what runs the process.
-//
-// A manager answers four questions: install+enable the service, install its nightly
-// backup schedule, restart it, remove it. Each takes the instance row and an `io` of the
-// SAME shape the runbook already threads around — { exec, writeFile, sudoP, log } — so
-// the dry-run, remote-ssh and logging behaviour of makeExec/makeWriteFile carries over
-// untouched (ADR 0130). Nothing here executes anything itself.
-//
-// systemd is the default and its commands are BYTE-IDENTICAL to the strings it replaced;
-// tests/provision.mjs pins them. The live box boots systemd, so it keeps systemd.
-
+// scripts/gds/provision-process.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-process.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { CONFIG, REPO_ROOT } = require('./provision-config.js');
-const { CORE_PKG_DIR, appGroupExpr, appUser, instanceUser, standaloneRoot } = require('./provision-repo.js');
-const {
-  backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath,
-  backupUnitName, serviceUnit, serviceUnitPath,
-} = require('./provision-units.js');
-
-// ── systemd — the default, and what every live box runs ──────────────────────
-const systemd = {
-  key: 'systemd',
-
-  installService(inst, { exec, writeFile, sudoP }) {
-    writeFile(serviceUnitPath(inst), serviceUnit(inst), { mode: 0o644, sudo: true });
-    exec(`${sudoP}systemctl daemon-reload`);
-    exec(`${sudoP}systemctl enable --now ${inst.slug}`);
-  },
-
-  // The backup DIR belongs to this step, not to the runbook: it exists only to serve the
-  // schedule, so a manager that installs no schedule must not create it either.
-  installBackup(inst, { exec, writeFile, sudoP }) {
-    exec(`${sudoP}install -d -o ${appUser()} -g ${appGroupExpr()} -m 0750 ${CONFIG.backupDir}`);
-    writeFile(backupServicePath(inst), backupService(inst), { mode: 0o644, sudo: true });
-    writeFile(backupTimerPath(inst), backupTimer(inst), { mode: 0o644, sudo: true });
-    exec(`${sudoP}systemctl daemon-reload`);
-    exec(`${sudoP}systemctl enable --now ${backupUnitName(inst)}.timer`);
-    return { installed: true };
-  },
-
-  restartService(inst, { exec, sudoP }) {
-    exec(`${sudoP}systemctl restart ${inst.slug}`);
-  },
-
-  // Teardown. Every step allowFail: a half-provisioned instance must still tear down.
-  // reset-failed is not optional (task 1003940): a removed unit's FAILED state outlives
-  // its file, so without it `systemctl --failed` lists torn-down ghosts for weeks.
-  removeService(inst, { exec, sudoP }) {
-    exec(`${sudoP}systemctl disable --now ${inst.slug}`, { allowFail: true });
-    exec(`${sudoP}rm -f ${serviceUnitPath(inst)}`, { allowFail: true });
-    exec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
-    exec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
-    // the caps drop-in `provision.js apply-caps` wrote (task 1004414, provision-caps.js)
-    exec(`${sudoP}rm -f /etc/systemd/system.control/${inst.slug}.service.d/50-*.conf`, { allowFail: true });
-    exec(`${sudoP}rmdir /etc/systemd/system.control/${inst.slug}.service.d`, { allowFail: true });
-    exec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
-    exec(`${sudoP}systemctl reset-failed ${inst.slug}.service ${backupUnitName(inst)}.service`, { allowFail: true });
-  },
-};
-
-// ── supervisord — the container implementation ───────────────────────────────
-// No sudo anywhere: the self-host image runs as an unprivileged user that already owns
-// its conf dir, so escalation would fail rather than help.
-function supervisorConfPath(inst) {
-  return path.posix.join(CONFIG.supervisorConfDir, `${inst.slug}.conf`);
-}
-
-// The ExecStart equivalent, resolved the same way serviceUnit resolves it so the two
-// cannot drift: a standalone runs out of its own pinned core, anything else out of this
-// checkout.
-function programCommand(inst) {
-  return inst.hosting_shape === 'cloud-host'
-    ? `/usr/bin/node ${CORE_PKG_DIR}/src/platform-server.js`
-    : '/usr/bin/node src/platform-server.js';
-}
-
-function supervisorProgram(inst, { etcBase = CONFIG.etcBase } = {}) {
-  const workDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : REPO_ROOT;
-  return `[program:${inst.slug}]
-; Cloud Bongos instance — ${inst.slug} (provisioned by provision.js, ADR 0306)
-command=${programCommand(inst)}
-directory=${workDir}
-; The isolation systemd spells User=/Group= (ADR 0281). A shared uid would let every
-; instance on this plane read its siblings' /proc/<pid>/environ — every OAuth cred in
-; the env file below. Dropping this line silently removes that boundary.
-user=${instanceUser(inst)}
-environment=HOME="${path.posix.join(etcBase, inst.slug)}",PGDATABASE="${inst.db_name || inst.slug}",PORT="${inst.port}"
-autostart=true
-autorestart=true
-startsecs=3
-stdout_logfile=/var/log/supervisor/${inst.slug}.log
-redirect_stderr=true
-`;
-}
-
-const supervisord = {
-  key: 'supervisord',
-
-  installService(inst, { exec, writeFile }) {
-    writeFile(supervisorConfPath(inst), supervisorProgram(inst), { mode: 0o644 });
-    exec('supervisorctl reread');
-    exec('supervisorctl update');
-    exec(`supervisorctl start ${inst.slug}`);
-  },
-
-  // supervisord supervises processes, not schedules — it has no timer concept. Rather
-  // than re-implement cron badly, install nothing and hand the operator the exact line
-  // (ADR 0306). LOUD on purpose: a self-host with no automatic DB backup must not be a
-  // thing anyone discovers after they need one.
-  installBackup(inst, { log }) {
-    // The env the dump needs is LIFTED from the systemd unit rather than retyped, so the
-    // crontab line and the unit cannot drift and the variable names live in one place.
-    const env = backupService(inst).split('\n')
-      .filter((l) => l.startsWith('Environment='))
-      .map((l) => l.slice('Environment='.length))
-      .join(' ');
-    log(`    (no backup schedule: ${supervisord.key} has no timers — add this to a crontab instead)`);
-    log(`      0 4 * * *  ${env} /bin/bash ${backupScriptPath(inst)}`);
-    return { installed: false, reason: 'supervisord has no timer concept' };
-  },
-
-  restartService(inst, { exec }) {
-    exec(`supervisorctl restart ${inst.slug}`);
-  },
-
-  removeService(inst, { exec }) {
-    exec(`supervisorctl stop ${inst.slug}`, { allowFail: true });
-    exec(`rm -f ${supervisorConfPath(inst)}`, { allowFail: true });
-    exec('supervisorctl reread', { allowFail: true });
-    exec('supervisorctl update', { allowFail: true });
-  },
-};
-
-const MANAGERS = { systemd, supervisord };
-
-// Was this host booted under systemd? /run/systemd/system is the check sd_booted(3)
-// makes and the one systemd documents for exactly this question — it exists only when
-// systemd is PID 1, so a container answers no without us guessing at container-ness.
-function systemdIsBooted(fsImpl) {
-  try { return fsImpl.existsSync('/run/systemd/system'); } catch { return false; }
-}
-
-// Explicit → probed → default. An unrecognised knob value throws rather than falling
-// back: silently supervising an instance a different way than the operator asked is
-// worse than refusing to provision.
-function resolveProcessManager({ env = process.env, fsImpl = fs } = {}) {
-  const want = String(env.PROVISION_PROCESS_MANAGER || '').trim().toLowerCase();
-  if (want) {
-    if (MANAGERS[want]) return MANAGERS[want];
-    throw new Error(`PROVISION_PROCESS_MANAGER=${want} is not a known process manager (${Object.keys(MANAGERS).join(', ')})`);
-  }
-  return systemdIsBooted(fsImpl) ? systemd : supervisord;
-}
-
-module.exports = {
-  resolveProcessManager,
-  supervisorConfPath,
-  supervisorProgram,
-  supervisord,
-  systemd,
-};
+require('../bongos/forwarder.js').forward(module, 'provision-process.js');