@bongos/core 1.21.92 → 1.21.94

package/scripts/gds/fitness.js

@@ -609,6 +609,12 @@ const KERNEL_FILES = [
   // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
   // (https, zlib), so joining costs nothing.
   'src/bongos/package-registry.js',
+  // task 1004657 (ADR 0363 D5): requireActAlone, the gate a building's own page mounts
+  // after its permission gate — the same trust-gate category as auth.js, re-exported
+  // by the doorway, so leaving it off reads as a kernel->non-kernel leak. It imports
+  // only module-seams.js and logger.js (both on this roster) and reaches the
+  // government module through its port, never by require.
+  'src/bongos/act-alone.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a
@@ -641,6 +647,7 @@ const KERNEL_NAMES_MODULES_OK = new Set([
   'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
   'src/bongos/auth-idp.js',              // same, on the federated path
   'src/bongos/auth-discord.js',          // the Discord account-link flow itself
+  'src/bongos/act-alone.js',             // resolves the 'government' port by key for checkActAlone (task 1004657)
   'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
   'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
   'src/role-responsibilities.js',        // the ideator's VERBATIM statement reads "Make good ideas" — the English word, colliding with the `ideas` key. Owner text; unparaphrasable.

package/scripts/gds/oauth-secret.js

@@ -172,12 +172,14 @@ function main() {
   cp.execSync(`systemctl restart ${slug}`, { stdio: 'inherit' });
   console.log(`✓ restarted ${slug}`);
 
-  // (3) VERIFY — probe /healthz for auth_configured (retry briefly for restart).
+  // (3) VERIFY — probe the JSON health answer for auth_configured (retry briefly for
+  // restart). /api/bongos/healthz, not the root /healthz, which answers a plain "ok"
+  // that never parses (task 1004577).
   if (!port) { console.error('✖ no PORT in web.env and no --port given — cannot probe /healthz'); process.exit(1); }
   let probe = { authConfigured: false };
   for (let i = 0; i < 10; i++) {
     try {
-      const out = cp.execSync(`curl -sS --max-time 5 http://127.0.0.1:${port}/healthz`, { stdio: ['ignore', 'pipe', 'pipe'] }).toString();
+      const out = cp.execSync(`curl -sS --max-time 5 http://127.0.0.1:${port}/api/bongos/healthz`, { stdio: ['ignore', 'pipe', 'pipe'] }).toString();
       probe = parseHealthzAuth(out);
       if (probe.ok || probe.authConfigured) break;
     } catch { /* not up yet */ }

package/scripts/gds/provision-github-setup.js

@@ -0,0 +1,148 @@
+'use strict';
+// scripts/gds/provision-github-setup.js — the control-plane runner's check of the two
+// GitHub steps a founder finishes ON GITHUB after the app exists: "Install it on your repo"
+// and "Command-line sign-in is on" (task 1004649; the checklist is derived in
+// modules/provisioning/github-setup.js).
+//
+// WHY THE RUNNER. Only the runner holds the app's credentials (it placed them in the
+// project's chmod-600 web.env; ADR 0111 §2 / ADR 0133 — the web tier never sees a secret).
+// The setup_url redirect GitHub sends after an install carries an installation_id, but
+// GitHub's own docs warn it can be spoofed, so a tick needs GitHub's answer to a question
+// asked with the app's own key:
+//   install — GET /repos/{owner}/{repo}/installation, authenticated as the app (a JWT
+//             signed with its private key). 200 with an id = installed on THIS repo.
+//   device  — POST github.com/login/device/code with the app's client id. GitHub answers a
+//             device code when device flow is on and `device_flow_disabled` when it is off.
+//             The unused code simply expires; nothing is signed in. GitHub has NO manifest
+//             field and NO API that turns device flow on (spike, task 1004649), so this
+//             only ever OBSERVES the founder's own tick on GitHub.
+// A verified fact is recorded once as a provisioning_events row; the checklist reads it.
+//
+// BOUNDED. Only attempts that settled within VERIFY_WINDOW_MS, or whose install was
+// reported within it, are checked, at most SWEEP_LIMIT per tick — so a finished or
+// abandoned project costs nothing, and a founder who ticks device flow later re-opens the
+// window by reinstalling or from the hall (task 1004652 owns "check again").
+// Secrets: web.env is read on the box, parsed in memory, and only NAMES ever reach a log.
+
+const crypto = require('node:crypto');
+const { webEnvPath } = require('./provision-units.js');
+const { SETUP_EVENTS, VERIFY_WINDOW_MS, githubSetupFacts, targetRepo } = require('../../modules/provisioning/github-setup.js');
+
+const SWEEP_LIMIT = 20;
+const UA = 'cloud-bongos-provisioner';
+
+function b64url(input) {
+  return Buffer.from(input).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+// An app JWT (RS256, 9 minutes, iat backdated for skew) — GitHub's app authentication.
+function appJwt({ appId, pem, nowSec = Math.floor(Date.now() / 1000) }) {
+  const head = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));
+  const body = b64url(JSON.stringify({ iat: nowSec - 60, exp: nowSec + 9 * 60, iss: String(appId) }));
+  const signer = crypto.createSign('RSA-SHA256');
+  signer.update(`${head}.${body}`);
+  signer.end();
+  return `${head}.${body}.${b64url(signer.sign(pem))}`;
+}
+
+// The app's id, private key and client id out of a web.env body. The pem is stored as one
+// line with literal \n (provision-units.js webEnvBody); the client id under the pack's
+// prefix, which this does not need to know. Missing pieces are null. PURE.
+function appCredsFromEnv(body) {
+  const val = (re) => { const m = String(body || '').match(re); return m ? m[1].trim() : null; };
+  const pemLine = val(/^GITHUB_APP_PRIVATE_KEY=(.+)$/m);
+  return {
+    appId: val(/^GITHUB_APP_ID=(\d+)\s*$/m),
+    pem: pemLine ? pemLine.replace(/\\n/g, '\n') : null,
+    clientId: val(/^[A-Z0-9_]+_GITHUB_CLIENT_ID=(\S+)\s*$/m),
+  };
+}
+
+// Is the app installed on owner/repo? true · false (404: the app is real, not installed
+// there) · null (cannot tell — any other answer, or no network).
+async function installedOnRepo({ appId, pem, repo, fetchImpl = globalThis.fetch }) {
+  try {
+    const res = await fetchImpl(`https://api.github.com/repos/${repo}/installation`, {
+      headers: { Authorization: `Bearer ${appJwt({ appId, pem })}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28', 'User-Agent': UA },
+    });
+    if (res.status === 404) return false;
+    if (!res.ok) return null;
+    const j = await res.json().catch(() => null);
+    return !!(j && j.id != null);
+  } catch (_) { return null; }
+}
+
+// Does GitHub accept a device-flow start for this client id? true · false
+// (device_flow_disabled) · null (any other answer — never read as "off").
+async function deviceFlowOn({ clientId, fetchImpl = globalThis.fetch }) {
+  try {
+    const res = await fetchImpl('https://github.com/login/device/code', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': UA },
+      body: `client_id=${encodeURIComponent(clientId)}`,
+    });
+    const j = await res.json().catch(() => null);
+    if (j && j.device_code) return true;
+    if (j && /device_flow_disabled/.test(String(j.error || ''))) return false;
+    return null;
+  } catch (_) { return null; }
+}
+
+// The attempts worth checking this tick: each instance's LATEST attempt, past the
+// credential placement (an app id recorded), settled or reported within the window.
+async function attemptsToVerify(db) {
+  const windowSec = Math.round(VERIFY_WINDOW_MS / 1000);
+  const { rows } = await db.query(
+    `WITH latest AS (
+       SELECT DISTINCT ON (instance_id) * FROM provisioning_oauth_manifests ORDER BY instance_id, created_at DESC)
+     SELECT l.id, l.instance_id, l.created_at, l.requested_by, i.slug, i.target_ref, i.hosting_shape, i.status AS instance_status
+       FROM latest l JOIN provisioning_instances i ON i.id = l.instance_id
+      WHERE l.app_id IS NOT NULL AND l.status IN ('done', 'error') AND i.status = 'active'
+        AND (l.updated_at > now() - ($1 * interval '1 second')
+             OR EXISTS (SELECT 1 FROM provisioning_events e WHERE e.instance_id = l.instance_id
+                         AND e.event = $2 AND e.created_at > now() - ($1 * interval '1 second')))
+      ORDER BY l.updated_at DESC LIMIT ${SWEEP_LIMIT}`,
+    [windowSec, SETUP_EVENTS.installReported]);
+  return rows;
+}
+
+// One tick: for every attempt in the window, check whatever is not verified yet and record
+// what GitHub confirmed. Returns { checked, installed, deviceFlow }.
+async function verifyGithubAppSetups(deps) {
+  const { db, provisioning, log, apply } = deps;
+  const out = { checked: 0, installed: 0, deviceFlow: 0 };
+  const rows = await attemptsToVerify(db);
+  if (!apply) {
+    for (const r of rows) log(`  would check the GitHub install + device flow for ${r.slug} (manifest #${r.id})`);
+    return out;
+  }
+  for (const r of rows) {
+    const facts = await githubSetupFacts(db, r.instance_id, r.created_at);
+    if (facts.installedAt && facts.deviceFlowAt) continue;
+    const onControlBox = r.hosting_shape === 'cloud-host' || r.hosting_shape === 'control-plane';
+    const boxExec = onControlBox ? (deps.controlExec || deps.exec) : deps.exec;
+    const read = boxExec(`${deps.privileged ? 'sudo ' : ''}cat ${webEnvPath(r)}`, { allowFail: true });
+    const creds = appCredsFromEnv(read && read.stdout);
+    out.checked++;
+    const repo = targetRepo(r);
+    const fetchImpl = deps.fetchImpl;
+    if (!facts.installedAt && creds.appId && creds.pem && repo) {
+      if (await installedOnRepo({ appId: creds.appId, pem: creds.pem, repo, fetchImpl })) {
+        await provisioning.recordEvent(db, { instanceId: r.instance_id, ownerBuilderId: r.requested_by, event: SETUP_EVENTS.installed,
+          detail: `the GitHub app is installed on ${repo} (checked with the app's own key)`, actor: 'runner' });
+        out.installed++; log(`  ✓ ${r.slug}: GitHub app installed on ${repo}`);
+      }
+    }
+    if (!facts.deviceFlowAt && creds.clientId) {
+      if (await deviceFlowOn({ clientId: creds.clientId, fetchImpl })) {
+        await provisioning.recordEvent(db, { instanceId: r.instance_id, ownerBuilderId: r.requested_by, event: SETUP_EVENTS.deviceFlow,
+          detail: 'command-line sign-in (device flow) is on for the GitHub app', actor: 'runner' });
+        out.deviceFlow++; log(`  ✓ ${r.slug}: command-line sign-in is on`);
+      }
+    }
+  }
+  if (out.checked) log(`github-setup — checked=${out.checked} installed=${out.installed} device-flow=${out.deviceFlow}`);
+  return out;
+}
+
+module.exports = { appJwt, appCredsFromEnv, installedOnRepo, deviceFlowOn, attemptsToVerify, verifyGithubAppSetups, SWEEP_LIMIT };

package/scripts/gds/provision.js

@@ -1039,6 +1039,13 @@ async function convertManifestCode(code, { fetchImpl = globalThis.fetch, userAge
   };
 }
 
+// The sign-in probe: the project's JSON health answer, which carries auth_configured
+// (src/bongos/routes/healthz.js). NOT healthzCmd — the root /healthz answers a plain "ok",
+// which never parses, so every setup that worked was recorded FAILED (task 1004577).
+function authHealthzCmd(inst) {
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/bongos/healthz`;
+}
+
 // Convert one manifest row's code → creds and PLACE them (rewrite web.env + restart +
 // verify /healthz). Uses the SAME executors provisionInstance does, so co-tenant (local
 // or remote-cohost) and standalone (control-plane-local) are handled identically. Returns { ok, appId, appSlug } | { ok:false, error }.
@@ -1082,15 +1089,19 @@ async function placeManifestCreds(inst, mrow, deps) {
     appId: creds.appId, appPem: creds.appPem,
   }), { mode: 0o600, sudo: true });
   pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
+  // The app now exists AND its credentials are placed — the checklist's first tick, and the
+  // slug the callback page needs to send the founder on to installing it (task 1004649).
+  if (apply && deps.onCredsPlaced) await Promise.resolve().then(() => deps.onCredsPlaced({ appId: creds.appId, appSlug: creds.appSlug })).catch(() => {});
 
-  // 4) verify /healthz reports auth_configured=true (only meaningful under --apply).
+  // 4) verify the project reports auth_configured=true (only meaningful under --apply).
   //    PATIENT (F23): the child must boot before it can answer; losing this race
-  //    used to record a failure for a setup that had succeeded.
+  //    used to record a failure for a setup that had succeeded. The JSON answer lives
+  //    at /api/bongos/healthz — the root /healthz says a plain "ok" (task 1004577).
   if (apply) {
     const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
     let authConfigured = false;
     for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
-      const out = boxExec(healthzCmd(inst), { allowFail: true });
+      const out = boxExec(authHealthzCmd(inst), { allowFail: true });
       if (oauthSecret.parseHealthzAuth(out && out.stdout).authConfigured) { authConfigured = true; break; }
       await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
@@ -1149,7 +1160,9 @@ async function drainOAuthManifests(deps) {
     try {
       const inst = await provisioning.getInstanceById(db, mrow.instance_id);
       if (!inst) { await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: 'instance row vanished' }); errors++; continue; }
-      const result = await placeManifestCreds(inst, mrow, deps);
+      // the slug lands on the row the moment the credentials are placed (task 1004649)
+      const onCredsPlaced = (c) => provisioning.resolveOAuthManifest(db, mrow.id, 'converting', { app_id: c.appId, app_slug: c.appSlug });
+      const result = await placeManifestCreds(inst, mrow, { ...deps, onCredsPlaced });
       if (result && result.ok === false) {
         // A SPENT code is terminal, always (F23): GitHub's manifest code is
         // single-use, so resetting the row to 'code_received' guarantees the
@@ -1257,6 +1270,7 @@ async function cmdRunIntents(deps) {
   }
   await snapshotAllCoreVersions(deps); // refresh what the deploy control reads, AFTER the drain (ADR 0293 D3/D6)
   const m = await drainOAuthManifests(deps); // same tick: convert + place any GitHub-App-Manifest creds awaiting the control plane
+  await require('./provision-github-setup.js').verifyGithubAppSetups(deps).catch((e) => log(`  github-setup check failed (non-blocking): ${e.message}`)); // install + device flow, asked of GitHub with the app's key (task 1004649)
   log(`done — ran=${ran} ok=${ok} errors=${errors}; oauth-manifest converted=${m.converted} errors=${m.errors}`);
   return { ran, ok, errors, manifests: m };
 }
@@ -1438,7 +1452,7 @@ module.exports = {
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch
   restartInstance,
   // GitHub App Manifest flow (task 2080, ADR 0133)
-  convertManifestCode, placeManifestCreds, drainOAuthManifests, MANIFEST_UA,
+  convertManifestCode, placeManifestCreds, drainOAuthManifests, authHealthzCmd, MANIFEST_UA,
   // cross-site identity federation (ADR 0141 §4, task #1002109)
   federationHubOrigin, shouldFederate, federateInstance,
 };

package/src/bongos/act-alone.js

@@ -0,0 +1,84 @@
+'use strict';
+
+// src/bongos/act-alone.js — WHO DECIDES WHAT, on every building's own page
+// (task 1004657, goal 1000111; ADR 0363 D5 and its Consequences).
+//
+// WHY. A project's decision-rules table (modules/government/decision-rules.js)
+// can hand a building to a sitting: "Release is decided by the council, by
+// majority". Until this file, only People's own routes asked the table before
+// letting one builder act; every other building's page still let whoever held
+// its permission act alone, so a passed amendment changed the board and not
+// the building. requireActAlone(area) is the one gate those pages mount, AFTER
+// their permission gate, so the permission stays the coarse wall and the row
+// only narrows who may use it alone (never wider — ADR 0363 D5).
+//
+// THE REFUSAL is People's, exactly (modules/government/routes/government.js,
+// peopleMayActAlone): 409 `decided_by_sitting` with { area, rule, who,
+// what_this_means, open_with }, so the hall renders one sentence for every
+// building and the builder is pointed at the sitting (POST
+// /government/board/matters) instead.
+//
+// FAIL DIRECTIONS, mirroring checkActAlone and People:
+//   • no government module, or a port without checkActAlone → AS TODAY (the
+//     route's own permission is the whole gate). A malformed or missing row
+//     already reads as its as-today default inside checkActAlone (D2).
+//   • the table cannot be read at all (checkActAlone throws), or the answer is
+//     not one this gate knows → 503 `decision_rule_unreadable`, fail-CLOSED, as
+//     People does: an unreadable rule never waves a lone act through.
+//
+// A PASSED MATTER IS NOT A LONE ACT. When a sitting passes a matter, the owning
+// module carries it out through its 'governor.matterAct' contribution, which
+// calls the route's underlying write directly (modules/autonomy/matter-acts.js,
+// modules/lifecycle/matter-acts.js, the Treasury act in
+// src/bongos/routes/builders.js) and never passes through this middleware — the
+// sitting is the authority. tests/government_act_alone_buildings.mjs pins that.
+//
+// `unless(req)` exempts a request that is not a decision at all (a dry run that
+// only reads, the owner door of a tenant pin move) or a BRAKE (switching
+// unattended building off, pausing one runner): stopping a machine never waits
+// for a meeting. Pass a named function — the route classifier reads the line.
+//
+// Server-side, per request, uncached (ADR 0016). Core and modules reach the
+// government module only through its port, never by require (ADR 0083).
+
+const seams = require('../module-seams');
+const log = require('./logger').logger.child({ src: 'act-alone' });
+
+function logError(message) {
+  try {
+    log.error(message);
+  } catch (_) { /* logging must never decide a request */ }
+}
+
+function requireActAlone(area, { unless = null } = {}) {
+  if (typeof area !== 'string' || area.length === 0) {
+    throw new TypeError('requireActAlone(area): name the building whose row decides this route');
+  }
+  if (unless !== null && typeof unless !== 'function') {
+    throw new TypeError('requireActAlone(area, { unless }): unless must be a function of the request');
+  }
+  return async function actAloneGate(req, res, next) {
+    if (unless && unless(req) === true) return next();
+    const government = seams.resolveOptional('government');
+    if (!government || typeof government.checkActAlone !== 'function') return next();
+    let out;
+    try {
+      out = await government.checkActAlone(area, req.builder && req.builder.id);
+    } catch (err) {
+      logError(`${area} decision rule unreadable: ${err && err.message}`);
+      return res.fail('decision_rule_unreadable', { status: 503, message: `who decides at ${area} could not be read just now` });
+    }
+    if (out && out.ok === true) return next();
+    if (!out || out.reason !== 'decided_by_sitting') {
+      // unknown_area is a wiring bug in the route, not a fact about the caller.
+      logError(`requireActAlone('${area}') got ${out && out.reason} — refusing fail-closed`);
+      return res.fail('decision_rule_unreadable', { status: 503, message: `who decides at ${area} could not be read just now` });
+    }
+    return res.fail('decided_by_sitting', 409, {
+      area: out.area, rule: out.rule, who: out.who,
+      what_this_means: out.what_this_means, open_with: out.open_with,
+    });
+  };
+}
+
+module.exports = { requireActAlone };

package/src/bongos/routes/builders.js

@@ -26,6 +26,11 @@ const path = require('node:path');
 const { execFile } = require('node:child_process');
 const express = require('express');
 const auth = require('../auth');
+// WHO DECIDES AT TREASURY (task 1004657; ADR 0363 D5): the budget write refuses a
+// lone act while Treasury's decision-rules row names a sitting. A passed Treasury
+// matter sets the limit through setMonthlyBudget directly (the governor.matterAct
+// below), never through the route, so the sitting is never refused by its own gate.
+const { requireActAlone } = require('../act-alone');
 const db = require('../db');
 const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81 / ADR
@@ -398,7 +403,7 @@ module.exports = function buildBuildersRouter() {
   // rank: archon — changes another builder's cost ceiling. NOT ownership-scoped:
   // archon-only admin op. Gate: requirePermission('builder.budget.set') — BV1.R104;
   // the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).
-  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requirePermission('builder.budget.set'), async (req, res) => {
+  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requirePermission('builder.budget.set'), requireActAlone('treasury'), async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     if (validateOrRespond(req, res, { monthly_budget_usd: {} })) return;  // number ≥0, or null to clear; validated below

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.92'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.94'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -133,6 +133,12 @@ module.exports = {
   //     the equivalent requireRank admitted, so a migrated module route is
   //     behaviour-identical (BV1.R105).
   get requirePermission() { return require('./bongos/auth').requirePermission; },
+  // requireActAlone(area, { unless }) — WHO DECIDES WHAT on a building's own
+  //     page (task 1004657; ADR 0363 D5). Mounted AFTER the route's permission
+  //     gate: while the project's decision-rules row hands that building to a
+  //     sitting, one builder acting alone is refused (409 decided_by_sitting,
+  //     pointing at the matter route). No government module → as today.
+  get requireActAlone() { return require('./bongos/act-alone').requireActAlone; },
   get rankMeetsThreshold() { return require('./bongos/auth').rankMeetsThreshold; },
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
   // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside

package/tests/autonomy_fence_priority.mjs

@@ -64,8 +64,10 @@ test('POST /autonomy/fence/priority sits behind the same owner-only atom as the
   const layer = router.stack.find((l) => l.route && l.route.path === '/autonomy/fence/priority');
   assert.ok(layer, 'the route is registered');
   assert.equal(layer.route.methods.post, true);
-  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack.length, 4, 'requireBuilder + requirePermission + requireActAlone + handler');
   assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.fence.manage');
+  // task 1004657: Automation's decision rule is asked after the permission gate.
+  assert.equal(layer.route.stack[2].handle.name, 'actAloneGate');
 });
 
 test('the route sets, clears, and refuses a goal that is not allowlisted', async () => {