@bongos/core 1.23.22 → 1.24.1

package/tests/auth_backchannel_logout_route.mjs

@@ -0,0 +1,201 @@
+// tests/auth_backchannel_logout_route.mjs — POST /auth/backchannel-logout, executed
+// for real (task 1004987, goal 1000094).
+//
+// This route needs no sign-in: the hub-signed logout token is the ONLY credential,
+// and a valid one revokes every session the named builder holds. Until this file only
+// the verifier (verifyHubLogoutToken) was tested, in tests/idp_device_exchange.mjs; the
+// route around it — the not-federated 404, the missing-key 503, the 401 on a bad token,
+// the single-use jti, and the no-leak answer for an unknown builder — was not.
+//
+// What is real: the router (src/bongos/routes/auth.js), verifyHubLogoutToken and its
+// signature check, the logout jti store, the body validator and the error envelope.
+// Tokens are minted by the REAL hub minter (modules/platform-identity/hub-keys.js) with
+// a keypair generated here, the tests/idp_device_exchange.mjs keypair recipe. What is
+// faked: auth.loadIdpConfig / auth.loadHubPublicKey (the instance's configuration),
+// db.getBuilderByGithubId (who exists) and db.revokeAllSessionsForBuilder, which
+// RECORDS instead of revoking. Every refusal asserts that nothing was revoked.
+//
+// Run:  node --test tests/auth_backchannel_logout_route.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after, beforeEach } from 'node:test';
+import http from 'node:http';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const auth = require('../src/bongos/auth.js');
+const db = require('../src/bongos/db.js');
+const hubKeys = require('../modules/platform-identity/hub-keys.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ── keys: the hub's, and a forger's ──────────────────────────────────────────
+const { privateKeyB64, publicKeyB64 } = hubKeys.generateHubKeypair();
+const hubSigningKey = crypto.createPrivateKey({ key: Buffer.from(privateKeyB64, 'base64'), format: 'der', type: 'pkcs8' });
+const hubPublicKey = crypto.createPublicKey({ key: Buffer.from(publicKeyB64, 'base64'), format: 'der', type: 'spki' });
+const forgerSigningKey = crypto.generateKeyPairSync('ed25519').privateKey;
+
+const CLIENT_ID = 'client-under-test';
+const KNOWN_GITHUB_ID = 4242;
+const KNOWN_BUILDER = { id: 77, github_id: String(KNOWN_GITHUB_ID), github_login: 'known-builder' };
+
+const mintLogout = ({ githubId = KNOWN_GITHUB_ID, clientId = CLIENT_ID } = {}, opts = {}) =>
+  hubKeys.mintHubLogoutToken({ clientId, githubId }, { signingKey: hubSigningKey, ...opts });
+
+// ── the instance's configuration and data, per case ──────────────────────────
+let idp = { clientId: CLIENT_ID };
+let publicKey = hubPublicKey;
+let revokes = [];
+let lookups = [];
+
+beforeEach(() => { idp = { clientId: CLIENT_ID }; publicKey = hubPublicKey; revokes = []; lookups = []; });
+
+auth.loadIdpConfig = () => idp;
+auth.loadHubPublicKey = () => publicKey;
+db.getBuilderByGithubId = async (githubId) => {
+  lookups.push(String(githubId));
+  return String(githubId) === String(KNOWN_GITHUB_ID) ? { ...KNOWN_BUILDER } : null;
+};
+db.revokeAllSessionsForBuilder = async (builderId) => { revokes.push(builderId); return 3; };
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAuthRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function logout(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: '/api/gds/auth/backchannel-logout', method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let raw = '';
+      res.on('data', (c) => { raw += c; });
+      res.on('end', () => { let json = null; try { json = JSON.parse(raw); } catch { /* text */ } resolve({ status: res.statusCode, json, raw }); });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+// ── not a public surface unless the instance federates ───────────────────────
+
+test('idp not configured → 404, no lookup, no revoke — even for a perfectly valid token', async () => {
+  idp = null;
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 404);
+  assert.equal(r.raw, 'not found', 'indistinguishable from a route that does not exist');
+  assert.deepEqual(lookups, []);
+  assert.deepEqual(revokes, []);
+});
+
+test('no hub public key set → 503 idp_unconfigured and no revoke', async () => {
+  publicKey = null;
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 503);
+  assert.equal(r.json.error.code, 'idp_unconfigured');
+  assert.deepEqual(lookups, []);
+  assert.deepEqual(revokes, []);
+});
+
+// ── forged and wrong tokens: 401, nothing revoked ────────────────────────────
+
+test('a forged token (signed by a key that is not the hub’s) → 401 and no revoke', async () => {
+  const forged = hubKeys.mintHubLogoutToken({ clientId: CLIENT_ID, githubId: KNOWN_GITHUB_ID }, { signingKey: forgerSigningKey });
+  const r = await logout({ logout_token: forged });
+  assert.equal(r.status, 401);
+  assert.equal(r.json.error.code, 'invalid_logout_token');
+  assert.match(r.json.error.message, /signature invalid/);
+  assert.deepEqual(lookups, [], 'the subject of an unverified token is never even looked up');
+  assert.deepEqual(revokes, []);
+});
+
+test('a genuine token with its subject swapped (payload re-encoded, signature kept) → 401 and no revoke', async () => {
+  const [h, p, s] = mintLogout({ githubId: 1 }).split('.');
+  const claims = JSON.parse(Buffer.from(p, 'base64url').toString('utf8'));
+  claims.sub = String(KNOWN_GITHUB_ID);
+  const tampered = `${h}.${Buffer.from(JSON.stringify(claims)).toString('base64url')}.${s}`;
+  const r = await logout({ logout_token: tampered });
+  assert.equal(r.status, 401);
+  assert.deepEqual(revokes, []);
+});
+
+test('a hub-signed token minted for ANOTHER instance → 401 and no revoke', async () => {
+  const r = await logout({ logout_token: mintLogout({ clientId: 'some-other-project' }) });
+  assert.equal(r.status, 401);
+  assert.match(r.json.error.message, /audience/);
+  assert.deepEqual(revokes, []);
+});
+
+test('a hub LOGIN assertion (no logout purpose) cannot log anyone out → 401 and no revoke', async () => {
+  const assertion = hubKeys.mintHubAssertion(
+    { clientId: CLIENT_ID, githubId: KNOWN_GITHUB_ID, githubLogin: 'known-builder', displayName: null, avatarUrl: null },
+    { signingKey: hubSigningKey },
+  );
+  const r = await logout({ logout_token: assertion });
+  assert.equal(r.status, 401);
+  assert.deepEqual(revokes, []);
+});
+
+test('an expired token → 401 and no revoke', async () => {
+  const r = await logout({ logout_token: mintLogout({}, { nowMs: Date.now() - 10 * 60 * 1000 }) });
+  assert.equal(r.status, 401);
+  assert.match(r.json.error.message, /expired/);
+  assert.deepEqual(revokes, []);
+});
+
+test('no token at all → 400 and no revoke', async () => {
+  const r = await logout({});
+  assert.equal(r.status, 400);
+  assert.deepEqual(revokes, []);
+});
+
+// ── a valid token: once, and only once ───────────────────────────────────────
+
+test('a valid token for a known builder → 200 and exactly one revoke, of that builder', async () => {
+  const r = await logout({ logout_token: mintLogout() });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json, { ok: true });
+  assert.deepEqual(lookups, [String(KNOWN_GITHUB_ID)]);
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id]);
+});
+
+test('the same token again (same jti) → 200, and still only the one revoke', async () => {
+  const token = mintLogout();
+  const first = await logout({ logout_token: token });
+  const replay = await logout({ logout_token: token });
+  const replayAgain = await logout({ logout_token: token });
+  assert.equal(first.status, 200);
+  assert.equal(replay.status, 200, 'a replay is an idempotent no-op, not an error');
+  assert.equal(replay.raw, first.raw, 'and answers the same bytes');
+  assert.equal(replayAgain.status, 200);
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id], 'a captured token cannot keep killing sessions made after it');
+});
+
+test('a fresh token for the same builder (a new jti) revokes again — the guard is per token, not per builder', async () => {
+  await logout({ logout_token: mintLogout() });
+  await logout({ logout_token: mintLogout() });
+  assert.deepEqual(revokes, [KNOWN_BUILDER.id, KNOWN_BUILDER.id]);
+});
+
+test('a valid token for an unknown sub → 200, zero revokes, and the same body as the known case', async () => {
+  const known = await logout({ logout_token: mintLogout() });
+  revokes = [];
+  const unknown = await logout({ logout_token: mintLogout({ githubId: 999001 }) });
+  assert.equal(unknown.status, 200);
+  assert.deepEqual(revokes, []);
+  assert.equal(unknown.raw, known.raw, 'whether this builder exists here is never leaked');
+});

package/tests/auto_satisfy_criteria.mjs

@@ -223,7 +223,16 @@ await test('the ship hook cannot fail a ship, and the sweep exists to retry it',
   assert.match(line, /auto-satisfy skipped \(sweep retries\)/, 'the failure is reported, not thrown');
   assert.match(logged.join('\n'), /shipTask 5/, 'and it names the ship it happened on');
   const rec = readFileSync(new URL('../modules/lifecycle/publish-reconciler.js', import.meta.url), 'utf8');
-  assert.match(rec, /runCriterionSweep\(deps\)\.catch\(/, 'the sweep is fire-and-forget on the tick, like runCostSweep');
+  // task 1004924: the tick runs the guarded SWEEPS list (fire-and-forget, a
+  // sweep still in flight is skipped), so the wiring is an entry there.
+  // task 1004965: an entry's third element is its cadence; these two have none, so
+  // they keep the every-tick cadence while promotion and the craft backfill go hourly.
+  assert.match(rec, /\['criterion sweep', runCriterionSweep\]/, 'the sweep is fire-and-forget on EVERY tick, like runCostSweep');
+  assert.match(rec, /\['cost sweep', runCostSweep\]/);
+  const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+  const cadence = new Map(reconciler.SWEEPS.map(([name, , everyMs]) => [name, everyMs]));
+  assert.equal(cadence.get('criterion sweep'), undefined, 'the criterion sweep is not slowed to hourly');
+  assert.equal(cadence.get('cost sweep'), undefined, 'nor the cost sweep');
   assert.match(rec, /BACKLOG DRAIN/, 'and documents why it is not merely belt-and-braces');
 });
 

package/tests/autobongos_tweak_lane.mjs

@@ -206,3 +206,147 @@ test('a backlog of rounds the lane must skip costs at most ten reads a pass', as
   await lane.pickRound({ api, state: {}, matchProtected, readInventory: () => INV, readRound: async () => { reads++; return round(1); } });
   assert.equal(reads, 10);
 });
+
+// ---- land only, going live waits for a person (task 1004974) -----------------
+//
+// The unattended path may reach its finish line (WAITING FOR THE ARTIST; the
+// artist's approval then lands it like any confirmed task) and must never be the
+// one that asks for a live pin move. Proven here: the hand-off fence refuses a
+// prompt or script list naming a pin door, and a scan of the text the worker
+// actually follows finds none. The SERVER side (whether the pin doors refuse the
+// worker's own session) is tests/autobongos_tweak_pin_identity.mjs.
+
+const fence = require('../modules/autonomy/fence.js');
+const fs = require('node:fs');
+const path = require('node:path');
+const ROOT = path.resolve(path.dirname(require('node:url').fileURLToPath(import.meta.url)), '..');
+
+// One planted line per door: the fence must refuse each, and name it.
+const PLANTED = [
+  ['core-upgrade', 'node scripts/bongos/api.js POST /api/bongos/provisioning/instances/41/core-upgrade --body \'{"to":"1.19.1"}\''],
+  ['core-upgrade', 'node scripts/bongos/provision-core-upgrade.js --instance 41'],
+  ['update-channel', 'node scripts/bongos/api.js POST /api/bongos/provisioning/instances/41/update-channel'],
+  ['update-channel', 'set the update channel to minor'],
+  ['npm-release', 'node scripts/bongos/api.js POST /api/bongos/npm-release/release'],
+  ['core.pin.move', 'you hold core.pin.move, so use it'],
+  ['core-update', 'node scripts/bongos/api.js POST /api/bongos/software-update/request'],
+  ['render-deploy', 'node scripts/bongos/api.js POST /api/bongos/render-deploy/act'],
+  ['bongos upgrade', 'ssh host bongos upgrade --to 1.19.1'],
+  ['pin move', 'then move the live pin so the artist sees it'],
+];
+
+test('the hand-off fence passes the real prompt, the real lane scripts and the real skill', () => {
+  const prompt = lane.buildTweakPrompt({ task: { id: 901 }, pageId: 'landing:index' });
+  const skillText = lane.readSkill();
+  const cmds = lane.skillCommands(skillText);
+  assert.ok(cmds.some((c) => /ship\.js/.test(c)) && cmds.some((c) => /tweak-halt\.js/.test(c)), 'the skill\'s command lines were found, so the scan is not vacuous');
+  assert.equal(lane.guardHandOff({ prompt, skillText }).go, true);
+});
+
+test('the hand-off fence refuses a prompt or a script list that names a pin door', () => {
+  const prompt = lane.buildTweakPrompt({ task: { id: 901 }, pageId: 'landing:index' });
+  for (const [door, line] of PLANTED) {
+    const inScripts = fence.refusePinMove({ prompt, scripts: [...lane.LANE_SCRIPTS, line] });
+    assert.equal(inScripts.code, 'pin_move', `script list: ${line}`);
+    assert.ok(inScripts.doors.includes(door), `names ${door}: ${inScripts.doors}`);
+    assert.equal(fence.refusePinMove({ prompt: `${prompt}\n${line}`, scripts: [...lane.LANE_SCRIPTS] }).code, 'pin_move', `prompt: ${line}`);
+    const skill = `${lane.readSkill()}\n\`\`\`bash\n${line}\n\`\`\`\n`;
+    assert.equal(lane.guardHandOff({ prompt, skillText: skill }).code, 'pin_move', `skill command: ${line}`);
+  }
+  assert.equal(fence.refusePinMove({ prompt, scripts: null }).go, false, 'an unreadable list refuses');
+  assert.equal(fence.refusePinMove({ prompt: undefined, scripts: [] }).go, false, 'an unreadable prompt refuses');
+  assert.equal(lane.guardHandOff({ prompt, skillText: null }).go, false, 'an unreadable skill refuses');
+});
+
+test('iteration: a planted pin move in the skill stops the round before the claim (no tree, no worker)', async () => {
+  const api = fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } });
+  for (const readSkill of [
+    () => `${lane.readSkill()}\n\`\`\`bash\n${PLANTED[0][1]}\n\`\`\`\n`,
+    () => { throw new Error('ENOENT'); },
+  ]) {
+    const h = harness({ api });
+    h.deps.laneDeps.readSkill = readSkill;
+    const row = await runner.iteration(opts, h.deps);
+    assert.equal(row.event, 'fenced');
+    assert.equal(row.lane, 'tweak');
+    assert.equal(row.code, 'pin_move');
+    assert.deepEqual(h.calls, [], 'nothing ran: no worktree, no claim, no worker');
+  }
+});
+
+test('iteration: the unattended path reaches its finish line and nothing it ran names a pin door', async () => {
+  const h = harness({ api: fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.outcome, 'waiting_for_artist', 'held at a passed grade for the artist, whose approval lands it');
+  assert.ok(h.calls.length >= 3, 'the tree, the claim and the worker all ran');
+  for (const c of h.calls) {
+    const said = [c.script, ...(c.args || []), c.prompt || ''].join(' ');
+    assert.deepEqual(fence.pinMoveDoors(said), [], `${c.script} named a pin door`);
+  }
+});
+
+// The scan of what the worker follows. Two matchers, so a bug in the fence's own
+// patterns cannot make this scan agree with it: the fence's, and a literal one.
+const LITERAL_DOORS = /core[-_]upgrade|update[-_]channel|core\.pin\.move|software-update|render-deploy\/act|bongos\s+upgrade|move\s+the\s+(?:live\s+)?pin/i;
+const scanned = () => [
+  ['the tweak skill (its unattended path follows every step)', fs.readFileSync(path.join(ROOT, lane.SKILL_PATH), 'utf8')],
+  ['the tweak lane', fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'autobongos-tweak-lane.js'), 'utf8')],
+];
+
+test('the unattended skill and the lane name no pin door', () => {
+  for (const [what, text] of scanned()) {
+    assert.ok(text.length > 1000, `${what} was read`);
+    assert.deepEqual(fence.pinMoveDoors(text), [], `${what} names a pin door`);
+    assert.equal(LITERAL_DOORS.exec(text), null, `${what} names a pin door`);
+  }
+});
+
+// The fence's list is named doors, so it is kept honest from the code: every
+// MUTATING route gated on core.pin.move (directly, or through a variable holding
+// that gate) or on the owner-or-pin gate must be matched by a pattern. A new pin
+// door added anywhere reds this until fence.js names it.
+function pinGatedMutatingRoutes() {
+  const files = [];
+  const modulesDir = path.join(ROOT, 'modules');
+  for (const m of fs.readdirSync(modulesDir)) {
+    const dir = path.join(modulesDir, m, 'routes');
+    if (fs.existsSync(dir)) for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) files.push(path.join(dir, f));
+  }
+  const coreRoutes = path.join(ROOT, 'src', 'bongos', 'routes');
+  for (const f of fs.readdirSync(coreRoutes)) if (f.endsWith('.js')) files.push(path.join(coreRoutes, f));
+  const out = [];
+  for (const file of files) {
+    const src = fs.readFileSync(file, 'utf8');
+    // Variables that hold the atom gate (npm-release's `mayPreview`, say).
+    const gateVars = [...src.matchAll(/(?:const|let)\s+(\w+)\s*=\s*[\w.]*requirePermission\(\s*'core\.pin\.move'\s*\)/g)].map((m) => m[1]);
+    const calls = [...src.matchAll(/router\.(post|put|patch|delete)\(/g)];
+    calls.forEach((m, i) => {
+      const body = src.slice(m.index, i + 1 < calls.length ? calls[i + 1].index : src.length).split(/\n\s*router\.(?:get|use)\(/)[0];
+      const gated = /requirePermission\(\s*'core\.pin\.move'\s*\)|requireOwnProjectOrPin/.test(body)
+        || gateVars.some((v) => new RegExp(`\\b${v}\\b`).test(body));
+      const route = /\(\s*['`]([^'`]+)['`]/.exec(body);
+      if (gated && route) out.push({ file: path.relative(ROOT, file), method: m[1], route: route[1] });
+    });
+  }
+  return out;
+}
+
+test('every mutating route behind the pin gates is a door the fence names', () => {
+  const routes = pinGatedMutatingRoutes();
+  const seen = routes.map((r) => r.route);
+  for (const known of ['/provisioning/instances/:id/core-upgrade', '/provisioning/instances/:id/update-channel', '/render-deploy/act', '/npm-release/release']) {
+    assert.ok(seen.includes(known), `the enumeration found ${known} (so it is not vacuous): ${seen.join(', ')}`);
+  }
+  for (const r of routes) {
+    assert.notDeepEqual(fence.pinMoveDoors(`POST /api/bongos${r.route}`), [], `${r.method.toUpperCase()} ${r.route} (${r.file}) is a pin door the fence does not name`);
+  }
+});
+
+test('the scan fails on a planted pin move in either file', () => {
+  for (const [what, text] of scanned()) {
+    for (const [door, line] of PLANTED) {
+      assert.ok(fence.pinMoveDoors(`${text}\n${line}\n`).includes(door), `${what}: ${door} not caught`);
+    }
+    assert.ok(LITERAL_DOORS.test(`${text}\n${PLANTED[0][1]}\n`), `${what}: the literal scan misses core-upgrade`);
+  }
+});

package/tests/autobongos_tweak_pin_identity.mjs

@@ -0,0 +1,137 @@
+// tests/autobongos_tweak_pin_identity.mjs — does a live pin door refuse the
+// unattended worker's own session? (task 1004974)
+//
+// "Land only. Ask before going live." The lane never ASKS for a pin move
+// (tests/autobongos_tweak_lane.mjs proves the hand-off fence and the scan). This
+// file asks the other half: if a worker wandered past its prompt, would the
+// server stop it?
+//
+// THE WORKER'S IDENTITY. autobongos-run.js hands a worker HOME and USERPROFILE
+// (WORKER_ENV_ALLOW), so the worker reads the runner builder's own CLI session
+// file and calls the instance as that builder, with a `cli` session — the same
+// token the builder uses at a terminal. Nothing on the request says "unattended".
+//
+// What runs here is REAL: auth.requireBuilder resolving a session token, the
+// provisioning router, its owner-or-pin gate, the act-alone gate and the handler.
+// Only the session lookup, the permission resolver and the instance rows are
+// doubles.
+//
+// THE KNOWN GAP. The refusals the owner's rule asks for are `todo` tests: today
+// the owner's runner session is ADMITTED by the owner door, and an Archon
+// runner's by the core.pin.move atom, so a worker running as either could queue
+// a live move. Filed as private security report 1000030 (task 1004974); the
+// todo tests turn into ordinary tests when the fix lands. The control test below
+// proves this harness CAN see a refusal, so a todo failing here is the gap and
+// not a broken harness.
+//
+// Run:  node --test tests/autobongos_tweak_pin_identity.mjs
+
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// The session double must be installed BEFORE auth.js loads (it destructures
+// lookupSession at require time — the tests/core_upgrade_owner_door.mjs precedent).
+const dbKernel = require('../src/bongos/db-kernel.js');
+// The runner builder is Metic+ (the lane's floor). 7 owns the hosted project 41;
+// 1 is the hub's Archon, who owns nothing hosted here; 8 is a stranger.
+const SESSIONS = {
+  ownerrunner: { builder_id: 7, github_id: '9001', rank: 'metic', source: 'cli', status: 'active' },
+  archonrunner: { builder_id: 1, github_id: '9000', rank: 'archon', source: 'cli', status: 'active' },
+  strangerrunner: { builder_id: 8, github_id: '9002', rank: 'metic', source: 'cli', status: 'active' },
+};
+dbKernel.lookupSession = async (token) => SESSIONS[token] || null;
+
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const api = require('../src/module-api.js');
+const prov = require('../modules/provisioning/provisioning.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
+
+const TENANT = Object.freeze({ id: 41, slug: 'hosted-shop', status: 'active', hosting_shape: 'cloud-host', owner_builder_id: 7, update_channel: 'pinned' });
+const ROWS = new Map([[41, TENANT]]);
+
+seams._reset();
+seams.registerProvider('government', {
+  resolveBuilderPermissions: async (id) => catalog.seedForRank(Object.values(SESSIONS).find((s) => s.builder_id === id).rank),
+});
+
+const queued = [];
+const saved = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent, pool: Object.getOwnPropertyDescriptor(api, 'pool') };
+prov.getInstanceById = async (_db, n) => ROWS.get(Number(n)) || null;
+prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+  queued.push({ id, action, requestedBy, targetVersion });
+  return { intent: { id: queued.length, action, state: 'pending', target_version: targetVersion }, created: true };
+};
+prov.recordEvent = async () => {};
+const channelWrites = [];
+Object.defineProperty(api, 'pool', { value: { query: async (sql, params) => { channelWrites.push(params); return { rows: [] }; } }, configurable: true, writable: true });
+
+const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+delete require.cache[routePath];
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => { require('../src/bongos/middleware/error-envelope.js').attachFail(req, res, next); });
+app.use(require(routePath)());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+after(() => {
+  server.close();
+  prov.getInstanceById = saved.get; prov.enqueueIntent = saved.enq; prov.recordEvent = saved.rec;
+  Object.defineProperty(api, 'pool', saved.pool);
+  delete require.cache[routePath];
+  seams._reset();
+});
+
+// A real live move: no dry_run, a named target.
+const move = (token, id = 41) => fetch(`${base}/provisioning/instances/${id}/core-upgrade`, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+  body: JSON.stringify({ to: '1.19.1033' }),
+});
+const channel = (token, id = 41) => fetch(`${base}/provisioning/instances/${id}/update-channel`, {
+  method: 'POST',
+  headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+  body: JSON.stringify({ channel: 'minor' }),
+});
+
+test('the worker carries its builder\'s own CLI session: the home directories pass through', () => {
+  const env = runner.workerEnv({ HOME: '/home/runner', USERPROFILE: 'C:\\Users\\runner', DATABASE_URL: 'postgres://x' });
+  assert.equal(env.HOME, '/home/runner');
+  assert.equal(env.USERPROFILE, 'C:\\Users\\runner');
+  assert.equal(env.DATABASE_URL, undefined, 'the allowlist is live, so the home dirs are deliberate');
+});
+
+test('control: a stranger\'s runner session is refused a live move, so this harness can see a refusal', async () => {
+  const r = await move('strangerrunner');
+  assert.equal(r.status, 403);
+  assert.equal(queued.length, 0);
+});
+
+const GAP = 'known gap, task 1004974: the server cannot tell an unattended worker from its builder at a terminal';
+
+test('the OWNER\'s runner session is refused a live move on the owner\'s own project', { todo: GAP }, async () => {
+  const before = queued.length;
+  const r = await move('ownerrunner');
+  assert.equal(r.status, 403, `a worker running as the owner queued a live move (status ${r.status})`);
+  assert.equal(queued.length, before);
+});
+
+test('the OWNER\'s runner session is refused a change to the project\'s update rule', { todo: GAP }, async () => {
+  const before = channelWrites.length;
+  const r = await channel('ownerrunner');
+  assert.equal(r.status, 403, `a worker running as the owner changed which moves the runner makes (status ${r.status})`);
+  assert.equal(channelWrites.length, before);
+});
+
+test('an ARCHON runner session is refused a live move on a hosted project', { todo: GAP }, async () => {
+  const before = queued.length;
+  const r = await move('archonrunner');
+  assert.equal(r.status, 403, `a worker running as the Archon queued a live move (status ${r.status})`);
+  assert.equal(queued.length, before);
+});

package/tests/backfill_subagent_rewards.mjs

@@ -16,7 +16,7 @@ import { makeRunner } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const {
-  CLASSES, DEDUP_FIX_AT, classifySession, buildBackfillPlan, renderReport,
+  CLASSES, CLASS_NOTE, DEDUP_FIX_AT, classifySession, buildBackfillPlan, renderReport,
 } = require('../scripts/bongos/backfill-subagent-rewards.js');
 const {
   computeSessionTokenReward, sessionTrueCostUsd, awardSessionTokenReward,
@@ -105,6 +105,22 @@ await test('no_subagent_record: no cost row means unrecoverable — never guesse
   assert.equal(r.subagentUsd, undefined, 'no invented figure');
 });
 
+// Task 1003640: most sessions in this bucket simply never ran a subagent, so the
+// reason must lead with that ordinary case, and name the failed-hook case only as
+// the rarer possibility the data cannot tell apart, never as the cause.
+await test('no_subagent_record: the reason does not blame a failed cost hook for a session that used no subagent', () => {
+  const note = CLASS_NOTE[CLASSES.NO_SUBAGENT_RECORD];
+  assert.match(note, /^[^.]*no subagent/i, 'the ordinary case (no subagent used) is named first');
+  assert.match(note, /nothing (is )?owed/i, 'says the ordinary case owes nothing');
+  assert.doesNotMatch(note, /: the cost hook never ran/, 'does not assert the hook failure as the cause');
+  assert.match(note, /cannot (be )?tell|cannot tell|indistinguishable|same trace/i, 'says the two cases look the same in the data');
+  const plan = buildBackfillPlan([row({ subagent_usd: null, subagent_recorded_at: null })],
+    { since: DEDUP_FIX_AT, marginPct: 20, usdPeg: 1 });
+  const { text } = renderReport(plan);
+  assert.doesNotMatch(text, /Sessions whose cost hook never ran left no trace at all/,
+    'the closing summary no longer reads every no-record session as a lost hook');
+});
+
 await test('pre_split: a legacy single `session` row lumps both legs and cannot be separated', () => {
   const r = classifySession(
     row({ subagent_usd: null, subagent_recorded_at: null, has_pre_split_cost_row: true }), OPTS

package/tests/backup_trigger_lock.mjs

@@ -0,0 +1,119 @@
+// tests/backup_trigger_lock.mjs
+//
+// task 1004924 — POST /backup/trigger runs a ~2 minute bash dump. Two at once on
+// one disk is the thing to prevent, so the route holds a single-flight lock: a
+// second trigger while one runs is 409 backup_already_running, and the lock frees
+// when the dump finishes. The lock existed but nothing pinned it; and a spawn
+// that threw synchronously never reached the callback, so the lock stuck and
+// every later trigger 409'd until a restart.
+//
+// Hermetic: the auth gates are stubbed (the rank gate itself is tested in its own
+// suites), and execFile is the router's injected seam — no real dump runs.
+//
+// Run:  node tests/backup_trigger_lock.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// Stub the gates BEFORE building: the router reads them at build time.
+const pass = (req, _res, next) => { req.builder = { id: 'b-test' }; next(); };
+auth.requireBuilder = pass;
+auth.requirePermission = () => (_req, _res, next) => next();
+
+const buildBackupRouter = require('../src/bongos/routes/backup.js');
+const { test, summary } = makeRunner();
+
+async function withServer(execFile, fn) {
+  const app = express();
+  app.use(attachFail);
+  app.use(buildBackupRouter({ execFile }));
+  const server = await new Promise((r) => { const s = app.listen(0, '127.0.0.1', () => r(s)); });
+  const port = server.address().port;
+  // node:http with no keep-alive agent, not fetch: fetch's pooled sockets are
+  // still closing when summary() calls process.exit, which aborts on Windows
+  // (libuv UV_HANDLE_CLOSING assertion) after every case has passed.
+  const trigger = () => new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: '/backup/trigger', method: 'POST', agent: false }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(data) }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+  try { await fn(trigger); } finally { await new Promise((r) => server.close(r)); }
+}
+
+await test('a second trigger while a dump runs is 409; once it finishes the next one starts', async () => {
+  const spawned = [];
+  const execFile = (cmd, args, opts, cb) => { spawned.push(cb); };
+  await withServer(execFile, async (trigger) => {
+    assert.equal((await trigger()).status, 202);
+    const second = await trigger();
+    assert.equal(second.status, 409);
+    assert.equal(second.body.error.code, 'backup_already_running');
+    assert.equal(spawned.length, 1, 'never two dumps at once');
+
+    spawned[0](null, '', ''); // the dump finishes
+    assert.equal((await trigger()).status, 202);
+    assert.equal(spawned.length, 2);
+    spawned[1](new Error('pg_dump failed'), '', 'boom'); // a FAILED dump frees the lock too
+    assert.equal((await trigger()).status, 202);
+    spawned[2](null, '', '');
+  });
+});
+
+await test('a spawn that throws synchronously frees the lock instead of wedging it', async () => {
+  let calls = 0;
+  let throwIt = true;
+  const execFile = (cmd, args, opts, cb) => {
+    calls++;
+    if (throwIt) throw new Error('spawn EAGAIN');
+    setImmediate(() => cb(null, '', ''));
+  };
+  await withServer(execFile, async (trigger) => {
+    const first = await trigger();
+    assert.equal(first.status, 500);
+    assert.equal(first.body.error.code, 'backup_start_failed');
+    throwIt = false;
+    const second = await trigger();
+    assert.equal(second.status, 202, 'the lock was released, so a retry starts a dump');
+    assert.equal(calls, 2);
+  });
+});
+
+// task 1004966 — the in-memory flag above cannot see the nightly timer, which runs
+// the script outside this process. The cross-process guard is the flock INSIDE
+// db-backup-nightly.sh, so it only covers the manual trigger if the trigger runs
+// that very script — the one the systemd unit's ExecStart names.
+await test('the trigger runs the same script as the nightly unit, so both take its flock', async () => {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  const { BACKUP_SCRIPT, SKIPPED_MARK } = buildBackupRouter;
+  const root = path.resolve(path.dirname(require('node:url').fileURLToPath(import.meta.url)), '..');
+  const script = path.join(root, 'scripts', 'bongos', 'db-backup-nightly.sh');
+  assert.equal(path.resolve(BACKUP_SCRIPT), path.resolve(script));
+  const unit = fs.readFileSync(path.join(root, 'scripts', 'bongos', 'gds-db-backup.service'), 'utf8');
+  assert.match(unit, /^ExecStart=.*\/db-backup-nightly\.sh\s*$/m, 'the timer runs the same script');
+  const src = fs.readFileSync(script, 'utf8');
+  assert.match(src, /flock -n 9/, 'the script takes the lock');
+  assert.ok(src.includes(SKIPPED_MARK), 'the script prints the skip line the trigger listens for');
+
+  const runs = [];
+  const execFile = (cmd, args, opts, cb) => { runs.push([cmd, args]); setImmediate(() => cb(null, `${SKIPPED_MARK} another backup is running`, '')); };
+  await withServer(execFile, async (trigger) => {
+    assert.equal((await trigger()).status, 202);
+    await new Promise((r) => setImmediate(r));
+    assert.deepEqual(runs[0], ['bash', [BACKUP_SCRIPT]]);
+    assert.equal((await trigger()).status, 202, 'a skipped run frees the in-memory flag too');
+  });
+});
+
+summary();