@bongos/core 1.23.22 → 1.24.2

package/tests/project_settings_spend_cap_route.mjs

@@ -0,0 +1,235 @@
+// tests/project_settings_spend_cap_route.mjs — PATCH /project-settings/spend-cap,
+// executed for real (task 1004985, goal 1000094).
+//
+// The spend cap is the project's only monthly ceiling (task 1004712, ADR 0379), and
+// until this file no test performed a write through its route: the neighbours pin
+// refusal sentences and the act-alone inventory, never what the handler WRITES. So
+// every case here asserts two things — the answer the caller got, and exactly what
+// reached setSpendCap (nothing, on every refusal).
+//
+// What is real: the router (modules/lifecycle/routes/project-settings.js), the
+// kernel's requirePermission (auth.js) and requireActAlone (act-alone.js), the
+// body validator, the error envelope, and the pure parser + describer from
+// src/bongos/project-settings.js. What is faked: who the caller is (requireBuilder),
+// the two calls that would reach Postgres (setSpendCap records, resolveSpendCap
+// reads back what was recorded), and the government port — the one place both
+// gates ask "may this builder do this" — so a case can grant or withhold the atom
+// and let the Treasury act alone or send it to a sitting.
+//
+// The doorway is stubbed in require.cache BEFORE the route loads (the
+// tests/access_requests_invite.mjs pattern).
+//
+// Run:  node --test tests/project_settings_spend_cap_route.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after, beforeEach } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+const realSettings = require('../src/bongos/project-settings.js');
+const seams = require('../src/module-seams.js');
+
+const ATOM = 'project.settings.manage';
+const CALLER = 42;
+
+// ── the world each case arranges ─────────────────────────────────────────────
+let held = [ATOM];          // what the government port says the caller holds
+let actAlone = { ok: true }; // what checkActAlone answers
+let setThrows = null;        // an Error setSpendCap raises, or null
+let writes = [];             // every setSpendCap(usd, builderId) call
+let parses = [];             // every parseSpendCap(raw) call
+let actAloneAsked = [];      // every checkActAlone(area, builderId) call
+let stored = null;           // what resolveSpendCap reads back
+
+beforeEach(() => {
+  held = [ATOM];
+  actAlone = { ok: true };
+  setThrows = null;
+  writes = [];
+  parses = [];
+  actAloneAsked = [];
+  stored = null;
+});
+
+// The government port, as both gates reach it (seams.resolveOptional('government')).
+// It is registered before any request and removed afterwards, so it cannot leak
+// into another file's process — each test file runs in its own node.
+const government = {
+  async resolveBuilderPermissions(builderId) { return builderId === CALLER ? held : []; },
+  async checkActAlone(area, builderId) {
+    actAloneAsked.push({ area, builderId });
+    if (actAlone instanceof Error) throw actAlone;
+    return actAlone;
+  },
+};
+
+require.cache[apiPath].exports = {
+  ...realApi,
+  requireBuilder: (req, _res, next) => { req.builder = { id: CALLER, github_login: 'treasurer' }; next(); },
+  projectSettings: {
+    ...realApi.projectSettings,
+    // The REAL parser, recorded, so "the parser's own reason" is the parser's own words.
+    parseSpendCap: (raw) => { parses.push(raw); return realSettings.parseSpendCap(raw); },
+    setSpendCap: async (usd, builderId) => {
+      writes.push({ usd, builderId });
+      if (setThrows) throw setThrows;
+      stored = usd;
+      return usd;
+    },
+    resolveSpendCap: async () => ({ on: stored != null, usd: stored, source: stored == null ? 'default' : 'project_settings', invalid: null }),
+    describeSpendCap: realSettings.describeSpendCap,
+  },
+};
+
+const buildRouter = require('../modules/lifecycle/routes/project-settings.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildRouter());
+
+let server, port;
+before(async () => {
+  seams.registerProvider('government', government);
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => {
+  await new Promise((r) => server.close(r));
+});
+
+function patch(body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: '/api/gds/project-settings/spend-cap', method: 'PATCH',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+// ── setting and clearing ─────────────────────────────────────────────────────
+
+test('{usd: 50} sets the cap for the caller and answers it back as on', async () => {
+  const r = await patch({ usd: 50 });
+  assert.equal(r.status, 200);
+  assert.deepEqual(writes, [{ usd: 50, builderId: CALLER }], 'one write, the parsed dollars, by the caller');
+  assert.equal(r.json.ok, true);
+  assert.equal(r.json.on, true);
+  assert.equal(r.json.usd, 50);
+  assert.equal(r.json.sentence, realSettings.describeSpendCap({ on: true, usd: 50 }), 'the describer’s own sentence, not a re-typed one');
+  assert.deepEqual(parses, [50], 'a number goes through the shared parser');
+  assert.deepEqual(actAloneAsked, [{ area: 'treasury', builderId: CALLER }], 'the Treasury’s row decides, asked about this caller');
+});
+
+test('{usd: null} turns the cap off — setSpendCap(null), and the answer says off', async () => {
+  stored = 50;
+  const r = await patch({ usd: null });
+  assert.equal(r.status, 200);
+  assert.deepEqual(writes, [{ usd: null, builderId: CALLER }]);
+  assert.equal(r.json.on, false);
+  assert.equal(r.json.usd, null);
+  assert.equal(r.json.sentence, realSettings.describeSpendCap({ on: false, usd: null }));
+  assert.deepEqual(parses, [], 'null is the off switch, never handed to the parser');
+});
+
+// ── bad bodies: refused, nothing written ─────────────────────────────────────
+
+test('{} → 400 bad_spend_cap and no write', async () => {
+  const r = await patch({});
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_spend_cap');
+  // The route's own sentence, not the parser's: a missing usd is refused before any
+  // parse, so an absent field can never be read as "turn the cap off".
+  assert.equal(r.json.error.message, 'Send a number of dollars a month, or nothing to turn the cap off.');
+  assert.deepEqual(parses, [], 'refused before the parser is consulted');
+  assert.deepEqual(writes, []);
+});
+
+test("{usd: 'lots'} → 400 carrying the parser's own reason, and no write", async () => {
+  const r = await patch({ usd: 'lots' });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_spend_cap');
+  assert.deepEqual(parses, ['lots']);
+  const own = realSettings.parseSpendCap('lots').reason;
+  assert.ok(own, 'the parser refuses it');
+  assert.equal(r.json.error.message, own);
+  assert.deepEqual(writes, []);
+});
+
+// ── who may do it ────────────────────────────────────────────────────────────
+
+test('a caller without project.settings.manage → 403 and no write, set or clear', async () => {
+  held = ['some.other.atom'];
+  for (const body of [{ usd: 50 }, { usd: null }]) {
+    const r = await patch(body);
+    assert.equal(r.status, 403, JSON.stringify(body));
+    assert.equal(r.json.error.code, 'permission_forbidden');
+    assert.match(r.json.error.message, /project\.settings\.manage/);
+  }
+  assert.deepEqual(writes, []);
+  assert.deepEqual(actAloneAsked, [], 'the atom gate refuses before the Treasury is even asked');
+});
+
+test('authority that cannot be established (the resolver throws) → 403 and no write', async () => {
+  held = null;
+  government.resolveBuilderPermissions = async () => { throw new Error('resolver down'); };
+  try {
+    const r = await patch({ usd: 50 });
+    assert.equal(r.status, 403);
+    assert.equal(r.json.error.code, 'permission_forbidden');
+    assert.deepEqual(writes, []);
+  } finally {
+    government.resolveBuilderPermissions = async (builderId) => (builderId === CALLER ? held : []);
+  }
+});
+
+test("requireActAlone('treasury') sending it to a sitting → its 409 refusal and no write", async () => {
+  actAlone = {
+    ok: false, reason: 'decided_by_sitting', area: 'treasury', rule: 'sitting',
+    who: 'the Treasury’s sitting', what_this_means: 'put it to a vote', open_with: '/government/treasury',
+  };
+  for (const body of [{ usd: 50 }, { usd: null }]) {
+    const r = await patch(body);
+    assert.equal(r.status, 409, JSON.stringify(body));
+    assert.equal(r.json.error.code, 'decided_by_sitting');
+    assert.equal(r.json.error.details.area, 'treasury');
+    assert.equal(r.json.error.details.open_with, '/government/treasury', 'the gate’s own refusal, passed through');
+  }
+  assert.deepEqual(writes, []);
+});
+
+test('a Treasury rule that cannot be read → 503 and no write (fail closed)', async () => {
+  actAlone = new Error('rule table unreadable');
+  const r = await patch({ usd: 50 });
+  assert.equal(r.status, 503);
+  assert.equal(r.json.error.code, 'decision_rule_unreadable');
+  assert.deepEqual(writes, []);
+});
+
+// ── the write failing ────────────────────────────────────────────────────────
+
+test('setSpendCap throwing → 500 project_settings_write_failed, the error’s text kept off the wire', async () => {
+  setThrows = new Error('relation project_settings: connection reset SECRET-ISH-DETAIL');
+  const r = await patch({ usd: 50 });
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'project_settings_write_failed');
+  assert.equal(r.json.error.message, 'internal error');
+  assert.doesNotMatch(JSON.stringify(r.json), /SECRET-ISH-DETAIL|connection reset/, 'the database error never reaches the caller');
+  assert.equal(r.json.ok, undefined, 'no success shape rides on a failure');
+  assert.deepEqual(writes, [{ usd: 50, builderId: CALLER }], 'it was attempted once, not retried');
+});

package/tests/promotion_sweep.mjs

@@ -240,7 +240,35 @@ await test('a throwing pool is reported, not propagated (a sweep can never crash
 await test('the sweep runs on the tick, fire-and-forget like its siblings', async () => {
   const src = readFileSync(new URL('../modules/lifecycle/publish-reconciler.js', import.meta.url), 'utf8')
     .replace(/\r\n/g, '\n');
-  assert.match(src, /runPromotionSweep\(deps\)\.catch\(/, 'wired into tick() the way runCriterionSweep is');
+  // task 1004924: the tick runs a guarded list (buildTick skips a sweep still in
+  // flight), so the wiring is an entry in SWEEPS, beside runCriterionSweep.
+  // task 1004965: the promotion sweep runs HOURLY; the criterion sweep keeps the tick.
+  assert.match(src, /\['promotion sweep', runPromotionSweep, HOURLY_MS\]/, 'wired into the tick, hourly');
+  assert.match(src, /\['criterion sweep', runCriterionSweep\]/);
+});
+
+await test('cadence per sweep: publish, cost and criterion every tick; promotion and craft backfill hourly (task 1004965)', async () => {
+  const byName = new Map(reconciler.SWEEPS.map(([name, , everyMs]) => [name, everyMs]));
+  assert.equal(reconciler.HOURLY_MS, 60 * 60_000);
+  for (const name of ['sweep', 'cost sweep', 'criterion sweep']) assert.equal(byName.get(name), undefined, `${name} keeps the tick`);
+  for (const name of ['promotion sweep', 'craft achievement backfill']) assert.equal(byName.get(name), reconciler.HOURLY_MS, `${name} is hourly`);
+
+  // Drive buildTick through 2 hours of 5-minute ticks on a fake clock.
+  const runs = { fast: 0, hourlyAt: [] };
+  let t = 0;
+  let i = 0;
+  const sweeps = [
+    ['fast', async () => { runs.fast += 1; }],
+    ['hourly', async () => { runs.hourlyAt.push(i); }, reconciler.HOURLY_MS],
+  ];
+  const tick = reconciler.buildTick({ logFn: () => {}, errFn: () => {} }, sweeps, { now: () => t, tickMs: 5 * 60_000 });
+  for (i = 0; i < 24; i++) {
+    tick();
+    await new Promise((r) => setImmediate(r)); // let the fire-and-forget runs settle
+    t += 5 * 60_000 - (i % 2 ? 3 : 0); // a few ms early on some ticks: timer jitter
+  }
+  assert.equal(runs.fast, 24, 'every tick');
+  assert.deepEqual(runs.hourlyAt, [0, 12], 'on the first tick and exactly 12 ticks (an hour) later — jitter never costs it a tick');
 });
 
 // ---------- Summary ----------

package/tests/provision.mjs

@@ -1628,7 +1628,8 @@ t('webEnvBody writes the BARE publish-credential vars, pem flattened to one env
   });
   // BARE names (github-push.js reads process.env.GITHUB_APP_ID, no instance prefix)
   assert.match(body, /^GITHUB_APP_ID=42$/m);
-  assert.match(body, /^GITHUB_APP_PRIVATE_KEY=-----BEGIN KEY-----\\nAAA\\nBBB\\n-----END KEY-----\\n$/m);
+  // double-quoted so systemd keeps the \n (task 1005009; tests/github_one_trip.mjs parses it as systemd does)
+  assert.match(body, /^GITHUB_APP_PRIVATE_KEY="-----BEGIN KEY-----\\nAAA\\nBBB\\n-----END KEY-----\\n"$/m);
   assert.doesNotMatch(body, /GITHUB_APP_INSTALLATION_ID/, 'installation id is discovered at runtime, never placed');
   // pem missing (older Apps) → no half-written credential
   const noPem = P.webEnvBody(inst, { clientId: 'Iv1.abc123def456ghi7', clientSecret: 's'.repeat(40), appId: 42, appPem: null });
@@ -1683,7 +1684,7 @@ await ta('placeManifestCreds (--apply): converts, rewrites web.env with the cred
   assert.match(env.body, /_GITHUB_CLIENT_SECRET=z{40}/);
   // …and the publish credential (task 1003049): App id + one-line pem, bare names
   assert.match(env.body, /^GITHUB_APP_ID=9$/m, 'the App id is placed as the publish credential');
-  assert.match(env.body, /^GITHUB_APP_PRIVATE_KEY=-----BEGIN KEY-----\\nAAA\\n-----END KEY-----\\n$/m, 'the pem is placed env-flattened');
+  assert.match(env.body, /^GITHUB_APP_PRIVATE_KEY="-----BEGIN KEY-----\\nAAA\\n-----END KEY-----\\n"$/m, 'the pem is placed env-flattened, double-quoted (task 1005009)');
   // the unit was restarted, and /healthz was probed
   assert.ok(cmds.some((c) => /systemctl restart mercury/.test(c)), 'restarts the unit');
   assert.ok(cmds.some((c) => /\/healthz/.test(c)), 'probes healthz');

package/tests/provisioning_app_status.mjs

@@ -219,6 +219,24 @@ await ta('the knocks run a few at a time, never all at once and never one by one
   assert.deepEqual(out, { checked: 12, live: 12 });
   assert.equal(peak, 5);
 });
+await ta('cadence: every 5 minutes, not every minute (task 1004960)', () => {
+  assert.equal(liveness.INTERVAL_MS, 5 * 60_000);
+});
+await ta('a run that starts while the previous sweep is in flight is skipped (task 1004960)', async () => {
+  let reads = 0;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  const db = { query: async () => { reads++; await gate; return { rows: [] }; } };
+  const first = liveness.tick({ pool: db, log: () => {} });
+  const secondRun = liveness.tick({ pool: db, log: () => {} }); // fires while the first is still reading
+  release();
+  const [firstOut, second] = await Promise.all([first, secondRun]);
+  assert.deepEqual(second, { skipped: true });
+  assert.deepEqual(firstOut, { checked: 0, live: 0 });
+  assert.equal(reads, 1, 'the overlapping run never touched the database');
+  assert.deepEqual(await liveness.tick({ pool: { query: async () => ({ rows: [] }) }, log: () => {} }), { checked: 0, live: 0 },
+    'once the first finished, the next run goes ahead');
+});
 await ta('the module starts the poller', () => {
   const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
   assert.ok(manifest.contributes.pollers.includes('app-liveness'));

package/tests/provisioning_credential_preflight.mjs

@@ -130,6 +130,59 @@ await ta('GitHub unreachable → ADMITTED, matching the runner: an outage must n
   assert.equal(await adoptCredentialFault(adopt(), deps({ throws: 'github_error' })), null);
 });
 
+// ── pre-launch (stealth) keeps project code private (task 1004998) ──────────────
+
+await ta('pre-launch ON: a PUBLIC repo is refused 409 public_repo_prelaunch, saying how to proceed', async () => {
+  const d = { ...deps({ repo: { private: false, admin: true } }), prelaunchActive: () => true };
+  const fault = await adoptCredentialFault(adopt(), d);
+  assert.equal(fault && fault.code, 'public_repo_prelaunch');
+  assert.equal(fault.status, 409);
+  assert.match(fault.message, /octo-owner\/demo is public/);
+  assert.match(fault.message, /private on GitHub first/, 'names the way forward');
+});
+
+await ta('pre-launch ON: a PRIVATE repo with admin still adopts, exactly as today', async () => {
+  const d = { ...deps({ repo: { private: true, admin: true } }), prelaunchActive: () => true };
+  assert.equal(await adoptCredentialFault(adopt(), d), null);
+});
+
+await ta('pre-launch ON: the admin refusal stops offering "make it public" as the way out', async () => {
+  const d = { ...deps({ repo: { private: true, admin: false } }), prelaunchActive: () => true };
+  const fault = await adoptCredentialFault(adopt(), d);
+  assert.equal(fault && fault.code, 'repo_admin_required');
+  assert.doesNotMatch(fault.message, /make the repository public/);
+});
+
+await ta('pre-launch ON: a GitHub hiccup still ADMITS — no positive read that the repo is public', async () => {
+  const d = { ...deps({ throws: 'github_error' }), prelaunchActive: () => true };
+  assert.equal(await adoptCredentialFault(adopt(), d), null);
+});
+
+await ta('pre-launch OFF (or not wired): a public repo adopts as before', async () => {
+  assert.equal(await adoptCredentialFault(adopt(), { ...deps(), prelaunchActive: () => false }), null);
+  assert.equal(await adoptCredentialFault(adopt(), deps()), null);
+});
+
+await ta('the doorway hands the module the REAL gate switch, read from the env each call', async () => {
+  const api = require('../src/module-api.js');
+  const saved = [process.env.PRELAUNCH_PASSWORD, process.env.STEALTH_PASSWORD];
+  try {
+    delete process.env.PRELAUNCH_PASSWORD; delete process.env.STEALTH_PASSWORD;
+    assert.equal(api.prelaunchActive(), false);
+    process.env.STEALTH_PASSWORD = 'x';   // the deprecated alias live still sets
+    assert.equal(api.prelaunchActive(), true);
+  } finally {
+    if (saved[0] === undefined) delete process.env.PRELAUNCH_PASSWORD; else process.env.PRELAUNCH_PASSWORD = saved[0];
+    if (saved[1] === undefined) delete process.env.STEALTH_PASSWORD; else process.env.STEALTH_PASSWORD = saved[1];
+  }
+});
+
+await ta('the create route WIRES the switch in — without it the check above is never asked', async () => {
+  const src = require('node:fs').readFileSync(require.resolve('../modules/provisioning/routes/provisioning.js'), 'utf8');
+  const call = src.slice(src.indexOf('await adoptCredentialFault('), src.indexOf('if (credFault)'));
+  assert.match(call, /prelaunchActive:\s*api\.prelaunchActive/);
+});
+
 // ── the parse must not drift from the runner's ──────────────────────────────────
 
 await ta('parseTargetRef accepts every form the runner accepts, and rejects what it rejects', async () => {

package/tests/provisioning_env_manifest_edit_delete.mjs

@@ -0,0 +1,223 @@
+// tests/provisioning_env_manifest_edit_delete.mjs — PATCH and DELETE
+// /provisioning/instances/:id/env-manifest/:varId, executed for real (task 1004986,
+// goal 1000094). The POST path is tests/provisioning_env_manifest.mjs's.
+//
+// The two write routes after a declaration exists had no test driving them, and each
+// carries a promise a regression would break quietly:
+//   - a VALUE is refused out loud, never stored (the manifest holds names only);
+//   - a variable id that belongs to ANOTHER project answers exactly like an id that
+//     does not exist, so a guessed id never confirms what someone else declared;
+//   - a builder who neither owns the project nor is an Archon is turned away before
+//     any data call, with the same 404 a missing project gets;
+//   - the project the data call is scoped to comes from the owner gate's loaded row,
+//     never from anything the caller put in the body.
+// Every refusal below asserts that NO data call was made.
+//
+// What is real: the router (modules/provisioning/routes/env-manifest.js), the owner
+// gate (route-helpers.js requireProjectOwner), parseVarId, the value refusal, the
+// strict body validator and the kernel error envelope. What is faked: who the caller
+// is (requireBuilder), the project row (getInstanceById: project 1, owned by builder
+// 7), and the two data calls, which RECORD their arguments and answer the way the SQL
+// does — a row only when the declaration's instance_id matches the scoped project.
+//
+// Run:  node --test tests/provisioning_env_manifest_edit_delete.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after, beforeEach } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const api = require('../src/module-api.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const envManifest = require('../modules/provisioning/env-manifest.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+// ── the cast ─────────────────────────────────────────────────────────────────
+const OWNER = { id: 7, rank: 'xenos', github_login: 'owner' };
+const STRANGER = { id: 8, rank: 'metic', github_login: 'stranger' };
+const ARCHON = { id: 9, rank: 'archon', github_login: 'archon' };
+const PROJECT_1 = Object.freeze({ id: 1, owner_builder_id: 7, slug: 'lantern', status: 'active', hosting_shape: 'byo-host' });
+
+// Declarations as the table holds them: 5 is project 1's, 6 is project 2's.
+const DECLARED = new Map([
+  ['5', { id: 5, instance_id: 1, name: 'DATABASE_URL', description: 'old text', environments: ['production'], required: true, created_at: 'c', updated_at: 'u' }],
+  ['6', { id: 6, instance_id: 2, name: 'OTHER_PROJECTS_VAR', description: 'theirs', environments: ['production'], required: true, created_at: 'c', updated_at: 'u' }],
+]);
+
+let caller = OWNER;
+let loads = [];
+let updates = [];
+let removes = [];
+
+beforeEach(() => { caller = OWNER; loads = []; updates = []; removes = []; });
+
+api.requireBuilder = (req, _res, next) => { req.builder = caller; next(); };
+provisioning.getInstanceById = async (_db, id) => {
+  loads.push(String(id));
+  return String(id) === '1' ? { ...PROJECT_1 } : null;
+};
+// The WHERE instance_id = $1 AND id = $2 the real SQL applies, applied here.
+const scoped = (instanceId, varId) => {
+  const row = DECLARED.get(String(varId));
+  return row && String(row.instance_id) === String(instanceId) ? row : null;
+};
+envManifest.updateEnvVar = async (db, instanceId, varId, patch) => {
+  updates.push({ db, instanceId, varId, patch: { ...patch } });
+  const row = scoped(instanceId, varId);
+  return row ? envManifest.envVarRow({ ...row, ...patch }) : null;
+};
+envManifest.removeEnvVar = async (db, instanceId, varId) => {
+  removes.push({ db, instanceId, varId });
+  return !!scoped(instanceId, varId);
+};
+
+const buildRouter = require('../modules/provisioning/routes/env-manifest.js');
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildRouter());
+
+let server, base;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const headers = payload ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } : {};
+    const req = http.request(`${base}${path}`, { method, headers }, (res) => {
+      let raw = '';
+      res.on('data', (c) => { raw += c; });
+      res.on('end', () => { let json = null; try { json = JSON.parse(raw); } catch { /* not JSON */ } resolve({ status: res.statusCode, json, raw }); });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+const varUrl = (varId, project = 1) => `/provisioning/instances/${project}/env-manifest/${varId}`;
+
+// Obviously fake: the shape of a provider key, none of its substance.
+const FAKE_SECRET = 'sk-FAKE-not-a-real-key-000000';
+
+// ── PATCH ────────────────────────────────────────────────────────────────────
+
+test('PATCH {value} → 400 value_not_accepted, the value never echoed, no updateEnvVar call', async () => {
+  const r = await call('PATCH', varUrl(5), { value: FAKE_SECRET });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'value_not_accepted', 'the value refusal speaks, not the generic validator');
+  assert.doesNotMatch(r.raw, /sk-FAKE/, 'the secret is not reflected back');
+  assert.deepEqual(updates, []);
+});
+
+test('PATCH carrying a value under every spelling the manifest knows, beside a legal edit → refused, no call', async () => {
+  for (const field of envManifest.VALUE_FIELDS) {
+    const r = await call('PATCH', varUrl(5), { description: 'fine', [field]: FAKE_SECRET });
+    assert.equal(r.status, 400, field);
+    assert.equal(r.json.error.code, 'value_not_accepted', field);
+  }
+  assert.deepEqual(updates, []);
+});
+
+test("PATCH another project's varId → 404 env_var_not_found, byte-identical to a varId that does not exist", async () => {
+  const foreign = await call('PATCH', varUrl(6), { description: 'mine now' });
+  const missing = await call('PATCH', varUrl(999), { description: 'mine now' });
+  assert.equal(foreign.status, 404);
+  assert.equal(foreign.json.error.code, 'env_var_not_found');
+  assert.equal(foreign.raw, missing.raw, 'a guessed id confirms nothing about another project');
+  assert.doesNotMatch(foreign.raw, /OTHER_PROJECTS_VAR|theirs/);
+  assert.deepEqual(updates.map((u) => u.instanceId), [1, 1], 'both scoped to the caller’s project, never to the id’s owner');
+});
+
+test('PATCH as builder 8 (not owner, not Archon) → 404 instance_not_found and no updateEnvVar call', async () => {
+  caller = STRANGER;
+  const r = await call('PATCH', varUrl(5), { description: 'x' });
+  assert.equal(r.status, 404);
+  assert.equal(r.json.error.code, 'instance_not_found');
+  assert.deepEqual(updates, []);
+  // …and byte-identical to a project that does not exist, so the id is not confirmed.
+  const none = await call('PATCH', varUrl(5, 77), { description: 'x' });
+  assert.equal(r.raw, none.raw);
+});
+
+test('PATCH as an Archon on project 1 → 200, scoped to project 1', async () => {
+  caller = ARCHON;
+  const r = await call('PATCH', varUrl(5), { description: 'archon fixed it' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.json.env_var.description, 'archon fixed it');
+  assert.equal(r.json.values_held, false);
+  assert.equal(updates.length, 1);
+  assert.equal(updates[0].instanceId, 1);
+});
+
+test('PATCH with only description → environments (and the rest) absent from the update call', async () => {
+  const r = await call('PATCH', varUrl(5), { description: 'new text' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(updates.length, 1);
+  const u = updates[0];
+  assert.equal(u.db, api.pool, 'the module pool, not something the request supplied');
+  assert.equal(u.instanceId, 1);
+  assert.equal(u.varId, '5');
+  assert.deepEqual(Object.keys(u.patch), ['description']);
+  assert.equal(Object.prototype.hasOwnProperty.call(u.patch, 'environments'), false, 'an omitted field is left alone (merge-patch)');
+});
+
+test('PATCH a malformed varId → 400 bad_id and no call', async () => {
+  const r = await call('PATCH', varUrl('5abc'), { description: 'x' });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_id');
+  assert.deepEqual(updates, []);
+});
+
+// ── DELETE ───────────────────────────────────────────────────────────────────
+
+test('DELETE → removeEnvVar(pool, 1, varId): the project id from the gate, never the body', async () => {
+  const r = await call('DELETE', varUrl(5), { instance_id: 2, instanceId: 2, id: 2 });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.json.removed, true);
+  assert.equal(removes.length, 1);
+  assert.equal(removes[0].db, api.pool);
+  assert.equal(removes[0].instanceId, 1, 'the loaded row’s id, not the body’s 2');
+  assert.equal(removes[0].varId, '5');
+});
+
+test("DELETE another project's varId → 404 env_var_not_found, byte-identical to a missing one", async () => {
+  const foreign = await call('DELETE', varUrl(6));
+  const missing = await call('DELETE', varUrl(999));
+  assert.equal(foreign.status, 404);
+  assert.equal(foreign.json.error.code, 'env_var_not_found');
+  assert.equal(foreign.raw, missing.raw);
+  assert.deepEqual(removes.map((x) => x.instanceId), [1, 1]);
+});
+
+test('DELETE as a non-owner → 404 instance_not_found before any call', async () => {
+  caller = STRANGER;
+  const r = await call('DELETE', varUrl(5));
+  assert.equal(r.status, 404);
+  assert.equal(r.json.error.code, 'instance_not_found');
+  assert.deepEqual(removes, []);
+});
+
+test('DELETE as an Archon on project 1 → 200, scoped to project 1', async () => {
+  caller = ARCHON;
+  const r = await call('DELETE', varUrl(5));
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(removes.map((x) => x.instanceId), [1]);
+});
+
+test('DELETE a malformed varId → 400 bad_id from parseVarId and no call', async () => {
+  for (const bad of ['abc', '5;DROP', '-1']) {
+    const r = await call('DELETE', varUrl(encodeURIComponent(bad)));
+    assert.equal(r.status, 400, bad);
+    assert.equal(r.json.error.code, 'bad_id', bad);
+    assert.match(r.json.error.message, /varId/, 'parseVarId’s own sentence, naming the field');
+  }
+  assert.deepEqual(removes, []);
+});

package/tests/publish_reconciler_overlap.mjs

@@ -0,0 +1,60 @@
+// tests/publish_reconciler_overlap.mjs
+//
+// task 1004924 — the reconciler's interval tick fired five sweeps every 5 minutes
+// with no check that the previous round had finished, so a slow DB or GitHub call
+// stacked rounds and held several pool connections at once. buildTick now keeps a
+// per-sweep in-flight flag: a sweep still running from the last tick is skipped.
+//
+// Its own file on purpose: tests/publish_reconciler.mjs exits on a fixed 100 ms
+// timer, so a case appended there that waits on a few event-loop turns is cut off
+// before it reports — it neither passes nor fails, it just vanishes.
+//
+// Run:  node tests/publish_reconciler_overlap.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+const { test, summary } = makeRunner();
+
+const settle = () => new Promise((r) => setImmediate(r));
+
+await test('buildTick skips a sweep still in flight, and runs it again once it settles', async () => {
+  const calls = { slow: 0, fast: 0, failing: 0 };
+  let releaseSlow;
+  const sweeps = [
+    ['slow', () => { calls.slow++; return new Promise((r) => { releaseSlow = r; }); }],
+    ['fast', async () => { calls.fast++; }],
+    ['failing', async () => { calls.failing++; throw new Error('boom'); }],
+  ];
+  const logs = [];
+  const errs = [];
+  const tick = reconciler.buildTick({ log: (m) => logs.push(m), error: (m) => errs.push(m) }, sweeps);
+
+  tick(); await settle();
+  tick(); await settle();
+  tick(); await settle();
+  assert.equal(calls.slow, 1, 'the slow sweep is never stacked while its first run is pending');
+  assert.equal(calls.fast, 3, 'a slow sweep never starves the others');
+  assert.equal(calls.failing, 3, 'a rejected run clears its flag too');
+  assert.equal(logs.filter((m) => /slow still running/.test(m)).length, 2, 'each skip is logged');
+
+  releaseSlow(); await settle();
+  tick(); await settle();
+  assert.equal(calls.slow, 2, 'once the run settles the next tick runs it again');
+});
+
+await test('the default tick covers all five sweeps', () => {
+  // A sweep left out of the guarded list would simply never run again.
+  const src = require('node:fs').readFileSync(require.resolve('../modules/lifecycle/publish-reconciler.js'), 'utf8');
+  // task 1004965: read the exported list, since an entry may now carry a cadence.
+  const fns = reconciler.SWEEPS.map(([, fn]) => fn);
+  for (const fn of ['runSweep', 'runCostSweep', 'runCriterionSweep', 'runPromotionSweep', 'runCraftAchievementBackfill']) {
+    assert.ok(fns.includes(reconciler[fn]), `${fn} is in the tick`);
+  }
+  assert.match(src, /const tick = buildTick\(deps\);/, 'start() uses the guarded tick');
+});
+
+summary();