@caelo-cms/provisioning 0.10.48 → 0.10.49

package/src/upgrader-assess.test.ts

@@ -35,9 +35,12 @@ const POLICY: StoredUpdatePolicy = {
   windowEnd: null,
   windowTimezone: "UTC",
   soakHours: 24,
+  securitySoakHours: 2,
   paused: false,
   pausedReason: null,
   pausedAt: null,
+  pausedUntil: null,
+  pausedByOwner: false,
   updatedAt: "2026-10-13T00:00:00Z",
 };
 
@@ -57,6 +60,7 @@ interface Row {
   readonly manifest?: ReleaseManifestResult;
   readonly installed?: InstalledState;
   readonly trigger?: "manual" | "auto";
+  readonly autoBasis?: "security" | "patch" | "minor";
   readonly policy?: StoredUpdatePolicy;
   readonly target?: string;
   /** "proceed" or `<status>/<code>`. */
@@ -157,6 +161,39 @@ const ROWS: readonly Row[] = [
     manifest: verified({ security: true, advisories: ["GHSA-abcd-efgh-ijkm"] }),
     expect: "proceed",
   },
+  {
+    name: "automatic 'security' flag without a published advisory",
+    trigger: "auto",
+    policy: { ...POLICY, autoMinor: false, autoPatch: false },
+    manifest: verified({ security: true, advisories: [] }),
+    expect: "refused/policy",
+  },
+  {
+    name: "queued as a security fix, signed manifest says it is not one",
+    trigger: "auto",
+    autoBasis: "security",
+    expect: "refused/policy",
+    reasonContains: "names no published security advisory",
+  },
+  {
+    name: "queued as a security fix, signed manifest agrees",
+    trigger: "auto",
+    autoBasis: "security",
+    manifest: verified({ security: true, advisories: ["GHSA-abcd-efgh-ijkm"] }),
+    expect: "proceed",
+  },
+  {
+    name: "automatic, Owner pause already over",
+    trigger: "auto",
+    policy: {
+      ...POLICY,
+      paused: true,
+      pausedByOwner: true,
+      pausedAt: "2026-10-12T00:00:00Z",
+      pausedUntil: "2026-10-13T00:00:00Z",
+    },
+    expect: "proceed",
+  },
   {
     name: "automatic, outside the window",
     trigger: "auto",
@@ -175,7 +212,11 @@ const ROWS: readonly Row[] = [
 describe("assessUpgradeRequest — refusal matrix", () => {
   it.each(ROWS.map((r) => [r.name, r] as const))("%s", (_name, row) => {
     const d = assessUpgradeRequest({
-      request: { targetVersion: row.target ?? "0.11.0", trigger: row.trigger ?? "manual" },
+      request: {
+        targetVersion: row.target ?? "0.11.0",
+        trigger: row.trigger ?? "manual",
+        autoBasis: row.autoBasis ?? null,
+      },
       manifest: row.manifest ?? verified(),
       installed: row.installed ?? INSTALLED,
       policy: row.policy ?? POLICY,

package/src/upgrader-assess.ts

@@ -30,6 +30,7 @@
  * | contract (destructive) migrations, automatic run    | refused           |
  * | contract migrations, Owner's click                  | proceed + warning |
  * | automatic run the update policy does not allow      | refused           |
+ * | automatic "security" run, signed manifest disagrees | refused           |
  *
  * Self-hosted installs (the host agent, #696 Phase 4c) have no separately
  * converged infrastructure: their Compose file, roles and bootstrap script
@@ -40,6 +41,7 @@
  */
 
 import {
+  type AutoUpdateBasis,
   autoInstallRefusal,
   type PlatformUpdateTrigger,
   type StoredUpdatePolicy,
@@ -119,7 +121,12 @@ const stop = (
 
 /** Decide what the job does with a request. See the file comment for the matrix. */
 export function assessUpgradeRequest(input: {
-  readonly request: { readonly targetVersion: string; readonly trigger: PlatformUpdateTrigger };
+  readonly request: {
+    readonly targetVersion: string;
+    readonly trigger: PlatformUpdateTrigger;
+    /** Why the admin's scheduler queued an automatic request (Phase 5). */
+    readonly autoBasis?: AutoUpdateBasis | null;
+  };
   readonly manifest: ReleaseManifestResult;
   readonly installed: InstalledState;
   readonly policy: StoredUpdatePolicy;
@@ -228,6 +235,16 @@ export function assessUpgradeRequest(input: {
     if (refusal) {
       return stop("refused", "policy", `Not installed automatically: ${refusal}.`, manifest);
     }
+    // The scheduler read the manifest unverified; it may only have used the
+    // security fix's shorter soak period if the SIGNED manifest backs it.
+    if (request.autoBasis === "security" && assessment.kind !== "security") {
+      return stop(
+        "refused",
+        "policy",
+        `Not installed automatically: v${target} was queued as a security fix, but its signed release information names no published security advisory. Install it from Settings → Updates.`,
+        manifest,
+      );
+    }
   }
   return { kind: "proceed", manifest, warnings };
 }

package/src/upgrader-job.test.ts

@@ -53,9 +53,12 @@ const POLICY: StoredUpdatePolicy = {
   windowEnd: null,
   windowTimezone: "UTC",
   soakHours: 24,
+  securitySoakHours: 2,
   paused: false,
   pausedReason: null,
   pausedAt: null,
+  pausedUntil: null,
+  pausedByOwner: false,
   updatedAt: "2026-10-13T00:00:00Z",
 };
 

package/src/upgrader-job.ts

@@ -33,6 +33,7 @@
  */
 
 import type {
+  AutoUpdateBasis,
   PlatformUpdateEventLevel,
   PlatformUpdatePhase,
   PlatformUpdateTrigger,
@@ -61,6 +62,8 @@ export interface ClaimedUpdate {
   readonly id: string;
   readonly targetVersion: string;
   readonly trigger: PlatformUpdateTrigger;
+  /** Why the admin's scheduler queued an automatic request; null for the Owner's. */
+  readonly autoBasis?: AutoUpdateBasis | null;
   readonly policy: StoredUpdatePolicy;
 }