@homeflare/alchemy 0.38.0 → 0.40.0

package/src/ceph/ceph-auth-parse.test.ts

@@ -0,0 +1,155 @@
+/**
+ * Parsing against fixture stdout — REASONED shapes (ceph-auth-parse.ts's header), so these fixtures
+ * are this PR's stand-in for a live cluster, not a measurement.
+ */
+import { describe, expect, test } from 'bun:test';
+import { leaksSliceOf, trailingCommaKeyStdout, unquotedKeyStdout } from './ceph-key-leak-assert.ts';
+import { parseAuthGet, parseAuthGetOrCreate, parseQuorumStatus } from './ceph-auth-parse.ts';
+
+const ENTITY = 'client.k8s-rbd';
+const CAPS = {
+  mgr: 'profile rbd pool=k8s-rbd',
+  mon: 'profile rbd',
+  osd: 'profile rbd pool=k8s-rbd',
+};
+const KEYRING_JSON = JSON.stringify([
+  { caps: CAPS, entity: ENTITY, key: 'fake-ceph-key-not-a-real-secret' },
+]);
+
+describe('parseAuthGet', () => {
+  test('present: returns caps only — the parsed value has no key field at all', () => {
+    const observed = parseAuthGet({ exitCode: 0, stderr: '', stdout: KEYRING_JSON }, ENTITY);
+    expect(observed).toEqual({ caps: CAPS, kind: 'present' });
+    expect(Object.keys(observed)).not.toContain('key');
+  });
+
+  test('absent: ENOENT in stderr, never mistaken for an error', () => {
+    const observed = parseAuthGet(
+      { exitCode: 2, stderr: 'Error ENOENT: failed to find client.k8s-rbd in keyring', stdout: '' },
+      ENTITY,
+    );
+    expect(observed).toEqual({ kind: 'absent' });
+  });
+
+  test('a nonzero exit without ENOENT propagates as an error, never as absent', () => {
+    expect(() =>
+      parseAuthGet({ exitCode: 1, stderr: 'Error EACCES: permission denied', stdout: '' }, ENTITY),
+    ).toThrow(/EACCES/);
+  });
+
+  test('unparseable stdout is an error, never absent', () => {
+    expect(() => parseAuthGet({ exitCode: 0, stderr: '', stdout: 'not json' }, ENTITY)).toThrow();
+  });
+
+  test('a JSON array with no matching entity is an error', () => {
+    const other = JSON.stringify([{ caps: CAPS, entity: 'client.k8s-other', key: 'x' }]);
+    expect(() => parseAuthGet({ exitCode: 0, stderr: '', stdout: other }, ENTITY)).toThrow(
+      /no matching entry/,
+    );
+  });
+
+  test('an entry missing a caps field is an error', () => {
+    const bad = JSON.stringify([{ entity: ENTITY, key: 'x' }]);
+    expect(() => parseAuthGet({ exitCode: 0, stderr: '', stdout: bad }, ENTITY)).toThrow();
+  });
+
+  // Decision 65 (LAND finding 5): `auth get` is read unfiltered on every reconcile, so every
+  // failure path below feeds it a key-shaped sentinel and proves no 8-character SLICE of it ever
+  // reaches the thrown error — not just the whole string. LAND red team (2026-09-26), CONFIRMED:
+  // a hyphenated sentinel and a whole-string `.not.toContain` check both missed a real leak where
+  // `JSON.parse`'s own error message quoted a prefix of an unquoted or comma-adjacent key
+  // (ceph-key-leak-assert.ts has the measured detail).
+  test('a malformed present entry never lets even a slice of the key it carried leak', () => {
+    const bad = JSON.stringify([{ entity: ENTITY, key: 'sentinel-ceph-key-must-never-leak' }]); // no caps
+    let caught: unknown;
+    try {
+      parseAuthGet({ exitCode: 0, stderr: '', stdout: bad }, ENTITY);
+    } catch (cause) {
+      caught = cause;
+    }
+    expect(caught).toBeInstanceOf(Error);
+    expect(leaksSliceOf(String(caught), 'sentinel-ceph-key-must-never-leak')).toBe(false);
+  });
+
+  test('a nonzero exit never echoes stdout, even a slice of a key it somehow carried', () => {
+    const stdout = unquotedKeyStdout(ENTITY);
+    let caught: unknown;
+    try {
+      parseAuthGet({ exitCode: 13, stderr: 'Error EPERM: refused', stdout }, ENTITY);
+    } catch (cause) {
+      caught = cause;
+    }
+    expect(String(caught)).toContain('EPERM');
+    expect(leaksSliceOf(String(caught))).toBe(false);
+  });
+
+  for (const [shape, stdout] of [
+    ['a bare (unquoted) key token', unquotedKeyStdout(ENTITY)],
+    ['a trailing comma after the entry', trailingCommaKeyStdout(ENTITY)],
+  ] as const) {
+    test(`unparseable stdout via ${shape} never leaks a slice of the key, from parseAuthGet`, () => {
+      let caught: unknown;
+      try {
+        parseAuthGet({ exitCode: 0, stderr: '', stdout }, ENTITY);
+      } catch (cause) {
+        caught = cause;
+      }
+      expect(caught).toBeInstanceOf(Error);
+      expect(leaksSliceOf(String(caught))).toBe(false);
+    });
+
+    test(`unparseable stdout via ${shape} never leaks a slice of the key, from parseAuthGetOrCreate`, () => {
+      let caught: unknown;
+      try {
+        parseAuthGetOrCreate({ exitCode: 0, stderr: '', stdout }, ENTITY);
+      } catch (cause) {
+        caught = cause;
+      }
+      expect(caught).toBeInstanceOf(Error);
+      expect(leaksSliceOf(String(caught))).toBe(false);
+    });
+  }
+});
+
+describe('parseAuthGetOrCreate', () => {
+  test('returns caps and the key, on success', () => {
+    const created = parseAuthGetOrCreate({ exitCode: 0, stderr: '', stdout: KEYRING_JSON }, ENTITY);
+    expect(created).toEqual({ caps: CAPS, key: 'fake-ceph-key-not-a-real-secret' });
+  });
+
+  test('never reads a nonzero exit as absent — always an error', () => {
+    expect(() =>
+      parseAuthGetOrCreate(
+        { exitCode: 22, stderr: 'Error EINVAL: caps do not match', stdout: '' },
+        ENTITY,
+      ),
+    ).toThrow(/EINVAL/);
+  });
+});
+
+describe('parseQuorumStatus', () => {
+  test('healthy: a non-empty quorum array', () => {
+    expect(parseQuorumStatus('{"quorum":[0,1,2],"quorum_names":["a","b","c"]}')).toEqual({
+      healthy: true,
+    });
+  });
+
+  test('degraded: an empty quorum array', () => {
+    expect(parseQuorumStatus('{"quorum":[]}')).toEqual({
+      healthy: false,
+      reason: 'no non-empty `quorum` array in the quorum_status output',
+    });
+  });
+
+  test('degraded: no quorum field at all', () => {
+    expect(parseQuorumStatus('{"election_epoch":5}').healthy).toBe(false);
+  });
+
+  test('degraded: not even a JSON object', () => {
+    expect(parseQuorumStatus('[1,2,3]').healthy).toBe(false);
+  });
+
+  test('degraded, never thrown: unparseable JSON fails closed instead of crashing the caller', () => {
+    expect(parseQuorumStatus('not json').healthy).toBe(false);
+  });
+});

package/src/ceph/ceph-auth-parse.ts

@@ -0,0 +1,121 @@
+/**
+ * Parsing for the three ceph `-f json` shapes `Ceph.AuthEntity` reads: `auth get`, `auth
+ * get-or-create` and `quorum_status`. Pure: no I/O, tested with fixture stdout
+ * (ceph-auth-parse.test.ts) — there is no live mon to capture real output from yet, so every shape
+ * below is REASONED from public Ceph documentation, not measured, and an unexpected shape is
+ * always an error, never a guess.
+ *
+ * ⛔ `parseAuthGet`'S RETURN TYPE HAS NO `key` FIELD. Decision 65 (2026-09-26, LAND finding 5)
+ *   amended the design to let the observe step read `auth get`'s unfiltered stdout on every
+ *   reconcile, not only on create — but the key it carries is dropped in the same breath:
+ *   `parseKeyringEntry` reads it into a local binding and `parseAuthGet` never puts it in the
+ *   object it returns. Not a convention, a type: there is no field here to forget to strip.
+ * ⛔ `parseQuorumStatus` FAILS CLOSED. A JSON parse error, a missing `quorum` array or an empty one
+ *   all answer `{ healthy: false }`; nothing here ever calls an unparseable answer healthy.
+ */
+
+export type CephCaps = { readonly mon: string; readonly osd: string; readonly mgr: string };
+
+export type CephExecOutcome = {
+  readonly exitCode: number;
+  readonly stdout: string;
+  readonly stderr: string;
+};
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null;
+
+const parseCaps = (value: unknown, entity: string): CephCaps => {
+  if (!isRecord(value)) throw new Error(`ceph auth: ${entity}'s entry has no caps object`);
+  const { mon, osd, mgr } = value;
+  if (typeof mon !== 'string' || typeof osd !== 'string' || typeof mgr !== 'string') {
+    throw new Error(`ceph auth: ${entity}'s caps are missing a mon, osd or mgr string`);
+  }
+  return { mgr, mon, osd };
+};
+
+/**
+ * REASONED shape (public `ceph auth get -f json` / `auth get-or-create -f json` docs): a JSON
+ * array with one object per entity, `{entity, key, caps: {mon, osd, mgr}}`.
+ */
+const parseKeyringEntry = (
+  stdout: string,
+  entity: string,
+): { readonly caps: CephCaps; readonly key: string } => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    // ⛔ NEVER INTERPOLATE THE CATCH VALUE. LAND red team (2026-09-26), CONFIRMED: both Bun's and
+    //   Node's `JSON.parse` errors quote a slice of the offending input — a bare (unquoted) or
+    //   comma-adjacent key in this stdout put a slice of a real cephx key straight into this
+    //   thrown error (measured: median 32/40 chars of a 1000-key sample). `stdout` carries the
+    //   key on every reconcile since decision 65, so this message names only what failed, never
+    //   any part of what it was reading.
+    throw new Error(`ceph auth ${entity}: stdout did not parse as JSON`);
+  }
+  const row = Array.isArray(parsed)
+    ? parsed.find((entry) => isRecord(entry) && entry['entity'] === entity)
+    : undefined;
+  if (!isRecord(row)) throw new Error(`ceph auth ${entity}: no matching entry in the JSON output`);
+  const { key } = row;
+  if (typeof key !== 'string' || key.trim() === '') {
+    throw new Error(`ceph auth ${entity}: the entry has no key field`);
+  }
+  return { caps: parseCaps(row['caps'], entity), key };
+};
+
+export type CephAuthObserved =
+  | { readonly kind: 'present'; readonly caps: CephCaps }
+  | { readonly kind: 'absent' };
+
+/**
+ * ⚠️ ABSENCE IS RECOGNISED ONLY BY `ENOENT` IN STDERR (REASONED from `ceph auth get`'s documented
+ *   error text). Any other nonzero exit — a permission problem, a malformed entity ceph itself
+ *   refused, a mon mid-election — propagates as an error, never as "absent": the transient-read
+ *   test every family in this kit carries.
+ */
+export const parseAuthGet = (result: CephExecOutcome, entity: string): CephAuthObserved => {
+  if (result.exitCode !== 0) {
+    if (result.stderr.includes('ENOENT')) return { kind: 'absent' };
+    throw new Error(`ceph auth get ${entity} failed: ${result.stderr.trim().slice(0, 300)}`);
+  }
+  const { caps } = parseKeyringEntry(result.stdout, entity);
+  return { caps, kind: 'present' };
+};
+
+/**
+ * ⚠️ `get-or-create` NEVER READS AS ABSENT — REASONED: it either creates, returns the existing
+ *   entity unchanged, or fails outright (e.g. an existing entity with different caps). A nonzero
+ *   exit here is always an error.
+ */
+export const parseAuthGetOrCreate = (
+  result: CephExecOutcome,
+  entity: string,
+): { readonly caps: CephCaps; readonly key: string } => {
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `ceph auth get-or-create ${entity} failed: ${result.stderr.trim().slice(0, 300)}`,
+    );
+  }
+  return parseKeyringEntry(result.stdout, entity);
+};
+
+export type CephQuorum =
+  | { readonly healthy: true }
+  | { readonly healthy: false; readonly reason: string };
+
+/** REASONED shape (public `ceph quorum_status -f json` docs): an object with a `quorum` array. */
+export const parseQuorumStatus = (stdout: string): CephQuorum => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch (cause) {
+    return { healthy: false, reason: `stdout did not parse as JSON (${String(cause)})` };
+  }
+  if (!isRecord(parsed)) return { healthy: false, reason: 'stdout was not a JSON object' };
+  const quorum = parsed['quorum'];
+  return Array.isArray(quorum) && quorum.length > 0
+    ? { healthy: true }
+    : { healthy: false, reason: 'no non-empty `quorum` array in the quorum_status output' };
+};

package/src/ceph/ceph-auth-reconcile-secrecy.test.ts

@@ -0,0 +1,82 @@
+/**
+ * K-A4 finding 5 / decision 65 (2026-09-26): the design was amended to let the observe step read
+ * `auth get`'s unfiltered stdout on every reconcile, not only on create, with no node-side shell
+ * filter — accepted because the key is dropped in memory before anything is logged, returned,
+ * stored or put in an error. Split from ceph-auth-reconcile.test.ts (which already covers the
+ * happy-path create/no-op/drift secrecy checks) to keep that file under the house line cap; this
+ * file is the failure-path proof the decision's own text calls for.
+ *
+ * ⛔ THE MALFORMED STDOUT MUST ACTUALLY FAIL `JSON.parse`. LAND red team (2026-09-26), CONFIRMED:
+ *   an earlier version of this file fed a WELL-FORMED JSON entry that was merely missing `caps` —
+ *   a different, never-vulnerable error path (`parseCaps` never even looks at `key`) — so it never
+ *   exercised the line that used to interpolate the parse failure's own message. The two shapes
+ *   below (ceph-key-leak-assert.ts) are ones that genuinely throw inside `JSON.parse`.
+ */
+import { describe, expect, test } from 'bun:test';
+import { type Seen, run, withFake } from '../openbao/fake-bao.ts';
+import {
+  KEY_SHAPED_SENTINEL,
+  leaksSliceOf,
+  trailingCommaKeyStdout,
+  unquotedKeyStdout,
+} from './ceph-key-leak-assert.ts';
+import { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';
+import type { CephAuthEntityProps } from './ceph-auth-form.ts';
+import { fakeCephDial, fakeCephOk } from './fake-ceph-dial.ts';
+
+const ENTITY = 'client.k8s-rbd';
+const MON = 'mon-a.example.test';
+const CAPS = {
+  mgr: 'profile rbd pool=k8s-rbd',
+  mon: 'profile rbd',
+  osd: 'profile rbd pool=k8s-rbd',
+};
+const PROPS: CephAuthEntityProps = { caps: CAPS, entity: ENTITY, mount: 'talos-c1', nodes: [MON] };
+const okReply = () => ({ status: 200 });
+
+const reconcileOn = async (stdout: string) => {
+  const lines: string[] = [];
+  const fake = fakeCephDial({ [MON]: [fakeCephOk(stdout)] });
+  let caught: unknown;
+  let seen: readonly Seen[] = [];
+  await withFake(okReply, async (bao) => {
+    try {
+      await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: (l) => lines.push(l) }),
+      );
+    } catch (cause) {
+      caught = cause;
+    }
+    seen = bao.seen;
+  });
+  return { caught, lines, writes: seen.filter((s) => s.method !== 'GET') };
+};
+
+describe('a malformed present observation', () => {
+  test('a well-formed entry missing `caps` never leaks the key it carried (parseCaps never sees it)', async () => {
+    const { caught, lines, writes } = await reconcileOn(
+      JSON.stringify([{ entity: ENTITY, key: KEY_SHAPED_SENTINEL }]),
+    );
+    expect(caught).toBeInstanceOf(Error);
+    expect(leaksSliceOf(String(caught))).toBe(false);
+    expect(writes).toHaveLength(0);
+    expect(leaksSliceOf(lines.join('\n'))).toBe(false);
+  });
+
+  for (const [shape, stdout] of [
+    ['a bare (unquoted) key token', unquotedKeyStdout(ENTITY)],
+    ['a trailing comma after the entry', trailingCommaKeyStdout(ENTITY)],
+  ] as const) {
+    test(`unparseable stdout via ${shape} never leaks a slice of the key, through the full reconcile loop`, async () => {
+      // Decision 65 accepts reading `auth get`'s unfiltered stdout on every reconcile only
+      // because the key never survives past the parse — including when the parse ITSELF fails on
+      // input that (unlike a well-formed-but-incomplete entry) actually contains the key's bytes.
+      const { caught, lines, writes } = await reconcileOn(stdout);
+      expect(caught).toBeInstanceOf(Error);
+      expect(leaksSliceOf(String(caught))).toBe(false);
+      expect(writes).toHaveLength(0);
+      expect(leaksSliceOf(lines.join('\n'))).toBe(false);
+    });
+  }
+});

package/src/ceph/ceph-auth-reconcile.test.ts

@@ -0,0 +1,233 @@
+/**
+ * The observe -> ensure -> sync loop against fakeCephDial + fakeBao — no ssh, no real vault.
+ * Mon-transport doc acceptance tests #2 (the reconcile loop itself) and #3 (secret handling). The
+ * failure-path half of #3 — a malformed `auth get` reply that still carries a key — is
+ * ceph-auth-reconcile-secrecy.test.ts, split out to keep this file under the house line cap.
+ */
+import { describe, expect, test } from 'bun:test';
+import { sha256 } from '../openbao/digest.ts';
+import { type Reply, type Seen, run, withFake } from '../openbao/fake-bao.ts';
+import { leaksSliceOf } from './ceph-key-leak-assert.ts';
+import { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';
+import type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
+import { fakeCephDial, fakeCephOk } from './fake-ceph-dial.ts';
+
+const ENTITY = 'client.k8s-rbd';
+const MON = 'mon-a.example.test';
+const CAPS = {
+  mgr: 'profile rbd pool=k8s-rbd',
+  mon: 'profile rbd',
+  osd: 'profile rbd pool=k8s-rbd',
+};
+const OTHER_CAPS = { ...CAPS, osd: 'profile rbd pool=other' };
+const KEY = 'fake-ceph-key-not-a-real-secret';
+const keyring = (caps = CAPS) => JSON.stringify([{ caps, entity: ENTITY, key: KEY }]);
+const ABSENT = { exitCode: 2, stderr: 'Error ENOENT: not found', stdout: '' };
+const HEALTHY_QUORUM = '{"quorum":[0,1,2]}';
+
+const PROPS: CephAuthEntityProps = { caps: CAPS, entity: ENTITY, mount: 'talos-c1', nodes: [MON] };
+const PRIOR: CephAuthEntityAttributes = {
+  baoPath: 'talos-c1/ceph/client.k8s-rbd',
+  caps: CAPS,
+  entity: ENTITY,
+  fingerprint: sha256(KEY),
+  node: MON,
+};
+
+const okReply = (): Reply => ({ status: 200 });
+const writesOf = (seen: readonly Seen[]) => seen.filter((s) => s.method !== 'GET');
+const argvOf = (seen: readonly { readonly argv: readonly string[] }[]) =>
+  seen.map((c) => c.argv.slice(1, 3));
+
+describe('create of absent', () => {
+  test('a preflight write, get-or-create, the real write, one quorum check, key never in the attributes', async () => {
+    const lines: string[] = [];
+    const fake = fakeCephDial({
+      [MON]: [
+        { kind: 'result', result: ABSENT },
+        fakeCephOk(keyring()),
+        fakeCephOk(HEALTHY_QUORUM),
+      ],
+    });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, undefined, {
+          dial: fake.dial,
+          log: (line) => lines.push(line),
+        }),
+      );
+      expect(attrs).toEqual(PRIOR);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+
+      // ⛔ The preflight (K-A4 finding 2) proves the path is writable BEFORE anything is minted —
+      //   see ceph-auth-reconcile.ts's header. Both writes land at the same path; only the second
+      //   carries the key.
+      const writes = writesOf(bao.seen);
+      expect(writes).toHaveLength(2);
+      expect(writes[0]?.path).toBe('/v1/talos-c1/data/ceph/client.k8s-rbd');
+      expect(leaksSliceOf(writes[0]?.body ?? '', KEY)).toBe(false);
+      expect(writes[1]?.path).toBe('/v1/talos-c1/data/ceph/client.k8s-rbd');
+      expect(writes[1]?.body).toContain(KEY);
+
+      expect(argvOf(fake.seen)).toEqual([
+        ['auth', 'get'],
+        ['auth', 'get-or-create'],
+        ['quorum_status', '-f'],
+      ]);
+      for (const call of fake.seen)
+        expect(leaksSliceOf(JSON.stringify(call.argv), KEY)).toBe(false);
+      // Decision 65 (LAND finding 5): the create path's own `auth get` observe also reads the
+      // keyring's unfiltered stdout — this proves the runner's log line never carries it either.
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+
+  test('a vault write refused before anything is minted leaves the mon untouched', async () => {
+    const fake = fakeCephDial({ [MON]: [{ kind: 'result', result: ABSENT }] });
+    const refused = () => ({ json: { errors: ['permission denied'] }, status: 403 });
+    await withFake(refused, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow();
+      // Only `auth get` (the observe) reached the mon — the preflight failed before get-or-create.
+      expect(argvOf(fake.seen)).toEqual([['auth', 'get']]);
+    });
+  });
+});
+
+describe('a second reconcile, caps unchanged', () => {
+  test('zero bao writes, zero quorum checks — the observe alone decides', async () => {
+    // Decision 65 (LAND finding 5): this `auth get` reads the keyring's unfiltered stdout too —
+    // prove the key never survives into attrs or the per-call log line, same as the create path.
+    const lines: string[] = [];
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, PRIOR, { dial: fake.dial, log: (line) => lines.push(line) }),
+      );
+      expect(attrs).toEqual(PRIOR);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(fake.seen).toHaveLength(1);
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+});
+
+describe('caps drift', () => {
+  test('runs exactly auth caps, never get-or-create; the fingerprint is reused, not reminted', async () => {
+    // Same decision-65 guarantee: the drifted `auth get` reply carries the key in its stdout too.
+    const lines: string[] = [];
+    const drifted: CephAuthEntityAttributes = { ...PRIOR, caps: OTHER_CAPS };
+    const fake = fakeCephDial({
+      [MON]: [fakeCephOk(keyring(OTHER_CAPS)), fakeCephOk(HEALTHY_QUORUM)],
+    });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, drifted, {
+          dial: fake.dial,
+          log: (line) => lines.push(line),
+        }),
+      );
+      expect(attrs.caps).toEqual(CAPS);
+      expect(attrs.fingerprint).toBe(PRIOR.fingerprint);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(argvOf(fake.seen)).toEqual([
+        ['auth', 'get'],
+        ['auth', 'caps'],
+        ['quorum_status', '-f'],
+      ]);
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+});
+
+describe('a down anchor', () => {
+  test('every mon failing at the transport layer is an error, never "absent", and nothing is created', async () => {
+    const fake = fakeCephDial({});
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/never treated as absent/);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+    });
+  });
+});
+
+describe('never adopted', () => {
+  test('a live entity present with no prior state is refused outright, never taken over', async () => {
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/never adopted/);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(fake.seen).toHaveLength(1);
+    });
+  });
+});
+
+describe('a moved identity (K-A4 finding 1)', () => {
+  test('an entity edited in place is refused before any ssh call, never re-capped as a takeover', async () => {
+    const moved: CephAuthEntityProps = { ...PROPS, entity: 'client.k8s-other' };
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(moved, PRIOR, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/identity moved/);
+      // Refused before the transport is ever touched — no `auth get`, no `auth caps`.
+      expect(fake.seen).toHaveLength(0);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+    });
+  });
+
+  test('a mount change alone is the same identity move', async () => {
+    const moved: CephAuthEntityProps = { ...PROPS, mount: 'talos-c2' };
+    const fake = fakeCephDial({});
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(moved, PRIOR, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/identity moved/);
+      expect(fake.seen).toHaveLength(0);
+    });
+  });
+});
+
+describe('a degraded quorum after a write fails the row', () => {
+  test('the create is reported as failed even though the ceph write itself landed', async () => {
+    const fake = fakeCephDial({
+      [MON]: [
+        { kind: 'result', result: ABSENT },
+        fakeCephOk(keyring()),
+        fakeCephOk('{"quorum":[]}'),
+      ],
+    });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/degraded/);
+    });
+  });
+});