@homeflare/alchemy 0.39.0 → 0.40.0

package/src/ceph/ceph-auth-reconcile-secrecy.test.ts

@@ -0,0 +1,82 @@
+/**
+ * K-A4 finding 5 / decision 65 (2026-09-26): the design was amended to let the observe step read
+ * `auth get`'s unfiltered stdout on every reconcile, not only on create, with no node-side shell
+ * filter — accepted because the key is dropped in memory before anything is logged, returned,
+ * stored or put in an error. Split from ceph-auth-reconcile.test.ts (which already covers the
+ * happy-path create/no-op/drift secrecy checks) to keep that file under the house line cap; this
+ * file is the failure-path proof the decision's own text calls for.
+ *
+ * ⛔ THE MALFORMED STDOUT MUST ACTUALLY FAIL `JSON.parse`. LAND red team (2026-09-26), CONFIRMED:
+ *   an earlier version of this file fed a WELL-FORMED JSON entry that was merely missing `caps` —
+ *   a different, never-vulnerable error path (`parseCaps` never even looks at `key`) — so it never
+ *   exercised the line that used to interpolate the parse failure's own message. The two shapes
+ *   below (ceph-key-leak-assert.ts) are ones that genuinely throw inside `JSON.parse`.
+ */
+import { describe, expect, test } from 'bun:test';
+import { type Seen, run, withFake } from '../openbao/fake-bao.ts';
+import {
+  KEY_SHAPED_SENTINEL,
+  leaksSliceOf,
+  trailingCommaKeyStdout,
+  unquotedKeyStdout,
+} from './ceph-key-leak-assert.ts';
+import { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';
+import type { CephAuthEntityProps } from './ceph-auth-form.ts';
+import { fakeCephDial, fakeCephOk } from './fake-ceph-dial.ts';
+
+const ENTITY = 'client.k8s-rbd';
+const MON = 'mon-a.example.test';
+const CAPS = {
+  mgr: 'profile rbd pool=k8s-rbd',
+  mon: 'profile rbd',
+  osd: 'profile rbd pool=k8s-rbd',
+};
+const PROPS: CephAuthEntityProps = { caps: CAPS, entity: ENTITY, mount: 'talos-c1', nodes: [MON] };
+const okReply = () => ({ status: 200 });
+
+const reconcileOn = async (stdout: string) => {
+  const lines: string[] = [];
+  const fake = fakeCephDial({ [MON]: [fakeCephOk(stdout)] });
+  let caught: unknown;
+  let seen: readonly Seen[] = [];
+  await withFake(okReply, async (bao) => {
+    try {
+      await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: (l) => lines.push(l) }),
+      );
+    } catch (cause) {
+      caught = cause;
+    }
+    seen = bao.seen;
+  });
+  return { caught, lines, writes: seen.filter((s) => s.method !== 'GET') };
+};
+
+describe('a malformed present observation', () => {
+  test('a well-formed entry missing `caps` never leaks the key it carried (parseCaps never sees it)', async () => {
+    const { caught, lines, writes } = await reconcileOn(
+      JSON.stringify([{ entity: ENTITY, key: KEY_SHAPED_SENTINEL }]),
+    );
+    expect(caught).toBeInstanceOf(Error);
+    expect(leaksSliceOf(String(caught))).toBe(false);
+    expect(writes).toHaveLength(0);
+    expect(leaksSliceOf(lines.join('\n'))).toBe(false);
+  });
+
+  for (const [shape, stdout] of [
+    ['a bare (unquoted) key token', unquotedKeyStdout(ENTITY)],
+    ['a trailing comma after the entry', trailingCommaKeyStdout(ENTITY)],
+  ] as const) {
+    test(`unparseable stdout via ${shape} never leaks a slice of the key, through the full reconcile loop`, async () => {
+      // Decision 65 accepts reading `auth get`'s unfiltered stdout on every reconcile only
+      // because the key never survives past the parse — including when the parse ITSELF fails on
+      // input that (unlike a well-formed-but-incomplete entry) actually contains the key's bytes.
+      const { caught, lines, writes } = await reconcileOn(stdout);
+      expect(caught).toBeInstanceOf(Error);
+      expect(leaksSliceOf(String(caught))).toBe(false);
+      expect(writes).toHaveLength(0);
+      expect(leaksSliceOf(lines.join('\n'))).toBe(false);
+    });
+  }
+});

package/src/ceph/ceph-auth-reconcile.test.ts

@@ -0,0 +1,233 @@
+/**
+ * The observe -> ensure -> sync loop against fakeCephDial + fakeBao — no ssh, no real vault.
+ * Mon-transport doc acceptance tests #2 (the reconcile loop itself) and #3 (secret handling). The
+ * failure-path half of #3 — a malformed `auth get` reply that still carries a key — is
+ * ceph-auth-reconcile-secrecy.test.ts, split out to keep this file under the house line cap.
+ */
+import { describe, expect, test } from 'bun:test';
+import { sha256 } from '../openbao/digest.ts';
+import { type Reply, type Seen, run, withFake } from '../openbao/fake-bao.ts';
+import { leaksSliceOf } from './ceph-key-leak-assert.ts';
+import { reconcileCephAuthEntity } from './ceph-auth-reconcile.ts';
+import type { CephAuthEntityAttributes, CephAuthEntityProps } from './ceph-auth-form.ts';
+import { fakeCephDial, fakeCephOk } from './fake-ceph-dial.ts';
+
+const ENTITY = 'client.k8s-rbd';
+const MON = 'mon-a.example.test';
+const CAPS = {
+  mgr: 'profile rbd pool=k8s-rbd',
+  mon: 'profile rbd',
+  osd: 'profile rbd pool=k8s-rbd',
+};
+const OTHER_CAPS = { ...CAPS, osd: 'profile rbd pool=other' };
+const KEY = 'fake-ceph-key-not-a-real-secret';
+const keyring = (caps = CAPS) => JSON.stringify([{ caps, entity: ENTITY, key: KEY }]);
+const ABSENT = { exitCode: 2, stderr: 'Error ENOENT: not found', stdout: '' };
+const HEALTHY_QUORUM = '{"quorum":[0,1,2]}';
+
+const PROPS: CephAuthEntityProps = { caps: CAPS, entity: ENTITY, mount: 'talos-c1', nodes: [MON] };
+const PRIOR: CephAuthEntityAttributes = {
+  baoPath: 'talos-c1/ceph/client.k8s-rbd',
+  caps: CAPS,
+  entity: ENTITY,
+  fingerprint: sha256(KEY),
+  node: MON,
+};
+
+const okReply = (): Reply => ({ status: 200 });
+const writesOf = (seen: readonly Seen[]) => seen.filter((s) => s.method !== 'GET');
+const argvOf = (seen: readonly { readonly argv: readonly string[] }[]) =>
+  seen.map((c) => c.argv.slice(1, 3));
+
+describe('create of absent', () => {
+  test('a preflight write, get-or-create, the real write, one quorum check, key never in the attributes', async () => {
+    const lines: string[] = [];
+    const fake = fakeCephDial({
+      [MON]: [
+        { kind: 'result', result: ABSENT },
+        fakeCephOk(keyring()),
+        fakeCephOk(HEALTHY_QUORUM),
+      ],
+    });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, undefined, {
+          dial: fake.dial,
+          log: (line) => lines.push(line),
+        }),
+      );
+      expect(attrs).toEqual(PRIOR);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+
+      // ⛔ The preflight (K-A4 finding 2) proves the path is writable BEFORE anything is minted —
+      //   see ceph-auth-reconcile.ts's header. Both writes land at the same path; only the second
+      //   carries the key.
+      const writes = writesOf(bao.seen);
+      expect(writes).toHaveLength(2);
+      expect(writes[0]?.path).toBe('/v1/talos-c1/data/ceph/client.k8s-rbd');
+      expect(leaksSliceOf(writes[0]?.body ?? '', KEY)).toBe(false);
+      expect(writes[1]?.path).toBe('/v1/talos-c1/data/ceph/client.k8s-rbd');
+      expect(writes[1]?.body).toContain(KEY);
+
+      expect(argvOf(fake.seen)).toEqual([
+        ['auth', 'get'],
+        ['auth', 'get-or-create'],
+        ['quorum_status', '-f'],
+      ]);
+      for (const call of fake.seen)
+        expect(leaksSliceOf(JSON.stringify(call.argv), KEY)).toBe(false);
+      // Decision 65 (LAND finding 5): the create path's own `auth get` observe also reads the
+      // keyring's unfiltered stdout — this proves the runner's log line never carries it either.
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+
+  test('a vault write refused before anything is minted leaves the mon untouched', async () => {
+    const fake = fakeCephDial({ [MON]: [{ kind: 'result', result: ABSENT }] });
+    const refused = () => ({ json: { errors: ['permission denied'] }, status: 403 });
+    await withFake(refused, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow();
+      // Only `auth get` (the observe) reached the mon — the preflight failed before get-or-create.
+      expect(argvOf(fake.seen)).toEqual([['auth', 'get']]);
+    });
+  });
+});
+
+describe('a second reconcile, caps unchanged', () => {
+  test('zero bao writes, zero quorum checks — the observe alone decides', async () => {
+    // Decision 65 (LAND finding 5): this `auth get` reads the keyring's unfiltered stdout too —
+    // prove the key never survives into attrs or the per-call log line, same as the create path.
+    const lines: string[] = [];
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, PRIOR, { dial: fake.dial, log: (line) => lines.push(line) }),
+      );
+      expect(attrs).toEqual(PRIOR);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(fake.seen).toHaveLength(1);
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+});
+
+describe('caps drift', () => {
+  test('runs exactly auth caps, never get-or-create; the fingerprint is reused, not reminted', async () => {
+    // Same decision-65 guarantee: the drifted `auth get` reply carries the key in its stdout too.
+    const lines: string[] = [];
+    const drifted: CephAuthEntityAttributes = { ...PRIOR, caps: OTHER_CAPS };
+    const fake = fakeCephDial({
+      [MON]: [fakeCephOk(keyring(OTHER_CAPS)), fakeCephOk(HEALTHY_QUORUM)],
+    });
+    await withFake(okReply, async (bao) => {
+      const attrs = await run(
+        { BAO_ADDR: bao.address },
+        reconcileCephAuthEntity(PROPS, drifted, {
+          dial: fake.dial,
+          log: (line) => lines.push(line),
+        }),
+      );
+      expect(attrs.caps).toEqual(CAPS);
+      expect(attrs.fingerprint).toBe(PRIOR.fingerprint);
+      expect(leaksSliceOf(JSON.stringify(attrs), KEY)).toBe(false);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(argvOf(fake.seen)).toEqual([
+        ['auth', 'get'],
+        ['auth', 'caps'],
+        ['quorum_status', '-f'],
+      ]);
+      expect(leaksSliceOf(lines.join('\n'), KEY)).toBe(false);
+    });
+  });
+});
+
+describe('a down anchor', () => {
+  test('every mon failing at the transport layer is an error, never "absent", and nothing is created', async () => {
+    const fake = fakeCephDial({});
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/never treated as absent/);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+    });
+  });
+});
+
+describe('never adopted', () => {
+  test('a live entity present with no prior state is refused outright, never taken over', async () => {
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/never adopted/);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+      expect(fake.seen).toHaveLength(1);
+    });
+  });
+});
+
+describe('a moved identity (K-A4 finding 1)', () => {
+  test('an entity edited in place is refused before any ssh call, never re-capped as a takeover', async () => {
+    const moved: CephAuthEntityProps = { ...PROPS, entity: 'client.k8s-other' };
+    const fake = fakeCephDial({ [MON]: [fakeCephOk(keyring())] });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(moved, PRIOR, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/identity moved/);
+      // Refused before the transport is ever touched — no `auth get`, no `auth caps`.
+      expect(fake.seen).toHaveLength(0);
+      expect(writesOf(bao.seen)).toHaveLength(0);
+    });
+  });
+
+  test('a mount change alone is the same identity move', async () => {
+    const moved: CephAuthEntityProps = { ...PROPS, mount: 'talos-c2' };
+    const fake = fakeCephDial({});
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(moved, PRIOR, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/identity moved/);
+      expect(fake.seen).toHaveLength(0);
+    });
+  });
+});
+
+describe('a degraded quorum after a write fails the row', () => {
+  test('the create is reported as failed even though the ceph write itself landed', async () => {
+    const fake = fakeCephDial({
+      [MON]: [
+        { kind: 'result', result: ABSENT },
+        fakeCephOk(keyring()),
+        fakeCephOk('{"quorum":[]}'),
+      ],
+    });
+    await withFake(okReply, async (bao) => {
+      await expect(
+        run(
+          { BAO_ADDR: bao.address },
+          reconcileCephAuthEntity(PROPS, undefined, { dial: fake.dial, log: () => {} }),
+        ),
+      ).rejects.toThrow(/degraded/);
+    });
+  });
+});

package/src/ceph/ceph-auth-reconcile.ts

@@ -0,0 +1,119 @@
+/**
+ * The observe -> ensure -> sync loop `Ceph.AuthEntity`'s reconcile runs (mon-transport doc,
+ * `Ceph.AuthEntity`). Split from auth-entity.ts so the loop itself — the part a fake-runner test
+ * actually exercises — is a plain function, the same split ceph-pool.ts and ssh-role.ts use.
+ *
+ * ⛔ NEVER ADOPTS. A live entity found present while this stack holds no attributes for it is
+ *   refused outright, `--adopt` included — the generic `refuseTakeover` (../ownership/adopt.ts)
+ *   is deliberately NOT used here, because it honours `--adopt` and this family's own design says
+ *   plainly: "Existing auth entities are recorded as observed inventory only — never adopted:
+ *   adopting one would mean reading and fingerprinting its key, and a key is only ever handled for
+ *   an entity this stack owns."
+ * ⛔ THE OBSERVE STEP READS `auth get`'S UNFILTERED STDOUT ON EVERY RECONCILE (decision 65,
+ *   2026-09-26, amending the design after LAND finding 5 — no node-side filter narrows it first).
+ *   The key that stdout carries is dropped in the same breath: `parseAuthGet` has no `key` field in
+ *   its return type at all, so there is no variable here ever holding it past that call. Only `auth
+ *   get-or-create`, run once on the create branch, yields a `key` value, and it goes straight to
+ *   OpenBao — never assigned to a variable this function returns, logs, or puts in the attributes
+ *   it hands back — `attributesOf` takes a fingerprint, never a key.
+ * ★ CAPS DRIFT NEVER RE-MINTS THE KEY. `auth caps` changes only what an entity may do; the returned
+ *   attributes reuse `output.fingerprint` unchanged.
+ * ⛔ A MOVED IDENTITY IS REFUSED HERE TOO, BELT AND SUSPENDERS WITH `planCephAuthEntity`'s
+ *   `replace`. `isResolved(news)` in auth-entity.ts's `diff` can defer to the engine's own
+ *   `update` fallback while any prop is still an Output (rename.ts's own header documents this
+ *   exact Alchemy behaviour for every other family this pattern protects) — a case in which
+ *   `planCephAuthEntity` never even runs. Reached with `output` naming a different entity/mount
+ *   than `props`, this refuses before any ssh call, the same shape of guard `guardRename`
+ *   (openbao/rename-identity.ts) runs first in every `Bao.*` reconcile.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { baoWrite } from '../openbao/bao-http.ts';
+import { sha256 } from '../openbao/digest.ts';
+import { authCapsArgv, authGetArgv, authGetOrCreateArgv } from './ceph-argv.ts';
+import { parseAuthGet, parseAuthGetOrCreate } from './ceph-auth-parse.ts';
+import {
+  type CephAuthEntityAttributes,
+  type CephAuthEntityProps,
+  attributesOf,
+  capsEqual,
+  cephDataPath,
+  identityMoved,
+} from './ceph-auth-form.ts';
+import { type CephTransportOptions, assertFreshQuorum, runCephCommand } from './ceph-transport.ts';
+
+export type CephAuthDeps = Pick<CephTransportOptions, 'dial' | 'log'>;
+
+const asError = (cause: unknown): Error =>
+  cause instanceof Error ? cause : new Error(String(cause));
+
+const runCeph = (transport: CephTransportOptions, argv: readonly string[]) =>
+  Effect.tryPromise({ catch: asError, try: () => runCephCommand(transport, argv) });
+
+const syncQuorum = (transport: CephTransportOptions) =>
+  Effect.tryPromise({ catch: asError, try: () => assertFreshQuorum(transport) });
+
+const neverAdopted = (entity: string): Error =>
+  new Error(
+    `Ceph.AuthEntity ${entity}: already exists on the mon cluster and this stack holds no state ` +
+      'for it. This family is never adopted — not even under --adopt — because taking it over ' +
+      'would mean fingerprinting a key this stack did not mint. Remove it by hand first, or bring ' +
+      'it under management through the coordinator’s own read-only inventory process.',
+  );
+
+const movedIdentity = (from: string, to: string): Error =>
+  new Error(
+    `Ceph.AuthEntity: planned as an update, but its identity moved from ${from} to ${to}. ` +
+      `Acting on ${to} now, with ${from}'s attributes, could re-cap an entity this generation ` +
+      'never minted. Nothing was sent to any mon. Run the deploy again: once entity/mount fully ' +
+      'resolve at plan time this plans as a replace instead.',
+  );
+
+export const reconcileCephAuthEntity = (
+  props: CephAuthEntityProps,
+  output: CephAuthEntityAttributes | undefined,
+  deps: CephAuthDeps,
+): Effect.Effect<CephAuthEntityAttributes, Error, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    if (identityMoved(props, output))
+      return yield* Effect.fail(movedIdentity(output?.entity ?? '', props.entity));
+
+    const transport: CephTransportOptions = { nodes: props.nodes, ...deps };
+
+    const observed = yield* runCeph(transport, authGetArgv(props.entity)).pipe(
+      Effect.map((result) => parseAuthGet(result, props.entity)),
+    );
+
+    if (observed.kind === 'absent') {
+      // ⛔ THE VAULT WRITE IS CHECKED BEFORE ANYTHING IS MINTED. LAND red team (2026-09-26),
+      //   CONFIRMED: minting first and writing second means a write refused by policy (the likely
+      //   first-deploy shape — the `data/ceph/*` write grant landing after this stack's first
+      //   run) strands a key that only ever existed in memory. The next reconcile's `auth get`
+      //   then finds the entity present, `output` is still undefined, and `neverAdopted` refuses
+      //   it — permanently, since `auth del` is refused too (D3). A placeholder write proves the
+      //   path is writable first; nothing has touched the mon if it fails, so a retry starts
+      //   clean. ⚠️ KV-v2 keeps this placeholder as a version in the secret's history (no version
+      //   is ever skipped) — harmless, since it never carries anything key-shaped, but visible to
+      //   `bao kv get -version=N` until the mount's `max_versions` rolls it off.
+      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {
+        data: { pending: true },
+      });
+      const result = yield* runCeph(transport, authGetOrCreateArgv(props.entity, props.caps));
+      const created = parseAuthGetOrCreate(result, props.entity);
+      // ⛔ THE ONE PLACE THE KEY CROSSES INTO A BAO CALL — as the HTTP request body's JSON, never
+      //   argv, never a temp file. `created.key` is not referenced again after this.
+      yield* baoWrite('POST', cephDataPath(props.mount, props.entity), {
+        data: { caps: created.caps, key: created.key },
+      });
+      yield* syncQuorum(transport);
+      return attributesOf(props, sha256(created.key), result.node);
+    }
+
+    if (output === undefined) return yield* Effect.fail(neverAdopted(props.entity));
+
+    if (capsEqual(observed.caps, props.caps)) return output;
+
+    const result = yield* runCeph(transport, authCapsArgv(props.entity, props.caps));
+    yield* syncQuorum(transport);
+    return attributesOf(props, output.fingerprint, result.node);
+  });

package/src/ceph/ceph-config-options.test.ts

@@ -0,0 +1,44 @@
+/**
+ * Structural guard on the named config-option list itself (mon-transport doc acceptance test #3):
+ * the list contains none of the lockout classes, and it starts empty (D-C1).
+ */
+import { describe, expect, test } from 'bun:test';
+import { NAMED_CONFIG_OPTIONS, isLockoutConfigOption } from './ceph-config-options.ts';
+
+describe('NAMED_CONFIG_OPTIONS', () => {
+  test('starts empty', () => {
+    expect(NAMED_CONFIG_OPTIONS.size).toBe(0);
+  });
+
+  test('contains none of the lockout classes, whatever gets added later', () => {
+    const bad = [...NAMED_CONFIG_OPTIONS].filter((name) => isLockoutConfigOption(name));
+    expect(bad).toEqual([]);
+  });
+});
+
+describe('isLockoutConfigOption', () => {
+  test.each([
+    'mon_host',
+    'public_network',
+    'cluster_network',
+    'public_addr',
+    'cluster_addr',
+    'auth_cluster_required',
+    'auth_service_required',
+    'auth_client_required',
+    'keyring',
+    'mgr_keyring',
+    'keyring_path',
+    'key',
+    'mon_data_key',
+  ])('flags %s', (name) => {
+    expect(isLockoutConfigOption(name)).toBe(true);
+  });
+
+  test.each(['mon_allow_pool_delete', 'osd_pool_default_size', 'mon_max_pg_per_osd'])(
+    'does not flag an ordinary tuning option like %s',
+    (name) => {
+      expect(isLockoutConfigOption(name)).toBe(false);
+    },
+  );
+});

package/src/ceph/ceph-config-options.ts

@@ -0,0 +1,36 @@
+/**
+ * The named Ceph config-option list — the only options `ceph config get/set/rm` may ever touch
+ * through the mon-command transport (ceph-argv.ts's `configProblem`). Design:
+ * docs/plans/2026-09-26-ceph-config-options.md, D-C1.
+ *
+ * ⛔ THE LIST STARTS EMPTY, AND EACH ADDITION IS ITS OWN REVIEWED PR LINE. Nothing in K-A4 adds to
+ *   it — `CephConfigOption` (K-D) is a separate, later family; this file exists now only so the
+ *   transport's allowlist has something to bound `config` against from day one, per the accepted
+ *   design ("config get/set for the named option list which starts EMPTY").
+ * ⛔ NEVER ADD ONE OF THE LOCKOUT CLASSES BELOW. `mon_host`, `public_network`, `cluster_network`,
+ *   `public_addr`, `cluster_addr`, every `auth_*_required` and every `key`/`keyring`-bearing
+ *   option re-address the mons or de-authenticate the whole cluster — cutting every VM disk — and
+ *   `isLockoutConfigOption` is a structural guard a test runs against this file's own list, not a
+ *   suggestion for the reviewer of the next PR line.
+ * ⛔ NEVER ADD A SECRET-VALUED OPTION. mgr module options can hold passwords (REASONED — no live
+ *   cluster to measure this against yet); a secret-bearing setting belongs in a vault-backed flow,
+ *   never a `ceph config set` argv, which lands in the runner's log and the node's sudo journal.
+ */
+
+/** Starts empty. Add one reviewed option name per PR line, never a batch. */
+export const NAMED_CONFIG_OPTIONS: ReadonlySet<string> = new Set([]);
+
+const LOCKOUT_EXACT: ReadonlySet<string> = new Set([
+  'mon_host',
+  'public_network',
+  'cluster_network',
+  'public_addr',
+  'cluster_addr',
+]);
+
+/** `auth_*_required` (cephx enforcement) and anything key/keyring-shaped, either side of `_`. */
+const LOCKOUT_PATTERN = /^auth_\w*_required$|(^|_)key(ring)?($|_)/;
+
+/** Whether `name` is a class this transport must never read a value for, adopt, or write. */
+export const isLockoutConfigOption = (name: string): boolean =>
+  LOCKOUT_EXACT.has(name) || LOCKOUT_PATTERN.test(name);

package/src/ceph/ceph-key-leak-assert.ts

@@ -0,0 +1,35 @@
+/**
+ * Shared by the two test files that prove `Ceph.AuthEntity` never leaks a minted key through a
+ * parse-error message: ceph-auth-parse.test.ts (direct parser calls) and
+ * ceph-auth-reconcile-secrecy.test.ts (through the full reconcile loop). Split out so the leak
+ * check and the malformed-stdout fixtures are identical in both places — the property being
+ * proved (decision 65) is the same one, and two hand-copied versions are exactly the kind of thing
+ * that quietly drifts apart.
+ *
+ * ⛔ TEST-ONLY. Nothing in `src/` imports this outside a `.test.ts` file.
+ * ★ NO HYPHEN IN THE SENTINEL. LAND red team (2026-09-26), CONFIRMED: a JSON lexer's "unexpected
+ *   identifier" error for a bare (unquoted) token stops at the first character outside
+ *   `[A-Za-z0-9_$]`, so a hyphenated sentinel (`sentinel-ceph-key-...`) truncates to its first
+ *   word — `.not.toContain(SENTINEL)` on the FULL string then never fires even when that first
+ *   word leaked. Cephx keys are base64 (`[A-Za-z0-9+/=]`, no hyphen), so this sentinel is shaped
+ *   the same way, and every check here compares 8-character slices, not full-string containment.
+ */
+
+/** A cephx-shaped sentinel: looks like a real minted key, no hyphen anywhere to truncate on. */
+export const KEY_SHAPED_SENTINEL = 'AQDsentinelKEYsentinelKEY0123456789abcd==';
+
+/** True if any 8-character window of `key` shows up anywhere in `message`. */
+export const leaksSliceOf = (message: string, key: string = KEY_SHAPED_SENTINEL): boolean => {
+  for (let start = 0; start + 8 <= key.length; start += 1) {
+    if (message.includes(key.slice(start, start + 8))) return true;
+  }
+  return false;
+};
+
+/** `auth get`/`auth get-or-create` stdout with the key left as a bare (unquoted) JSON token. */
+export const unquotedKeyStdout = (entity: string, key: string = KEY_SHAPED_SENTINEL): string =>
+  `[{"entity":"${entity}","key":${key}}]`;
+
+/** The same shape with a trailing comma after the entry — a different malformed-JSON path. */
+export const trailingCommaKeyStdout = (entity: string, key: string = KEY_SHAPED_SENTINEL): string =>
+  `[{"entity":"${entity}","key":"${key}"},]`;

package/src/ceph/ceph-no-output-logging.test.ts

@@ -0,0 +1,52 @@
+/**
+ * The design doc's own Risks section (docs/plans/2026-09-26-ceph-mon-transport.md) says this
+ * family "gets a structural test over its own source (no output-logging)". LAND red team
+ * (2026-09-26): no such test existed — the fake-runner tests proved the key never reaches a log
+ * line for the SHAPES they happened to exercise, but nothing proved a future call site could not
+ * add a new one that does. This is that test, the same grep-gate shape
+ * `talos/secrets-gate.test.ts` runs for PEM/bootstrap-token material.
+ *
+ * ★ A POSITIVE CONTROL WOULD DEFEAT THE PURPOSE HERE, same as secrets-gate.test.ts: there is no
+ *   "real" case where a hit should be found, so this only has a negative case.
+ * ⚠️ THIS IS A TEXT SCAN, NOT A TYPE CHECKER. It cannot prove no code path ever COULD log output —
+ *   only that today's source doesn't. ceph-transport.ts's own header comment carries the actual
+ *   invariant ("ONLY ARGV IS EVER LOGGED"); this test is the regression guard for it.
+ */
+import { describe, expect, test } from 'bun:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const CEPH_DIR = import.meta.dir;
+
+/** This family's own production source — never a test file, never the fake dial's test double. */
+const productionFiles = () =>
+  readdirSync(CEPH_DIR)
+    .filter(
+      (name) => name.endsWith('.ts') && !name.includes('.test.') && name !== 'fake-ceph-dial.ts',
+    )
+    .map((name) => join(CEPH_DIR, name));
+
+describe('no output-logging — structural test over this family’s own source', () => {
+  test('no console.* call anywhere — logging goes only through the injected `log` sink', () => {
+    for (const file of productionFiles()) {
+      const text = readFileSync(file, 'utf8');
+      expect(text).not.toMatch(/\bconsole\.\w+\(/);
+    }
+  });
+
+  test('every call to the injected `log` sink logs the attempted argv line only, never stdout/stderr/a key', () => {
+    let sawACall = false;
+    for (const file of productionFiles()) {
+      for (const line of readFileSync(file, 'utf8').split('\n')) {
+        if (!/\blog\(/.test(line)) continue;
+        sawACall = true;
+        expect(line).not.toMatch(/\.stdout\b/);
+        expect(line).not.toMatch(/\.stderr\b/);
+        expect(line).not.toMatch(/\bkey\b/i);
+      }
+    }
+    // ⛔ A GUARD AGAINST THE GUARD GOING QUIET. If this ever finds zero call sites (the log call
+    //   renamed, the file moved), the two checks above would trivially pass having proven nothing.
+    expect(sawACall).toBe(true);
+  });
+});