@homeflare/alchemy 0.8.0 → 0.10.0

package/src/openbao/auth-method.ts

@@ -19,6 +19,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoAuthMethodAttributes,
   type BaoAuthMethodProps,
@@ -54,12 +57,17 @@ export const BaoAuthMethodProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readMethod(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readMethod(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         diff: Effect.fn(function* ({ news, output }) {
-          if (output === undefined || !isResolved(news)) return undefined;
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
+          if (output === undefined) return undefined;
+          if (!isResolved(news)) return undefined;
           /**
            * ⛔ A CHANGED PATH FAILS HERE unless `remountFrom` names the old one — the same trap
            *   Bao.Mount had: reading the new path finds nothing, plans `update`, and enables an
@@ -81,8 +89,9 @@ export const BaoAuthMethodProvider = () =>
         }),
 
         /** The body, and the move, live in auth-method-reconcile.ts. */
-        reconcile: Effect.fn(function* ({ news, output }) {
-          return yield* reconcileAuthMethod(news, output?.path);
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
+          const claim = claimFor({ fqn, instanceId, output });
+          return yield* reconcileAuthMethod(news, output?.path, undefined, claim);
         }),
 
         /**
@@ -94,5 +103,5 @@ export const BaoAuthMethodProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/auth-role.ts

@@ -14,6 +14,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoAuthRoleAttributes,
   type BaoAuthRoleProps,
@@ -66,8 +69,11 @@ export const BaoAuthRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          return yield* readRole(olds);
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          const found = yield* readRole(olds);
+          const ours = Effect.sync(() => found !== undefined && matches(found, olds));
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -87,6 +93,7 @@ export const BaoAuthRoleProvider = () =>
            *   opt into `RemovalPolicy.destroy()` or destroy the old role's accessors by hand.
            */
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -96,10 +103,13 @@ export const BaoAuthRoleProvider = () =>
           return { action: 'update' } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a rename the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
           const live = yield* readRole(news);
+          const path = readPath(news.name);
+          if (live !== undefined)
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.AuthRole ${path}`);
           if (live === undefined || !matches(live, news)) {
             yield* baoWrite('PUT', readPath(news.name), writeBody(news));
           }
@@ -130,5 +140,5 @@ export const BaoAuthRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/cloudflare-role.ts

@@ -21,6 +21,9 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { refuseTakeover } from '../ownership/adopt.ts';
+import { ownedRead } from '../ownership/probe.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { groupKey, scopeOfResource } from './cloudflare-group-scope.ts';
 import { CloudflarePermissionGroups, type GroupRef } from './cloudflare-permission-groups.ts';
 import { resolvePolicies } from './cloudflare-policy.ts';
@@ -106,9 +109,15 @@ export const BaoCloudflareRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
           const live = yield* readCloudflareRole(olds.mount, olds.name);
-          return live === undefined ? undefined : attributesOf(olds, live);
+          const found = live === undefined ? undefined : attributesOf(olds, live);
+          const ours = Effect.gen(function* () {
+            if (live === undefined || refusalOf(olds) !== undefined) return false;
+            return differences(olds, yield* resolved(olds), live).length === 0;
+          });
+          return yield* ownedRead({ fqn, instanceId, output }, found, ours);
         }),
 
         /**
@@ -129,6 +138,7 @@ export const BaoCloudflareRoleProvider = () =>
          */
         diff: Effect.fn(function* ({ news, olds, output }) {
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -145,7 +155,7 @@ export const BaoCloudflareRoleProvider = () =>
             : ({ action: 'update' } as const);
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           const path = rolePath(news.mount, news.name);
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
@@ -155,6 +165,9 @@ export const BaoCloudflareRoleProvider = () =>
           }
           const policies = yield* resolved(news);
           const live = yield* readCloudflareRole(news.mount, news.name);
+          if (live !== undefined) {
+            yield* refuseTakeover({ fqn, instanceId, output }, `Bao.CloudflareRole ${path}`);
+          }
           /**
            * ⛔ ADOPTING A ROLE THAT ALREADY MATCHES MUST NOT REWRITE IT. Alchemy's `adopted` action
            *   routes through reconcile (policy.ts has the Apply.ts reading), so without this guard
@@ -199,5 +212,5 @@ export const BaoCloudflareRoleProvider = () =>
           return undefined;
         }),
       });
-    }),
+    }).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/fake-bao.ts

@@ -82,3 +82,55 @@ export const runFailure = <A, E>(
   env: BaoEnvironment,
   effect: Effect.Effect<A, E, HttpClient.HttpClient>,
 ) => Effect.runPromise(provided(env, Effect.flip(effect)));
+
+/**
+ * An injected crash between a write and its commit. Once armed, `crashNext()` fails the first read
+ * that follows a write with a 500 — a reconcile whose write landed and whose read-back, and so the
+ * engine's commit, never did — and `crashNext('write')` lands the next write and then answers it
+ * 500, for a reconcile that reads nothing back (Bao.Policy). Either leaves the `creating` /
+ * `replacing` row a killed deploy leaves.
+ */
+export const crashAfterWrite = () => {
+  let armed: 'read-back' | 'write' | undefined;
+  let wrote = false;
+  const CRASH: Reply = { json: { errors: ['injected: the deploy died here'] }, status: 500 };
+  return {
+    crashNext: (at: 'read-back' | 'write' = 'read-back') => {
+      armed = at;
+      wrote = false;
+    },
+    wrap:
+      (answer: (seen: Seen) => Reply) =>
+      (seen: Seen): Reply => {
+        if (armed === 'write' && seen.method !== 'GET') {
+          armed = undefined;
+          answer(seen);
+          return CRASH;
+        }
+        if (armed !== undefined && seen.method !== 'GET') wrote = true;
+        if (armed !== undefined && wrote && seen.method === 'GET') {
+          armed = undefined;
+          return CRASH;
+        }
+        return answer(seen);
+      },
+  };
+};
+
+/**
+ * A deploy killed BEFORE a resource's reconcile ran: the first write to a path ending in `suffix` is
+ * refused (500) without landing. Aimed at an upstream, it fails every create waiting on it after
+ * Apply has committed their `creating` rows — rows whose create never asked whose object sat at
+ * its identity (ownership/whole.ts).
+ */
+export const refuseWriteOnce = (suffix: string) => {
+  let armed = true;
+  return (answer: (seen: Seen) => Reply) =>
+    (seen: Seen): Reply => {
+      if (armed && seen.method !== 'GET' && seen.path.endsWith(suffix)) {
+        armed = false;
+        return { json: { errors: ['injected: the upstream was refused'] }, status: 500 };
+      }
+      return answer(seen);
+    };
+};

package/src/openbao/fake-core.ts

@@ -0,0 +1,141 @@
+/**
+ * The five families fake-families.ts does not cover — Bao.Policy, Bao.CloudflareRole,
+ * Bao.ProxmoxRole, Bao.Mount and Bao.AuthMethod — as rows of one table over one routed fake, so the
+ * ownership tests (adopt-core.test.ts) drive each through Alchemy's own plan and apply. Each row
+ * declares one object whose identity is fixed; `knob` is a duration-like prop that is NOT its
+ * identity, so an Output can stand in for it and a second owner can change it.
+ *
+ * ⛔ TEST-ONLY. Every value is a placeholder, not the estate's.
+ */
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import type * as Output from 'alchemy/Output';
+import { BaoAuthMethod, BaoAuthMethodProvider } from './auth-method.ts';
+import { BaoAuthRoleProvider } from './auth-role.ts';
+import { groupKey } from './cloudflare-group-scope.ts';
+import { CloudflarePermissionGroups } from './cloudflare-permission-groups.ts';
+import { BaoCloudflareRole, BaoCloudflareRoleProvider } from './cloudflare-role.ts';
+import type { Reply, Seen } from './fake-bao.ts';
+import { aclPolicies, cloudflareRoles, fakePolicyProviders, proxmoxRoles } from './fake-engines.ts';
+import { wireRoles } from './fake-engines-roles.ts';
+import { liveTable } from './fake-mounts.ts';
+import { type FakeStack, type StackBody, fakeStack, withFakeStack } from './fake-stack.ts';
+import { BaoMount, BaoMountProvider } from './mount.ts';
+import { BaoPolicy } from './policy.ts';
+import { BaoProxmoxRole, BaoProxmoxRoleProvider } from './proxmox-role.ts';
+
+/** Every group resolves, to an id named after it — these tests are about ownership, not groups. */
+const groups = Layer.succeed(CloudflarePermissionGroups, {
+  resolve: (_mount, refs) =>
+    Effect.succeed(new Map(refs.map((ref) => [groupKey(ref.name, ref.scope), `id-${ref.name}`]))),
+});
+
+export const coreProviders = Layer.mergeAll(
+  fakePolicyProviders,
+  BaoCloudflareRoleProvider().pipe(Layer.provide(groups)),
+  BaoProxmoxRoleProvider(),
+  BaoMountProvider(),
+  BaoAuthMethodProvider(),
+  // ★ For `upstream`: an AppRole whose `tokenTtl` is the Output a knob is fed.
+  BaoAuthRoleProvider(),
+  FetchHttpClient.layer,
+);
+
+/** Every store behind one answer, routed by path. */
+export const coreEstate = () => {
+  const stores = {
+    auth: liveTable('sys/auth', {}),
+    cloudflare: cloudflareRoles(),
+    mounts: liveTable('sys/mounts', {}),
+    policies: aclPolicies(),
+    proxmox: proxmoxRoles(),
+    roles: wireRoles(),
+  };
+  const answer = (seen: Seen): Reply => {
+    const path = seen.path.replace(/^\/v1\//, '');
+    if (path.startsWith('sys/policies/acl/')) return stores.policies(seen);
+    if (path.startsWith('sys/auth')) return stores.auth.answer(seen);
+    if (path.startsWith('sys/mounts') || path.startsWith('sys/remount')) {
+      return stores.mounts.answer(seen);
+    }
+    if (path.startsWith('cloudflare-acme-dns/')) return stores.cloudflare(seen);
+    if (path.startsWith('proxmox-lab/')) return stores.proxmox(seen);
+    return stores.roles(seen);
+  };
+  return Object.assign(answer, stores);
+};
+
+export type CoreEstate = ReturnType<typeof coreEstate>;
+
+type Text = string | Output.Output<string>;
+
+export interface CoreRow {
+  readonly family: string;
+  /** One resource, logical id `id`, at the row's fixed identity. */
+  readonly declare: (id: string, knob: Text) => StackBody;
+  /** Whether the fake holds the object. */
+  readonly has: (estate: CoreEstate) => boolean;
+}
+
+export const CORE: readonly CoreRow[] = [
+  {
+    // ★ The fragments directory IS the content (fake-engines.ts), so a knob changes the policy.
+    declare: (id, knob) => BaoPolicy(id, { fragments: knob, name: 'app' }),
+    family: 'Bao.Policy',
+    has: (estate) => estate.policies.live.has('sys/policies/acl/app'),
+  },
+  {
+    declare: (id, knob) =>
+      BaoCloudflareRole(id, {
+        description: 'Read DNS records on one zone. (zone: example.com)',
+        maxTtl: '1h',
+        mount: 'cloudflare-acme-dns',
+        name: 'dns-read',
+        policies: [
+          {
+            effect: 'allow',
+            groupOrder: 'declared',
+            groups: ['DNS Read'],
+            resource: 'com.cloudflare.api.account.zone.z1',
+          },
+        ],
+        ttl: knob,
+      }),
+    family: 'Bao.CloudflareRole',
+    has: (estate) => estate.cloudflare.live.has('cloudflare-acme-dns/roles/dns-read'),
+  },
+  {
+    declare: (id, knob) =>
+      BaoProxmoxRole(id, {
+        maxTtl: '6h',
+        mintUser: 'reader@pve',
+        mount: 'proxmox-lab',
+        name: 'read',
+        ttl: knob,
+      }),
+    family: 'Bao.ProxmoxRole',
+    has: (estate) => estate.proxmox.live.has('proxmox-lab/roles/read'),
+  },
+  {
+    declare: (id, knob) => BaoMount(id, { defaultLeaseTtl: knob, path: 'kv', type: 'kv' }),
+    family: 'Bao.Mount',
+    has: (estate) => estate.mounts.table.has('kv/'),
+  },
+  {
+    declare: (id, knob) => BaoAuthMethod(id, { defaultLeaseTtl: knob, path: 'jwt', type: 'jwt' }),
+    family: 'Bao.AuthMethod',
+    has: (estate) => estate.auth.table.has('jwt/'),
+  },
+];
+
+/** One stack over a fresh core estate, plus `owner`: a second stack over the same fake. */
+export const withCore = (
+  body: (stack: FakeStack, estate: CoreEstate, seen: Seen[], owner: FakeStack) => Promise<void>,
+  answer: (estate: CoreEstate) => (seen: Seen) => Reply = (estate) => estate,
+): Promise<void> => {
+  const estate = coreEstate();
+  return withFakeStack(coreProviders, answer(estate), (stack, bao) =>
+    body(stack, estate, bao.seen, fakeStack(coreProviders, { BAO_ADDR: bao.address }, 'Owner')),
+  );
+};

package/src/openbao/fake-families.ts

@@ -13,9 +13,9 @@ import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
 import { BaoAuthRole, BaoAuthRoleProvider } from './auth-role.ts';
-import type { Seen } from './fake-bao.ts';
+import type { Reply, Seen } from './fake-bao.ts';
 import { type Estate, fakeEstate } from './fake-engines-roles.ts';
-import { type FakeStack, type StackBody, withFakeStack } from './fake-stack.ts';
+import { type FakeStack, type StackBody, fakeStack, withFakeStack } from './fake-stack.ts';
 import { BaoJwtAuthConfig, BaoJwtAuthConfigProvider } from './jwt-config.ts';
 import { BaoJwtRole, BaoJwtRoleProvider } from './jwt-role.ts';
 import { BaoKubernetesRole, BaoKubernetesRoleProvider } from './kubernetes-role.ts';
@@ -38,12 +38,18 @@ export const familyProviders = Layer.mergeAll(
   FetchHttpClient.layer,
 );
 
-/** One stack over a fresh estate: every family's provider, and every call the fake saw. */
+/**
+ * One stack over a fresh estate: every family's provider, and every call the fake saw — plus
+ * `owner`, a SECOND stack over the same fake with its own state: another owner of the same names.
+ */
 export const withEstate = (
-  body: (stack: FakeStack, estate: Estate, seen: Seen[]) => Promise<void>,
+  body: (stack: FakeStack, estate: Estate, seen: Seen[], owner: FakeStack) => Promise<void>,
+  answer: (estate: Estate) => (seen: Seen) => Reply = (estate) => estate,
 ): Promise<void> => {
   const estate = fakeEstate();
-  return withFakeStack(familyProviders, estate, (stack, bao) => body(stack, estate, bao.seen));
+  return withFakeStack(familyProviders, answer(estate), (stack, bao) =>
+    body(stack, estate, bao.seen, fakeStack(familyProviders, { BAO_ADDR: bao.address }, 'Owner')),
+  );
 };
 
 /** The row for one family, by name. */

package/src/openbao/fake-mounts.ts

@@ -0,0 +1,74 @@
+/**
+ * A fake mount table for fake-bao — `sys/mounts` (secrets engines) or `sys/auth` (auth methods):
+ * enable, tune, read, the listing a 400 is settled against (mount-wire.ts), and `sys/remount`.
+ * Split out of mount-move.test.ts so the engine-level ownership tests drive Bao.Mount and
+ * Bao.AuthMethod through the same table.
+ *
+ * ⛔ TEST-ONLY — see fake-bao.ts. No provider imports this file.
+ */
+import type { Reply, Seen } from './fake-bao.ts';
+
+type Entry = { type: string; description: string; config: Record<string, unknown> };
+
+/** A fresh mount's lease TTLs: 0, "use the system default", as the server reports them. */
+const zero = () => ({ default_lease_ttl: 0, max_lease_ttl: 0 });
+
+/** The table keyed `<path>/` as the server keys it; `initial` maps a bare path to its type. */
+export const liveTable = (prefix: string, initial: Record<string, string>) => {
+  const entries = new Map<string, Entry>(
+    Object.entries(initial).map(([path, type]) => [
+      `${path}/`,
+      { config: zero(), description: '', type },
+    ]),
+  );
+  const types = () => new Map([...entries].map(([path, entry]) => [path, entry.type]));
+  const answer = (seen: Seen): Reply => {
+    const path = seen.path.replace(/^\/v1\//, '');
+    if (path === 'sys/remount' && seen.method === 'POST') {
+      const { from, to } = JSON.parse(seen.body) as { from: string; to: string };
+      const key = `${from.replace(/^auth\//, '')}/`;
+      const entry = entries.get(key);
+      if (entry === undefined) return { json: { errors: ['no matching mount'] }, status: 400 };
+      entries.delete(key);
+      entries.set(`${to.replace(/^auth\//, '')}/`, entry);
+      return { json: { data: { migration_id: 'm-1' } }, status: 200 };
+    }
+    if (path.startsWith('sys/remount/status/')) {
+      return { json: { data: { migration_info: { status: 'success' } } }, status: 200 };
+    }
+    if (path === prefix) return { json: { data: Object.fromEntries(types()) }, status: 200 };
+    const tune = path.endsWith('/tune');
+    const key = `${path.slice(prefix.length + 1).replace(/\/tune$/, '')}/`;
+    if (seen.method === 'POST') {
+      const body = JSON.parse(seen.body || '{}') as Record<string, unknown>;
+      const entry = entries.get(key) ?? {
+        config: zero(),
+        description: '',
+        type: 'enabled-by-test',
+      };
+      if (!tune && typeof body['type'] === 'string') entry.type = body['type'];
+      if (tune) {
+        const { description, ...config } = body;
+        if (typeof description === 'string') entry.description = description;
+        entry.config = { ...entry.config, ...config };
+      }
+      entries.set(key, entry);
+      return { status: 204 };
+    }
+    if (seen.method === 'DELETE') {
+      entries.delete(key);
+      return { status: 204 };
+    }
+    const entry = entries.get(key);
+    return entry === undefined
+      ? { json: { errors: [`No secret engine mount at ${key}`] }, status: 400 }
+      : { json: { data: entry }, status: 200 };
+  };
+  return {
+    answer,
+    /** The live table as `<path>/` → type, the shape the move tests compare. */
+    get table() {
+      return types();
+    },
+  };
+};

package/src/openbao/fake-stack.ts

@@ -16,6 +16,8 @@
  *   in the shell running the tests is never read. No provider imports this file.
  */
 import * as Alchemy from 'alchemy';
+import { AdoptPolicy } from 'alchemy/AdoptPolicy';
+import { provideFreshArtifactStore } from 'alchemy/Artifacts';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import type { BaoEnvironment } from './bao-address.ts';
@@ -28,9 +30,12 @@ export type Planned = Readonly<Record<string, string>>;
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
 export type StackBody = Effect.Effect<unknown, unknown, unknown>;
 
+/** What the CLI would set for one deploy: `adopt` is `--adopt` (the AdoptPolicy service). */
+export type DeployOptions = { readonly adopt?: boolean };
+
 export interface FakeStack {
   /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
-  readonly deploy: (body: StackBody) => Promise<Planned>;
+  readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
 }
 
 type Node = { readonly action: string };
@@ -72,22 +77,30 @@ export const fakeStack = <ROut, E, RIn>(
   ) => Effect.Effect<PlanView, unknown, never>;
   const apply = Alchemy.apply as unknown as (planned: PlanView) => Effect.Effect<unknown, unknown>;
 
-  const deploy = (body: StackBody) =>
+  /**
+   * ★ ONE ARTIFACT STORE ACROSS PLAN AND APPLY, as Deploy.ts's evalStack provides — the channel a
+   *   diff uses to tell reconcile it resumes an interrupted create (ownership/resume.ts).
+   * ★ `--adopt` reaches registration, plan and apply alike, as the Alchemist session provides it.
+   */
+  const deploy = (body: StackBody, options: DeployOptions = {}) =>
     Effect.gen(function* () {
       const compiled = yield* stack(name, { providers, state }, body);
       return yield* Effect.gen(function* () {
         const planned = yield* plan(compiled);
         yield* apply(planned);
         return actionsOf(planned);
-      }).pipe(Effect.provide(Layer.succeedContext(compiled.services)));
+      }).pipe(provideFreshArtifactStore, Effect.provide(Layer.succeedContext(compiled.services)));
     }).pipe(
+      options.adopt === undefined ? (e) => e : Effect.provideService(AdoptPolicy, options.adopt),
       Effect.provideService(Alchemy.Stage, 'test'),
       Effect.provideService(BaoEnv, env),
       Effect.provide(state),
       Effect.scoped,
     );
 
-  return { deploy: (body) => Effect.runPromise(deploy(body) as Effect.Effect<Planned>) };
+  return {
+    deploy: (body, options) => Effect.runPromise(deploy(body, options) as Effect.Effect<Planned>),
+  };
 };
 
 /**

package/src/openbao/jwt-config.ts

@@ -21,6 +21,8 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import {
   type BaoJwtAuthConfigAttributes,
   type BaoJwtAuthConfigProps,
@@ -33,7 +35,7 @@ import {
 } from './jwt-config-form.ts';
 import { declaredOr } from './rename.ts';
 import { type Identity, guardRename, judgeRename } from './rename-identity.ts';
-import { type RoleSpec, planRole, readRoleAt, reconcileRole } from './role-reconcile.ts';
+import { type RoleSpec, planRole, readOwnedRole, reconcileRole } from './role-reconcile.ts';
 
 export type { BaoJwtAuthConfigAttributes, BaoJwtAuthConfigProps } from './jwt-config-form.ts';
 
@@ -78,14 +80,15 @@ export const BaoJwtAuthConfigProvider = () =>
       BaoJwtAuthConfig.Provider.of({
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          const found = yield* readRoleAt(jwtConfigSpec(olds));
-          return found?.attributes;
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          return yield* readOwnedRole({ fqn, instanceId, output }, jwtConfigSpec(olds));
         }),
 
         diff: Effect.fn(function* ({ news, olds, output }) {
           // ⛔ The mount first, before isResolved; onto a mount with a config fails the plan.
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
@@ -93,14 +96,14 @@ export const BaoJwtAuthConfigProvider = () =>
         }),
 
         /** ⛔ Refuses, before writing, a live config that carries an OIDC client (wouldErase). */
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
-          return yield* reconcileRole(jwtConfigSpec(news));
+          return yield* reconcileRole(jwtConfigSpec(news), claimFor({ fqn, instanceId, output }));
         }),
 
         /** ⚠️ Writes nothing — there is no delete endpoint (header). */
         delete: () => Effect.void,
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );

package/src/openbao/jwt-role.ts

@@ -23,6 +23,8 @@ import { isResolved } from 'alchemy/Diff';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { claimFor } from '../ownership/adopt.ts';
+import { provingResumes } from '../ownership/resume.ts';
 import { baoDelete } from './bao-http.ts';
 import {
   type BaoJwtRoleAttributes,
@@ -34,7 +36,7 @@ import {
   writeBody,
 } from './jwt-role-form.ts';
 import { foldName, guardRename, judgeRename, roleIdentity } from './rename-identity.ts';
-import { type RoleSpec, planRole, readRoleAt, reconcileRole } from './role-reconcile.ts';
+import { type RoleSpec, planRole, readOwnedRole, reconcileRole } from './role-reconcile.ts';
 
 export type {
   BaoJwtCallbackMode,
@@ -87,25 +89,26 @@ export const BaoJwtRoleProvider = () =>
          */
         list: () => Effect.succeed([]),
 
-        read: Effect.fn(function* ({ olds }) {
-          const found = yield* readRoleAt(jwtRoleSpec(olds));
-          return found?.attributes;
+        /** ⛔ Stateless: `Unowned` unless our own interrupted create made it (ownership/probe.ts). */
+        read: Effect.fn(function* ({ fqn, instanceId, olds, output }) {
+          return yield* readOwnedRole({ fqn, instanceId, output }, jwtRoleSpec(olds));
         }),
 
         /** ⛔ IT COMPARES THE LIVE ROLE, NOT THE STORED DIGEST — a hand-widened audience is drift. */
         diff: Effect.fn(function* ({ news, olds, output }) {
           // ⛔ The identity first, before isResolved; onto a role that exists fails the plan.
           const move = yield* judgeRename(IDENTITY, olds, news, output);
+          // ★ No attributes: an unfinished generation, proven ours or not by provingResumes.
           if (output === undefined) return undefined;
           if (move !== undefined) return { action: 'replace' } as const;
           if (!isResolved(news)) return undefined;
           return { action: yield* planRole(jwtRoleSpec(news)) } as const;
         }),
 
-        reconcile: Effect.fn(function* ({ news, output }) {
+        reconcile: Effect.fn(function* ({ fqn, instanceId, news, output }) {
           // ⛔ An `update` across a move the diff could not see — refused before any write.
           yield* guardRename(IDENTITY, news, output);
-          return yield* reconcileRole(jwtRoleSpec(news));
+          return yield* reconcileRole(jwtRoleSpec(news), claimFor({ fqn, instanceId, output }));
         }),
 
         /** Idempotent as Alchemy requires — a missing role deletes as success. */
@@ -114,5 +117,5 @@ export const BaoJwtRoleProvider = () =>
           return undefined;
         }),
       }),
-    ),
+    ).pipe(Effect.map(provingResumes)),
   );