@serfab/cadre-host 0.9.0 → 0.11.0

package/src/__tests__/host-owner.smoke.test.ts

@@ -1,123 +1,123 @@
-/**
- * Server-level smoke: the /auth/* HTTP contract over the owner-node
- * channel adapter. Validates the two behaviours the realignment must
- * preserve:
- *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
- *   2. With the node refusing connections, GET /auth/trust-circle still lists
- *      local labels, and POST /auth/invites returns 503 (not a raw 500).
- *
- * The owner node is represented by a stub HTTP server matching the 6.6
- * admin contract (the spawn path itself is covered by
- * orchestrator-owner.test.ts).
- */
-
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import Fastify from 'fastify';
-import http from 'node:http';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
-import { OwnerNodeClient } from '../owner/index.js';
-import { registerErrorHandler } from '../server/error-handler.js';
-import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
-import { EventBus } from '../server/events/bus.js';
-
-const TOKEN = 'tok';
-
-let tmpRoot: string;
-beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
-afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
-
-function buildApp(service: TrustCircleService) {
-  const app = Fastify();
-  registerErrorHandler(app);
-  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
-  return app;
-}
-
-describe('host /auth delegation — node up', () => {
-  let server: http.Server;
-  let baseUrl: string;
-
-  beforeEach(async () => {
-    server = http.createServer((req, res) => {
-      const chunks: Buffer[] = [];
-      req.on('data', (c) => chunks.push(c as Buffer));
-      req.on('end', () => {
-        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
-          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
-        }
-        if (req.url === '/admin/invites' && req.method === 'POST') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
-          return;
-        }
-        if (req.url === '/admin/members' && req.method === 'GET') {
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
-          return;
-        }
-        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
-      });
-    });
-    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
-    const a = server.address();
-    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
-  });
-
-  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
-
-  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
-    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
-    const app = buildApp(service);
-    try {
-      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
-      expect(res.statusCode).toBe(200);
-      const body = res.json() as { encodedInvite: string };
-      expect(body.encodedInvite).toBe('ENC');
-    } finally {
-      await app.close();
-    }
-  });
-});
-
-describe('host /auth delegation — node refusing connections', () => {
-  let closedBaseUrl: string;
-
-  beforeEach(async () => {
-    const tmp = http.createServer();
-    const port = await new Promise<number>((resolve) => {
-      tmp.listen(0, '127.0.0.1', () => {
-        const a = tmp.address();
-        resolve(typeof a === 'object' && a ? a.port : 0);
-      });
-    });
-    await new Promise<void>((resolve) => tmp.close(() => resolve()));
-    closedBaseUrl = `http://127.0.0.1:${port}`;
-  });
-
-  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
-    const store = new TrustCircleStore(tmpRoot);
-    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
-
-    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
-    const service = new TrustCircleService({ cadreNode: client, store });
-    const app = buildApp(service);
-    try {
-      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
-      expect(list.statusCode).toBe(200);
-      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
-      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
-
-      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
-      expect(invite.statusCode).toBe(503);
-      const body = invite.json() as { error: { code: string } };
-      expect(body.error.code).toBe('node_unavailable');
-    } finally {
-      await app.close();
-    }
-  });
-});
+/**
+ * Server-level smoke: the /auth/* HTTP contract over the owner-node
+ * channel adapter. Validates the two behaviours the realignment must
+ * preserve:
+ *   1. With the node up, POST /auth/invites returns an encodedInvite (no 500).
+ *   2. With the node refusing connections, GET /auth/trust-circle still lists
+ *      local labels, and POST /auth/invites returns 503 (not a raw 500).
+ *
+ * The owner node is represented by a stub HTTP server matching the 6.6
+ * admin contract (the spawn path itself is covered by
+ * orchestrator-owner.test.ts).
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import Fastify from 'fastify';
+import http from 'node:http';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { TrustCircleService, TrustCircleStore, createTrustCircleHandlers } from '../auth/index.js';
+import { OwnerNodeClient } from '../owner/index.js';
+import { registerErrorHandler } from '../server/error-handler.js';
+import { registerTrustCircleRoutes } from '../server/routes/trust-circle.js';
+import { EventBus } from '../server/events/bus.js';
+
+const TOKEN = 'tok';
+
+let tmpRoot: string;
+beforeEach(() => { tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-smoke-')); });
+afterEach(() => { try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ } });
+
+function buildApp(service: TrustCircleService) {
+  const app = Fastify();
+  registerErrorHandler(app);
+  registerTrustCircleRoutes(app, { handlers: createTrustCircleHandlers(service), events: new EventBus() });
+  return app;
+}
+
+describe('host /auth delegation — node up', () => {
+  let server: http.Server;
+  let baseUrl: string;
+
+  beforeEach(async () => {
+    server = http.createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on('data', (c) => chunks.push(c as Buffer));
+      req.on('end', () => {
+        if (req.headers['authorization'] !== `Bearer ${TOKEN}`) {
+          res.writeHead(401); res.end(JSON.stringify({ ok: false, error: { code: 'not_authorized', message: 'x' } })); return;
+        }
+        if (req.url === '/admin/invites' && req.method === 'POST') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { invite: { partyId: 'p', ownerAddrs: [], token: 't', createdAt: 1 }, encodedInvite: 'ENC' } }));
+          return;
+        }
+        if (req.url === '/admin/members' && req.method === 'GET') {
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, data: { members: [] } }));
+          return;
+        }
+        res.writeHead(400); res.end(JSON.stringify({ ok: false, error: { code: 'bad_request', message: req.url } }));
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+    const a = server.address();
+    baseUrl = `http://127.0.0.1:${typeof a === 'object' && a ? a.port : 0}`;
+  });
+
+  afterEach(async () => { await new Promise<void>((resolve) => server.close(() => resolve())); });
+
+  it('POST /auth/invites returns an encodedInvite (no 500)', async () => {
+    const client = new OwnerNodeClient({ baseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store: new TrustCircleStore(tmpRoot) });
+    const app = buildApp(service);
+    try {
+      const res = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Mom' } });
+      expect(res.statusCode).toBe(200);
+      const body = res.json() as { encodedInvite: string };
+      expect(body.encodedInvite).toBe('ENC');
+    } finally {
+      await app.close();
+    }
+  });
+});
+
+describe('host /auth delegation — node refusing connections', () => {
+  let closedBaseUrl: string;
+
+  beforeEach(async () => {
+    const tmp = http.createServer();
+    const port = await new Promise<number>((resolve) => {
+      tmp.listen(0, '127.0.0.1', () => {
+        const a = tmp.address();
+        resolve(typeof a === 'object' && a ? a.port : 0);
+      });
+    });
+    await new Promise<void>((resolve) => tmp.close(() => resolve()));
+    closedBaseUrl = `http://127.0.0.1:${port}`;
+  });
+
+  it('GET /auth/trust-circle lists local labels and POST /auth/invites returns 503', async () => {
+    const store = new TrustCircleStore(tmpRoot);
+    store.addMember({ peerId: '12D3KooWLocal', label: 'My laptop', addedAt: '2025-01-01T00:00:00Z' });
+
+    const client = new OwnerNodeClient({ baseUrl: closedBaseUrl, token: TOKEN });
+    const service = new TrustCircleService({ cadreNode: client, store });
+    const app = buildApp(service);
+    try {
+      const list = await app.inject({ method: 'GET', url: '/auth/trust-circle' });
+      expect(list.statusCode).toBe(200);
+      const snap = list.json() as { members: Array<{ peerId: string; label: string }> };
+      expect(snap.members.some((m) => m.peerId === '12D3KooWLocal' && m.label === 'My laptop')).toBe(true);
+
+      const invite = await app.inject({ method: 'POST', url: '/auth/invites', payload: { label: 'Dad' } });
+      expect(invite.statusCode).toBe(503);
+      const body = invite.json() as { error: { code: string } };
+      expect(body.error.code).toBe('node_unavailable');
+    } finally {
+      await app.close();
+    }
+  });
+});

package/src/__tests__/orchestrator-env-scrub.test.ts

@@ -0,0 +1,140 @@
+/**
+ * HostProcessOrchestrator env-scrub test — the manager's own `process.env` must
+ * not leak `CADRE_*` config-override vars into spawned children.
+ *
+ * `launchChild` used to build each child's environment as
+ * `{ ...process.env, ...extraEnv, <fixed per-child vars> }`, so ANY `CADRE_*`
+ * var set on the manager (not just the ones the orchestrator deliberately
+ * sets) reached every child. Because `@serfab/cadre-cli` treats an inherited
+ * `CADRE_*` var as a config override that beats the per-child config file, a
+ * `CADRE_PARTY_ID` set on the manager could silently pull every child into
+ * that party.
+ *
+ * A fake CLI records the vars under test from its environment to a file so
+ * the scrub is observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+
+// Writes the vars under test (as seen in the child env) next to the startup token.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID ?? null,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH ?? null,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT ?? null,
+    DEBUG: process.env.DEBUG ?? null,
+  };
+  try { fs.writeFileSync(path.join(dir, 'env-seen.json'), JSON.stringify(record), 'utf8'); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+let savedEnv: Record<string, string | undefined>;
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-env-scrub-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+  savedEnv = {
+    CADRE_PARTY_ID: process.env.CADRE_PARTY_ID,
+    CADRE_STORAGE_PATH: process.env.CADRE_STORAGE_PATH,
+    CADRE_ADMIN_PORT: process.env.CADRE_ADMIN_PORT,
+    DEBUG: process.env.DEBUG,
+  };
+});
+
+afterEach(async () => {
+  for (const orch of orchestrators) {
+    for (const n of orch.listNodes()) {
+      try { await orch.removeContainer(n.dockerId); } catch { /* ignore */ }
+    }
+  }
+  orchestrators.length = 0;
+  await sleep(50);
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18000, end: 18499 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator child env scrub', () => {
+  it('does not leak manager CADRE_* config-override vars into children, but passes through non-CADRE vars', async () => {
+    process.env.CADRE_PARTY_ID = 'conflicting-party';
+    process.env.CADRE_STORAGE_PATH = '/tmp/should-not-leak';
+    // Not an ENV_MAPPINGS config override — read directly by the cli's `start`
+    // command — so it only stays scrubbed if the scrub is prefix-wide.
+    process.env.CADRE_ADMIN_PORT = '19999';
+    process.env.DEBUG = 'some:value';
+
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'child-1',
+      partyId: 'party-1',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+    await orch.createContainer({
+      containerId: 'child-2',
+      partyId: 'party-2',
+      bootstrapNodes: [],
+      profile: 'storage',
+    });
+
+    const seen1 = JSON.parse(await waitForFile(join(rootDir, 'child-1', 'env-seen.json')));
+    const seen2 = JSON.parse(await waitForFile(join(rootDir, 'child-2', 'env-seen.json')));
+
+    for (const seen of [seen1, seen2]) {
+      expect(seen.CADRE_PARTY_ID).toBeNull();
+      expect(seen.CADRE_STORAGE_PATH).toBeNull();
+      expect(seen.CADRE_ADMIN_PORT).toBeNull();
+      expect(seen.DEBUG).toBe('some:value');
+    }
+  });
+});

package/src/__tests__/orchestrator-node-identity.test.ts

@@ -0,0 +1,204 @@
+/**
+ * HostProcessOrchestrator per-node identity tests.
+ *
+ * A donated node must keep the peer id its host cadre approved across restarts,
+ * and needs a durable on-disk home for its node-local stores (`cadre-cli start`
+ * opens the file-backed bootstrap-peer / trusted-owner stores only when a
+ * protobuf identity key file is configured). The orchestrator therefore writes
+ * `<workdir>/identity.key` once per container and passes it as
+ * `--identity-protobuf`.
+ *
+ * A fake CLI records the `--identity-protobuf` argument it was launched with, so
+ * the spawn wiring is observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator, OWNER_CONTAINER_ID } from '../orchestrator/host-process-orchestrator.js';
+import { loadIdentity } from '../installer/identity.js';
+
+// Writes the --identity-protobuf argument (as seen on its own command line) next
+// to the startup token, then behaves like a minimal long-lived node.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  try { fs.writeFileSync(path.join(dir, 'identity-arg.txt'), get('--identity-protobuf') ?? '', 'utf8'); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-nodeid-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+});
+
+afterEach(async () => {
+  for (const orch of orchestrators) {
+    for (const n of orch.listNodes()) {
+      try { await orch.removeContainer(n.dockerId); } catch { /* ignore */ }
+    }
+  }
+  orchestrators.length = 0;
+  await sleep(50);
+  try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+function makeOrchestrator(
+  rootDir: string,
+  portRange: { start: number; end: number } = { start: 17500, end: 17999 },
+): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange,
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator node identity', () => {
+  it('passes --identity-protobuf pointing at a real key inside the node workdir', async () => {
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'donated-1',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a'],
+    });
+
+    const workdir = join(rootDir, 'donated-1');
+    const arg = await waitForFile(join(workdir, 'identity-arg.txt'));
+    expect(arg).toBe(join(workdir, 'identity.key'));
+    // Decodes as a libp2p protobuf private key → the child gets a usable identity.
+    expect(loadIdentity(arg).peerId).toMatch(/^12D3Koo/);
+  });
+
+  it('reuses the same identity when the same containerId is spawned again', async () => {
+    const rootDir = join(tmpRoot, 'b');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    const first = await orch.createContainer({
+      containerId: 'donated-2',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a'],
+    });
+    const workdir = join(rootDir, 'donated-2');
+    await waitForFile(join(workdir, 'identity-arg.txt'));
+    const before = loadIdentity(join(workdir, 'identity.key')).peerId;
+
+    // Stop (not remove — removal deletes the workdir) and re-spawn, as a restart
+    // of a live loan would.
+    await orch.stopContainer(first.dockerId);
+    await orch.createContainer({
+      containerId: 'donated-2',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a'],
+    });
+
+    const after = loadIdentity(join(workdir, 'identity.key')).peerId;
+    expect(after).toBe(before);
+  });
+
+  it('destroys the identity with the workdir when the loan is terminated', async () => {
+    const rootDir = join(tmpRoot, 'c');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    const created = await orch.createContainer({
+      containerId: 'donated-3',
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage',
+      pinnedOwnerKeys: ['key-a'],
+    });
+    const identityPath = join(rootDir, 'donated-3', 'identity.key');
+    await waitForFile(identityPath);
+
+    await orch.removeContainer(created.dockerId);
+    expect(existsSync(identityPath)).toBe(false);
+    expect(existsSync(join(rootDir, 'donated-3'))).toBe(false);
+  });
+
+  // The failure the identity step can actually produce is a damaged key file,
+  // and `DonationService.provision` turns every such throw into an `error`
+  // record and lets the grantee retry. If the spawn path reserved its ports
+  // before the step that throws, each retry would burn four more ports out of a
+  // bounded range until provisioning stopped working altogether.
+  it('reserves no ports when the identity step fails', async () => {
+    const rootDir = join(tmpRoot, 'd');
+    // Exactly one node's worth of ports (health, metrics, p2p, admin).
+    const orch = makeOrchestrator(rootDir, { start: 18100, end: 18103 });
+    await orch.init();
+
+    mkdirSync(join(rootDir, 'donated-bad'), { recursive: true });
+    writeFileSync(join(rootDir, 'donated-bad', 'identity.key'), 'not a protobuf private key', 'utf8');
+
+    const request = {
+      partyId: 'foreign-P',
+      bootstrapNodes: [],
+      profile: 'storage' as const,
+      pinnedOwnerKeys: ['key-a'],
+    };
+    await expect(orch.createContainer({ ...request, containerId: 'donated-bad' })).rejects.toThrow();
+
+    // The whole range is still free, so a healthy container still gets its four.
+    const ok = await orch.createContainer({ ...request, containerId: 'donated-good' });
+    expect(ok.p2pPort).toBeGreaterThanOrEqual(18100);
+  });
+
+  // The owner node carries the HOST's installer identity from <dataDir>, not a
+  // per-workdir key — a second key in its workdir would mean the host's own
+  // cadre node quietly changed peer id.
+  it('leaves the owner node on its own installer identity', async () => {
+    const rootDir = join(tmpRoot, 'e');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    const hostIdentity = join(tmpRoot, 'host-identity.key');
+    await orch.ensureOwnerNode({ identityPath: hostIdentity, partyId: 'host-P', libp2pPort: 4101 });
+
+    const ownerWorkdir = join(rootDir, OWNER_CONTAINER_ID);
+    expect(await waitForFile(join(ownerWorkdir, 'identity-arg.txt'))).toBe(hostIdentity);
+    expect(existsSync(join(ownerWorkdir, 'identity.key'))).toBe(false);
+  });
+});