gowalk-cicd 1.0.125 → 1.0.127

package/CLAUDE.md

@@ -419,3 +419,18 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
   Actions without `MOBILE_RELEASE_DEPLOYMENT_ID` preserve legacy consumer behavior. All new
   receipt helper reads are fixed-origin GitHub requests; Apple/Google still use their assigned exits.
+
+## Scoped backend diagnosis
+
+The existing backend action accepts `operation: identity-diagnostics` with a UTC `diagnostic-since`
+from the last24hours and exact `diagnostic-service` (default`api`). It performs no deploy, rsync,
+Compose mutation or environment read. `identity_diagnostics.py` uses the existing CI SSH binding,
+selects exactly one running container by Compose project/service, rechecks both labels and reads
+at most1000recent log lines within a1MiB/30second bound. Raw output stays on the host; only the
+fixed `firebase_identity_refused` stage/reason allowlist leaves it. No match means no observed
+label, not successful authentication. Dispatch this action through the app's existing backend
+workflow after a protected package release/adoption; never run hand-SSH or expose raw logs.
+
+The diagnostic reader accepts the product-independent standard WARNING logger envelope, discards its
+logger name and rejects trailing fields. Structured remote failure codes survive exit1; SSH transport,
+read bounds and scope refusals have a closed vocabulary. Unknown exceptions remain unclassified.

package/README.md

@@ -1212,3 +1212,23 @@ with HTTP Range; if the origin ignores Range, a bounded full restart is permitte
 must match the selected official manifest's SHA-256 before extraction. Authentication and certificate
 refusals remain terminal. Exhausted transfers emit `flutter_download_failed` with fixed status codes and
 retained-byte counts, without URLs or private curl stderr. Cache identities remain those of the pinned action.
+
+### Read fixed backend identity refusal labels
+
+The installed Backend Deploy workflow offers `operation=identity-diagnostics` on manual dispatch.
+Set `diagnostic-since` to a UTC `YYYY-MM-DDTHH:MM:SSZ` within the previous 24 hours.
+This uses the existing backend action and SSH binding to inspect the exact app's `api` Compose service.
+Custom workflows can set `diagnostic-service` explicitly. Retain the generated operation binding and
+skip app-specific runtime preparation when this mode is selected; preserve all normal deployment inputs.
+
+The action performs no deployment, file sync, database query or runtime-configuration read. It returns
+`gowalk-cicd/backend-identity-diagnostics.v1` with `ok`, a closed `failure` code (empty on success), and at most100 `{stage,reason}` records from the
+fixed Firebase refusal vocabulary. Raw logs stay on the host. Missing/ambiguous containers, scope mismatch,
+transport failure or read bounds fail closed. An empty successful record list means no matching observation;
+it does not prove authentication succeeded. Match the bounded observation window to the owned client attempt.
+
+Reader failures retain only: `invalid_scope`, `invalid_window`, `invalid_destination`,
+`container_ambiguous_or_absent`, `container_scope_mismatch`, `command_timeout`, `output_limit`,
+`command_failed`, `transport_failure`, `remote_invalid`, or `unclassified`. Structured remote refusals
+survive a remote exit1. SSH transport failures remain distinct. Unknown exceptions never contribute text.
+The optional standard `WARNING:<logger>:` prefix is discarded; logger names and trailing fields are never returned.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.125
+1.0.127

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.125
+1.0.127

package/android-action/play-upload/owner.cjs

@@ -12,18 +12,39 @@ function evidence(status) {
   return 'release_write_status=error';
 }
 
+// Does the record name THIS run? That one question settles both halves of the
+// protocol -- a claim is won when the answer is yes, released when it is no --
+// and the answer does not depend on which write produced it.
+//
+// Both halves used to demand their OWN revision back from the read that
+// follows their write. GitHub's contents API is read-after-write eventual on a
+// branch ref, so that read can serve the previous blob for a moment, and a
+// write that had already landed then looked like a failure. Foundy run
+// 34345638488 (2026-09-09) released ownership twice -- both commits are on
+// app-robot-play-coordination, both wrote `owner: null` -- and still failed
+// `play_owner_release_unverified`, taking the app's first Play release with it.
+const held = (row, selected) => record.same(row.value.owner, selected.owner);
+
+// Seal owes two things, not one: the record must not name this run, AND no
+// claim write of ours may still be able to land. A record another holder has
+// taken settles both -- their write moved the blob, so a late CAS of ours can
+// only conflict. An UNOWNED record settles only the first, so seal still writes
+// once to move the revision itself, and then accepts any readback that no
+// longer names this run. (That fence used to be a side effect of releasing a
+// record we never held; a lost claim response relies on it.)
+const fenced = (row, selected) => row.value.owner !== null && !held(row, selected);
+
 async function seal(client, selected) {
   let detail = 'release_write_status=none';
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = record.validate(await client.read(selected.path), selected);
-    if (row.value.owner !== null && !record.same(row.value.owner, selected.owner)) return;
+    if (fenced(row, selected)) return;
     const idle = record.replacement(row, null);
     // Reconcile a possibly applied write; keep only its status as evidence.
     try { detail = evidence(await client.write(selected.path, row, idle)); }
     catch { detail = evidence(undefined); }
     const after = record.validate(await client.read(selected.path), selected);
-    if (after.value.revision === idle.revision && after.value.owner === null) return;
-    if (after.value.owner !== null && !record.same(after.value.owner, selected.owner)) return;
+    if (!held(after, selected)) return;
   }
   const failure = new Error('play_owner_release_unverified');
   failure.detail = detail;
@@ -40,6 +61,12 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
   for (let attempt = 0; attempt < 3;) {
     if (waiting.signal?.aborted) throw new Error('play_owner_cancelled');
     const row = record.validate(await client.read(selected.path), selected);
+    // A record already naming THIS run is this run's own claim: the owner id is
+    // a UUID minted once per process, so no other writer can have put it there.
+    // Without this, a claim whose write landed but whose readback lagged came
+    // back on the next pass as a foreign live holder and the run waited out its
+    // own deadline against itself.
+    if (held(row, selected)) return;
     if (row.value.owner !== null) {
       const owner = row.value.owner;
       if (owner.kind !== 'ci' || !record.terminal(await client.run(owner), owner)) {
@@ -55,7 +82,7 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
     attempted();
     try { await client.write(selected.path, row, desired); } catch { /* Only exact readback may adopt it. */ }
     const after = record.validate(await client.read(selected.path), selected);
-    if (after.value.revision === desired.revision && record.same(after.value.owner, selected.owner)) return;
+    if (held(after, selected)) return;
   }
   throw new Error('play_owner_busy');
 }

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.125
+1.0.127

package/backend-action/action.yml

@@ -6,6 +6,18 @@ description: >
   The deploy host is publicly reachable, so this runs on a GitHub-hosted runner.
 
 inputs:
+  operation:
+    description: deploy (default) or identity-diagnostics (read-only fixed Firebase refusal labels).
+    required: false
+    default: deploy
+  diagnostic-service:
+    description: Exact Compose service to inspect; used only for identity-diagnostics.
+    required: false
+    default: api
+  diagnostic-since:
+    description: UTC YYYY-MM-DDTHH:MM:SSZ within the previous 24 hours; required for diagnostics.
+    required: false
+    default: ""
   host:
     description: SSH host of the deploy server.
     required: false
@@ -56,7 +68,15 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Validate operation
+      shell: bash
+      env:
+        OPERATION: ${{ inputs.operation }}
+      run: |
+        case "$OPERATION" in deploy|identity-diagnostics) ;; *) exit 1;; esac
+
     - name: Validate inputs
+      if: inputs.operation == 'deploy'
       id: layout
       shell: bash
       env:
@@ -102,6 +122,7 @@ runs:
         chmod 644 ~/.ssh/known_hosts
 
     - name: Sync backend to the host
+      if: inputs.operation == 'deploy'
       shell: bash
       env:
         BACKEND_DIR: ${{ inputs.backend-dir }}
@@ -139,6 +160,7 @@ runs:
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host
+      if: inputs.operation == 'deploy'
       shell: bash
       env:
         RUNTIME_ENV: ${{ inputs.runtime-env }}
@@ -159,6 +181,20 @@ runs:
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
              '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 
+    - name: Read fixed backend identity diagnostics
+      if: inputs.operation == 'identity-diagnostics'
+      shell: bash
+      env:
+        DIAGNOSTIC_APP: ${{ inputs.app-name }}
+        DIAGNOSTIC_SERVICE: ${{ inputs.diagnostic-service }}
+        DIAGNOSTIC_SINCE: ${{ inputs.diagnostic-since }}
+        DIAGNOSTIC_HOST: ${{ inputs.host }}
+        DIAGNOSTIC_USER: ${{ inputs.ssh-user }}
+      run: |
+        python3 "${{ github.action_path }}/identity_diagnostics.py" \
+          --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --since "$DIAGNOSTIC_SINCE" \
+          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER"
+
     - name: Cleanup key
       if: always()
       shell: bash

package/backend-action/identity_diagnostics.py

@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+"""Read one app's fixed Firebase refusal labels; raw host output never leaves this process."""
+import argparse
+import datetime
+import json
+import os
+from pathlib import Path
+import re
+import selectors
+import shlex
+import signal
+import subprocess
+import time
+
+STAGES = frozenset({'auth_signature', 'app_check_signature', 'app_scope', 'account_lookup', 'unclassified'})
+REASONS = frozenset({
+    'unclassified', 'transport_timeout', 'transport_failure', 'token_invalid',
+    'app_scope_invalid', 'token_size_invalid', 'token_header_invalid', 'token_time_invalid',
+    'authentication_time_invalid', 'app_audience_invalid', 'subject_invalid', 'invalid_key_id',
+    'key_fetch_busy', 'key_refresh_limited', 'unknown_key', 'key_provider_unavailable',
+    'key_response_limit', 'key_set_invalid', 'key_identity_invalid', 'key_algorithm_invalid',
+    'key_strength_invalid', 'account_verification_refused', 'account_response_limit', 'account_missing',
+    'account_disabled_or_mismatched', 'account_revocation_boundary_missing', 'account_revoked',
+})
+SCHEMA = 'gowalk-cicd/backend-identity-diagnostics.v1'
+LABEL = re.compile(r'(?:WARNING:[A-Za-z_][A-Za-z0-9_.-]{0,127}:)?'
+                   r'firebase_identity_refused stage=([a-z_]+) reason=([a-z_]+)')
+LIMIT = 1024 * 1024
+FAILURES = frozenset({
+    'unclassified', 'invalid_scope', 'invalid_window', 'invalid_destination',
+    'container_ambiguous_or_absent', 'container_scope_mismatch', 'command_timeout',
+    'output_limit', 'command_failed', 'transport_failure', 'remote_invalid',
+})
+
+
+class ReaderFailure(Exception):
+    def __init__(self, code):
+        self.code = code if isinstance(code, str) and code in FAILURES else 'unclassified'
+        super().__init__(self.code)
+
+
+def transfer(selector, process, payload, offset, data):
+    for key, _ in selector.select(0.1):
+        if key.fileobj is process.stdin:
+            offset += os.write(process.stdin.fileno(), payload[offset:offset + 4096])
+            if offset == len(payload):
+                selector.unregister(process.stdin)
+                process.stdin.close()
+        else:
+            chunk = os.read(process.stdout.fileno(), 65536)
+            if not chunk:
+                selector.unregister(process.stdout)
+            data.extend(chunk)
+            if len(data) > LIMIT:
+                raise ReaderFailure('output_limit')
+    return offset
+
+
+def bounded(argv, *, payload=None, seconds=30, with_status=False):
+    """Bound output, runtime and owned process cleanup without printing stderr."""
+    process = subprocess.Popen(argv, stdin=subprocess.PIPE if payload else subprocess.DEVNULL,
+                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, start_new_session=True)
+    deadline, data = time.monotonic() + seconds, bytearray()
+    try:
+        with selectors.DefaultSelector() as selector:
+            selector.register(process.stdout, selectors.EVENT_READ)
+            if payload:
+                os.set_blocking(process.stdin.fileno(), False)
+                selector.register(process.stdin, selectors.EVENT_WRITE)
+            offset = 0
+            while selector.get_map():
+                if time.monotonic() >= deadline:
+                    raise ReaderFailure('command_timeout')
+                offset = transfer(selector, process, payload, offset, data)
+        try:
+            status = process.wait(timeout=max(0.01, deadline - time.monotonic()))
+        except subprocess.TimeoutExpired:
+            raise ReaderFailure('command_timeout') from None
+        if with_status:
+            return status, bytes(data)
+        if status:
+            raise ReaderFailure('command_failed')
+        return bytes(data)
+    finally:
+        # Descendants can retain a pipe after the direct child exits. Kill only this owned group.
+        try:
+            os.killpg(process.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        process.wait(timeout=5)
+        process.stdout.close()
+        if process.stdin and not process.stdin.closed:
+            process.stdin.close()
+
+
+def validate(app, service, since):
+    if not re.fullmatch(r'[a-z0-9][a-z0-9-]{0,79}', app):
+        raise ReaderFailure('invalid_scope')
+    if not re.fullmatch(r'[a-z0-9][a-z0-9_-]{0,63}', service):
+        raise ReaderFailure('invalid_scope')
+    if not re.fullmatch(r'\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ', since):
+        raise ReaderFailure('invalid_window')
+    try:
+        start = datetime.datetime.strptime(since, '%Y-%m-%dT%H:%M:%SZ').replace(tzinfo=datetime.timezone.utc)
+    except ValueError:
+        raise ReaderFailure('invalid_window') from None
+    age = (datetime.datetime.now(datetime.timezone.utc) - start).total_seconds()
+    if age < 0 or age > 86400:
+        raise ReaderFailure('invalid_window')
+
+
+def records(raw):
+    result = []
+    for line in raw.decode('utf-8', errors='replace').splitlines():
+        match = LABEL.fullmatch(line)
+        if match and match[1] in STAGES and match[2] in REASONS:
+            result.append({'stage': match[1], 'reason': match[2]})
+    return result[-100:]
+
+
+def remote(app, service, since):
+    validate(app, service, since)
+    ids = bounded(['docker', 'ps', '--no-trunc', '--filter', f'label=com.docker.compose.project={app}',
+                   '--filter', f'label=com.docker.compose.service={service}', '--format', '{{.ID}}'], seconds=10).splitlines()
+    if len(ids) != 1 or not re.fullmatch(rb'[a-f0-9]{64}', ids[0]):
+        raise ReaderFailure('container_ambiguous_or_absent')
+    container = ids[0].decode('ascii')
+    # Recheck exact labels; Docker filter matching alone does not prove the requested scope.
+    inspected = json.loads(bounded(['docker', 'inspect', '--format', '{{json .Config.Labels}}', container],
+                                   seconds=10))
+    if (inspected.get('com.docker.compose.project') != app
+            or inspected.get('com.docker.compose.service') != service):
+        raise ReaderFailure('container_scope_mismatch')
+    # docker logs writes the container's stderr to its own stderr. Merge only inside the bounded reader.
+    command = ['docker', 'logs', '--since', since, '--tail', '1000', container]
+    raw = bounded(['sh', '-c', 'exec "$@" 2>&1', 'diagnostics', *command], seconds=10)
+    return {'schema': SCHEMA, 'ok': True, 'failure': '', 'records': records(raw)}
+
+
+def local(args):
+    validate(args.app, args.service, args.since)
+    if (not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9.-]{0,252}', args.host or '')
+            or not re.fullmatch(r'[a-z_][a-z0-9_-]{0,31}', args.user)):
+        raise ReaderFailure('invalid_destination')
+    command = shlex.join(['python3', '-', '--remote', '--app', args.app,
+                          '--service', args.service, '--since', args.since])
+    try:
+        status, raw = bounded(['ssh', '-i', str(Path.home() / '.ssh/backend_deploy'), '-o', 'IdentitiesOnly=yes',
+                       '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5',
+                       '-o', 'ServerAliveCountMax=2', f'{args.user}@{args.host}', command],
+                      payload=Path(__file__).read_bytes(), seconds=45, with_status=True)
+    except OSError:
+        raise ReaderFailure('transport_failure') from None
+    return decode_remote(status, raw)
+
+
+def decode_remote(status, raw):
+    if status not in (0, 1):
+        raise ReaderFailure('transport_failure')
+    try:
+        result = json.loads(raw)
+    except (ValueError, TypeError):
+        raise ReaderFailure('remote_invalid') from None
+    if (not isinstance(result, dict) or set(result) != {'schema', 'ok', 'failure', 'records'}
+            or result['schema'] != SCHEMA or not isinstance(result['ok'], bool)):
+        raise ReaderFailure('remote_invalid')
+    if status == 1 and result['ok'] is False and result['records'] == []:
+        raise ReaderFailure(result['failure'])
+    if status or result['ok'] is not True or result['failure'] != '':
+        raise ReaderFailure('remote_invalid')
+    if not isinstance(result['records'], list) or len(result['records']) > 100:
+        raise ReaderFailure('remote_invalid')
+    for row in result['records']:
+        if (not isinstance(row, dict) or set(row) != {'stage', 'reason'}
+                or not isinstance(row['stage'], str) or row['stage'] not in STAGES
+                or not isinstance(row['reason'], str) or row['reason'] not in REASONS):
+            raise ReaderFailure('remote_invalid')
+    return result
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--remote', action='store_true')
+    parser.add_argument('--app', required=True)
+    parser.add_argument('--service', default='api')
+    parser.add_argument('--since', required=True)
+    parser.add_argument('--host')
+    parser.add_argument('--user', default='root')
+    args = parser.parse_args()
+    try:
+        result = remote(args.app, args.service, args.since) if args.remote else local(args)
+    except Exception as error:
+        # Only our closed vocabulary survives; provider and parser exceptions remain unclassified.
+        code = error.code if isinstance(error, ReaderFailure) else 'unclassified'
+        print(json.dumps({'schema': SCHEMA, 'ok': False, 'failure': code, 'records': []}))
+        return 1
+    print(json.dumps(result, separators=(',', ':')))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

package/backend-action/test_identity_diagnostics.py

@@ -0,0 +1,101 @@
+"""Protocol and process-boundary checks for the deployed read-only diagnostic reader."""
+import datetime
+import importlib.util
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest.mock import patch
+
+SPEC = importlib.util.spec_from_file_location('reader', Path(__file__).with_name('identity_diagnostics.py'))
+READER = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(READER)
+SINCE = (datetime.datetime.now(datetime.timezone.utc) - datetime.timedelta(minutes=5)).strftime('%Y-%m-%dT%H:%M:%SZ')
+CID = b'a' * 64
+
+
+class IdentityDiagnostics(unittest.TestCase):
+    def test_exact_labels_only(self):
+        raw = b'\n'.join([
+            b'firebase_identity_refused stage=auth_signature reason=token_invalid',
+            b'WARNING:cast_tv.firebase:firebase_identity_refused stage=account_lookup reason=account_revoked',
+            b'WARNING:second_product.identity:firebase_identity_refused stage=app_check_signature reason=unknown_key',
+            b'Bearer PRIVATE_SENTINEL',
+            b'firebase_identity_refused stage=PRIVATE_SENTINEL reason=token_invalid',
+            b'firebase_identity_refused stage=auth_signature reason=PRIVATE_SENTINEL',
+            b'firebase_identity_refused stage=auth_signature reason=token_invalid user=PRIVATE_SENTINEL',
+            b'prefix firebase_identity_refused stage=auth_signature reason=token_invalid',
+        ])
+        self.assertEqual(READER.records(raw), [
+            {'stage': 'auth_signature', 'reason': 'token_invalid'},
+            {'stage': 'account_lookup', 'reason': 'account_revoked'},
+            {'stage': 'app_check_signature', 'reason': 'unknown_key'},
+        ])
+
+    def test_recent_rows_bounded(self):
+        self.assertEqual(len(READER.records(
+            b'firebase_identity_refused stage=app_check_signature reason=unknown_key\n' * 1001)), 100)
+
+    def test_invalid_scopes_and_windows(self):
+        for app, service, since in [('../other', 'api', SINCE), ('app', 'api;id', SINCE),
+                                    ('app', 'api', '2020-01-01T00:00:00Z'),
+                                    ('app', 'api', '2099-01-01T00:00:00Z'), ('app', 'api', '10m')]:
+            with self.subTest(app=app, service=service, since=since), self.assertRaises(READER.ReaderFailure):
+                READER.validate(app, service, since)
+
+    def test_remote_exact_container_recheck_and_fixed_projection(self):
+        labels = json.dumps({'com.docker.compose.project': 'fixture', 'com.docker.compose.service': 'api'}).encode()
+        with patch.object(READER, 'bounded', side_effect=[CID + b'\n', labels,
+                b'PRIVATE_SENTINEL\nfirebase_identity_refused stage=app_scope reason=app_scope_invalid\n']) as run:
+            result = READER.remote('fixture', 'api', SINCE)
+        self.assertEqual(result['records'], [{'stage': 'app_scope', 'reason': 'app_scope_invalid'}])
+        commands = [call.args[0] for call in run.call_args_list]
+        self.assertEqual(commands[0], ['docker', 'ps', '--no-trunc', '--filter',
+            'label=com.docker.compose.project=fixture', '--filter', 'label=com.docker.compose.service=api',
+            '--format', '{{.ID}}'])
+        self.assertEqual(commands[1][-1], CID.decode())
+        self.assertEqual(commands[2][4:], ['docker', 'logs', '--since', SINCE, '--tail', '1000', CID.decode()])
+        self.assertNotIn('PRIVATE_SENTINEL', json.dumps(result))
+
+    def test_absent_ambiguous_and_foreign_containers_refuse(self):
+        for ids in [b'', CID + b'\n' + CID, b'PRIVATE_SENTINEL']:
+            with patch.object(READER, 'bounded', return_value=ids) as run, self.assertRaises(READER.ReaderFailure):
+                READER.remote('fixture', 'api', SINCE)
+            self.assertEqual(run.call_count, 1)
+        for project, service in [('other', 'api'), ('fixture', 'db')]:
+            labels = json.dumps({'com.docker.compose.project': project, 'com.docker.compose.service': service})
+            with patch.object(READER, 'bounded', side_effect=[CID, labels]) as run, \
+                    self.assertRaises(READER.ReaderFailure):
+                READER.remote('fixture', 'api', SINCE)
+            self.assertEqual(run.call_count, 2)
+
+    def test_local_rejects_raw_or_extended_remote_output(self):
+        args = type('Args', (), dict(app='fixture', service='api', since=SINCE, host='fixture.invalid', user='root'))()
+        for raw in [b'PRIVATE_SENTINEL', json.dumps({'schema': READER.SCHEMA, 'ok': True,
+                'records': [{'stage': 'auth_signature', 'reason': 'PRIVATE_SENTINEL'}]}).encode(),
+                json.dumps({'schema': READER.SCHEMA, 'ok': True, 'records': [], 'raw': 'PRIVATE_SENTINEL'}).encode()]:
+            with patch.object(READER, 'bounded', return_value=(0, raw)), self.assertRaises(READER.ReaderFailure):
+                READER.local(args)
+
+    def test_owned_subprocess_success_and_stderr_suppression(self):
+        self.assertEqual(READER.bounded([sys.executable, '-c',
+            'import sys; print("ok"); print("PRIVATE_SENTINEL", file=sys.stderr)']), b'ok\n')
+
+    def test_failed_subprocess_does_not_export_output(self):
+        with self.assertRaisesRegex(READER.ReaderFailure, '^command_failed$'):
+            READER.bounded([sys.executable, '-c', 'print("PRIVATE_SENTINEL"); raise SystemExit(7)'])
+
+    def test_output_limit_and_owned_pipe_cleanup(self):
+        with self.assertRaisesRegex(READER.ReaderFailure, '^output_limit$'):
+            READER.bounded([sys.executable, '-c', 'print("x" * 1048577)'])
+        with self.assertRaisesRegex(READER.ReaderFailure, '^command_timeout$'):
+            READER.bounded([sys.executable, '-c',
+                'import os,time; child=os.fork(); time.sleep(10) if child == 0 else None'], seconds=0.2)
+
+    def test_stdin_upload_is_bounded_and_complete(self):
+        self.assertEqual(READER.bounded([sys.executable, '-c',
+            'import sys; print(len(sys.stdin.buffer.read()))'], payload=b'x' * 200000), b'200000\n')
+
+
+if __name__ == '__main__':
+    unittest.main()

package/backend-action/test_identity_failures.py

@@ -0,0 +1,56 @@
+"""Closed failure propagation through remote output, transport and the public CLI."""
+from contextlib import redirect_stdout
+import io
+import json
+import sys
+import unittest
+from unittest.mock import patch
+from test_identity_diagnostics import READER, SINCE
+
+
+class IdentityFailures(unittest.TestCase):
+    def test_every_fixed_remote_refusal_survives_the_ssh_exit(self):
+        args = type('Args', (), dict(app='fixture', service='api', since=SINCE, host='fixture.invalid', user='root'))()
+        for code in READER.FAILURES:
+            raw = json.dumps({'schema': READER.SCHEMA, 'ok': False, 'failure': code, 'records': []}).encode()
+            with self.subTest(code=code), patch.object(READER, 'bounded', return_value=(1, raw)) as run:
+                with self.assertRaises(READER.ReaderFailure) as failure:
+                    READER.local(args)
+                self.assertEqual(failure.exception.code, code)
+                self.assertTrue(run.call_args.kwargs['with_status'])
+
+    def test_transport_and_unknown_refusals_never_export_raw_values(self):
+        for status, raw, expected in [(255, b'PRIVATE_SENTINEL', 'transport_failure'),
+                (1, b'PRIVATE_SENTINEL', 'remote_invalid'),
+                (1, json.dumps({'schema': READER.SCHEMA, 'ok': False,
+                    'failure': 'PRIVATE_SENTINEL', 'records': []}).encode(), 'unclassified')]:
+            with self.assertRaises(READER.ReaderFailure) as failure:
+                READER.decode_remote(status, raw)
+            self.assertEqual(failure.exception.code, expected)
+            self.assertNotIn('PRIVATE_SENTINEL', str(failure.exception))
+
+    def test_nonzero_process_keeps_only_validated_structured_refusal(self):
+        payload = json.dumps({'schema': READER.SCHEMA, 'ok': False,
+                              'failure': 'container_scope_mismatch', 'records': []})
+        status, raw = READER.bounded([sys.executable, '-c',
+            'import sys; print(sys.argv[1]); print("PRIVATE_SENTINEL", file=sys.stderr); sys.exit(1)', payload],
+            with_status=True)
+        with self.assertRaisesRegex(READER.ReaderFailure, '^container_scope_mismatch$'):
+            READER.decode_remote(status, raw)
+        self.assertNotIn(b'PRIVATE_SENTINEL', raw)
+
+    def test_cli_known_and_unknown_errors_produce_closed_failure_envelopes(self):
+        argv = ['reader', '--remote', '--app', 'fixture', '--service', 'api', '--since', SINCE]
+        for error, expected in [(READER.ReaderFailure('command_timeout'), 'command_timeout'),
+                                (RuntimeError('PRIVATE_SENTINEL'), 'unclassified')]:
+            output = io.StringIO()
+            with patch.object(sys, 'argv', argv), patch.object(READER, 'remote', side_effect=error), \
+                    redirect_stdout(output):
+                self.assertEqual(READER.main(), 1)
+            self.assertEqual(json.loads(output.getvalue()), {
+                'schema': READER.SCHEMA, 'ok': False, 'failure': expected, 'records': []})
+            self.assertNotIn('PRIVATE_SENTINEL', output.getvalue())
+
+
+if __name__ == '__main__':
+    unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.125",
+  "version": "1.0.127",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -14,12 +14,22 @@ on:
       - ".github/actions/backend-app/**"
       - "!.github/actions/backend-app/.daemux-version"
   workflow_dispatch:
+    inputs:
+      operation:
+        type: choice
+        description: Deploy or read fixed identity refusal labels without changing the running app
+        default: deploy
+        options: [deploy, identity-diagnostics]
+      diagnostic-since:
+        type: string
+        description: For diagnostics, UTC YYYY-MM-DDTHH:MM:SSZ within the previous 24 hours
+        required: false
 
 permissions:
   contents: read
 
 concurrency:
-  group: backend-deploy-${{ github.ref }}
+  group: backend-deploy-${{ github.ref }}-${{ inputs.operation || 'deploy' }}
   cancel-in-progress: true
 
 jobs:
@@ -31,6 +41,7 @@ jobs:
 
       # Pick the source dir and either its nested compose file or a root one.
       - id: dir
+        if: inputs.operation != 'identity-diagnostics'
         run: |
           if [ -f backend/docker-compose.yml ]; then
             echo "path=backend" >> "$GITHUB_OUTPUT"
@@ -52,6 +63,8 @@ jobs:
       - name: Deploy backend
         uses: ./.github/actions/backend-app
         with:
+          operation: ${{ inputs.operation || 'deploy' }}
+          diagnostic-since: ${{ inputs.diagnostic-since }}
           ssh-key: ${{ secrets.BACKEND_DEPLOY_SSH_KEY }}
           host: ${{ vars.BACKEND_DEPLOY_HOST || '138.197.36.107' }}
           app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}