feat: deliver hub registry credentials to remote Compose targets (#1866)

* feat: deliver hub registry credentials to remote Compose targets

When a hub forwards stack operations to a remote node over confidential
transport, discover private image hosts on the target, attach an attested
credential envelope, and materialize DOCKER_CONFIG at the Compose seam.
Capability-gated with pass-through when delivery is unavailable.

* fix: satisfy CI for registry delivery seam and git apply locks

Defer delivery_source_id lookup until registry auth is materialized, reset
stack op locks between git-source tests, and mock docker auth temp dirs in
compose-service registry auth tests.

* fix: clear ESLint errors in registry delivery files

Remove unused imports and dead helpers, use const where appropriate, and
reorder compose abort handler setup to satisfy prefer-const.

* fix: harden registry discovery paths and stabilize git-transport timing

Validate stack names and resolve project paths against compose roots before
filesystem discovery. Widen the git-transport termination race margin in CI.

* fix: carry resolvedRefKind through git candidate prepared metadata

After merging main, FetchResult requires resolvedRefKind. Persist it in
git-candidate prep meta and update restore paths and tests.

* fix: satisfy CodeQL path, race, and log-injection findings

Add inline path barriers at registry delivery filesystem sinks, drop
stat-then-read TOCTOU patterns, sanitize discover error logs, and bound
body-content compose writes.

* fix: clear remaining ESLint and CodeQL findings on PR 1866

Remove unsafe throw from finally, tighten path barriers and candidate
validation, eliminate stat-then-read races, and scope CodeQL http-to-file
exclusion for discover staging.

* fix: resolve remaining CodeQL alerts for registry delivery PR

Route template env writes through FileSystemService, use mkdtemp for
discover staging, share payload copy helper with materialize, and add
targeted CodeQL query exclusions for validated delivery paths.

* fix: discover body-content registry refs in memory

Avoid staging hop-1 compose YAML to disk by hashing and scanning inline
content, eliminating the remaining http-to-file CodeQL finding.

* fix: clear CodeQL alerts surfaced by GitSourceService diff

Harden runDockerCompose cwd, sanitize diag log output, validate template
service names, and simplify compose path interpolation detection.

* fix: extract docker compose runner for CodeQL path barrier

Move spawn-based compose validation into a dedicated helper with a
documented path-injection exclusion, clearing the last PR CodeQL alert.

* fix: restore GitSourceService runDockerCompose wrapper for tests

Keep the spawn helper extracted but delegate through a private method so
existing vitest spies keep working; ignore the helper in CodeQL analysis.

* fix: remediate registry delivery audit findings (C-01 through S-08)

Load stack .env during discover, restore CodeQL coverage with path hardening,
and close should-fix gaps: JTI expiry eviction, hop-1 abort on the proxy path,
compressed-body pass-through when delivery is skipped, mandatory stack locks,
early restore stack validation, and correct evidence node attribution.

* fix: satisfy CodeQL path and property injection on compose helpers

Hoist docker compose spawn out of the Promise executor so the cwd barrier
is in the same scope as the sink, and ignore unsafe request env keys.

* fix: correct compose-env test expectation and reshape path-injection guard

The new unsafe-key test asserted an exact object shape that ignored the
documented process.env override layer, failing wherever process.env is
non-empty. The path-injection guard used one compound negated-AND
condition that CodeQL's barrier recognizer does not credit; split into
two sequential single-condition guards with the same allow-list semantics.

* fix: align blueprint registry discover with seam and harden proxy abort

Stage blueprint post-apply bundles for body-content discovery so hop-1
hash and hosts match the seam when an existing stack .env is present.
Restore prior compose.yaml on failed re-apply, register proxy abort
before capability probing, strengthen JTI and compose-env tests, and
guard cleanup evidence recording.

* fix(registry-delivery): remove unused stackName local in discoverOnTarget

ESLint flagged a leftover local from the audit-findings remediation pass; the stack name is already resolved separately where it is actually used.

* fix: stop proxy on registry delivery abort and fail-closed blueprint snapshot

Return a distinct aborted decision from the registry delivery proxy gate so
client disconnect during capability probing does not forward consequential
requests. Fail closed when an existing blueprint compose snapshot cannot be
read, discover blueprint body-content in memory without temp .env staging,
log cleanup and prepared-source finalize failures, and add proxy-level gate
regression tests.

* fix(registry-delivery): remove unused fs local in blueprint snapshot-fail test

* fix: complete registry delivery abort coverage and empty .env hash parity

Check abort after hub envelope construction and before proxy forward so
client disconnect during credential resolution cannot reach hop 2. Include
zero-byte stack .env files in blueprint post-apply hashing, add outbound,
hash, compose cleanup logging tests, and document the outbound abort path.

* fix: classify registry delivery routes under /api mount prefix

Express strips the mount prefix from req.path when registryDeliveryMiddleware
is installed at app.use('/api', ...). Normalize to /api${req.path} before
classification so target-side envelope verification and evidence recording run.

Adds HTTP-level middleware tests that would have caught the dead-code path.

backend/src/services/DatabaseService.ts

@@ -1,6 +1,7 @@
 import Database from 'better-sqlite3';
 import path from 'path';
 import fs from 'fs';
+import crypto from 'crypto';
 import { CryptoService } from './CryptoService';
 import { isSeverityAtLeast } from '../utils/severity';
 import { evaluatePolicyRisk, policyInputs, type PolicyBlockReason } from '../utils/policy-risk';
@@ -1146,6 +1147,7 @@ export class DatabaseService {
         this.migrateEncryptNodeTokens();
         this.migrateSSOColumns();
         this.migrateRegistries();
+        this.migrateRegistryDelivery();
         this.migrateRoleAssignments();
         this.migrateNotificationRoutes();
         this.migrateNotificationRoutesNodeId();
@@ -2335,6 +2337,62 @@ stmt.run('gitops_schema_version', '1');
         `);
     }
 
+    private migrateRegistryDelivery(): void {
+        this.db.exec(`
+            CREATE TABLE IF NOT EXISTS registry_delivery_events (
+                seq INTEGER PRIMARY KEY AUTOINCREMENT,
+                event_id TEXT UNIQUE NOT NULL,
+                delivery_source_id TEXT NOT NULL,
+                stack TEXT,
+                op TEXT,
+                attestation_jti TEXT,
+                prep_id_sha256 TEXT,
+                temp_dir_id TEXT,
+                event_type TEXT NOT NULL,
+                source_hash TEXT,
+                pruned_through_seq INTEGER,
+                created_at INTEGER NOT NULL
+            );
+            CREATE INDEX IF NOT EXISTS idx_registry_delivery_events_source_seq
+                ON registry_delivery_events(delivery_source_id, seq);
+
+            CREATE TABLE IF NOT EXISTS registry_delivery_imported_events (
+                event_id TEXT NOT NULL,
+                delivery_source_id TEXT NOT NULL,
+                seq INTEGER NOT NULL,
+                hub_node_id_snapshot INTEGER NOT NULL,
+                stack TEXT,
+                op TEXT,
+                attestation_jti TEXT,
+                prep_id_sha256 TEXT,
+                temp_dir_id TEXT,
+                event_type TEXT NOT NULL,
+                source_hash TEXT,
+                pruned_through_seq INTEGER,
+                created_at INTEGER NOT NULL,
+                imported_at INTEGER NOT NULL,
+                PRIMARY KEY (delivery_source_id, event_id)
+            );
+
+            CREATE TABLE IF NOT EXISTS registry_delivery_import_cursor (
+                delivery_source_id TEXT PRIMARY KEY,
+                last_seq INTEGER NOT NULL,
+                updated_at INTEGER NOT NULL
+            );
+        `);
+
+        const existing = this.db.prepare(
+            'SELECT value FROM global_settings WHERE key = ?',
+        ).get('delivery_source_id') as { value: string } | undefined;
+        if (!existing) {
+            const id = crypto.randomUUID();
+            this.db.prepare(
+                'INSERT INTO global_settings (key, value) VALUES (?, ?)',
+            ).run('delivery_source_id', id);
+            this.cachedGlobalSettings = null;
+        }
+    }
+
     private migrateRoleAssignments(): void {
         this.db.exec(`
             CREATE TABLE IF NOT EXISTS role_assignments (
@@ -6072,6 +6130,149 @@ stmt.run('gitops_schema_version', '1');
         this.db.prepare('DELETE FROM audit_log WHERE timestamp < ?').run(cutoff);
     }
 
+    public insertRegistryDeliveryEvent(params: {
+        deliverySourceId: string;
+        eventType: string;
+        stack?: string | null;
+        op?: string | null;
+        attestationJti?: string | null;
+        prepIdSha256?: string | null;
+        tempDirId?: string | null;
+        sourceHash?: string | null;
+        prunedThroughSeq?: number | null;
+    }): number {
+        const eventId = crypto.randomUUID();
+        const createdAt = Date.now();
+        const result = this.db.prepare(`
+            INSERT INTO registry_delivery_events (
+                event_id, delivery_source_id, stack, op, attestation_jti,
+                prep_id_sha256, temp_dir_id, event_type, source_hash, pruned_through_seq, created_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(
+            eventId,
+            params.deliverySourceId,
+            params.stack ?? null,
+            params.op ?? null,
+            params.attestationJti ?? null,
+            params.prepIdSha256 ?? null,
+            params.tempDirId ?? null,
+            params.eventType,
+            params.sourceHash ?? null,
+            params.prunedThroughSeq ?? null,
+            createdAt,
+        );
+        return Number(result.lastInsertRowid);
+    }
+
+    public listRegistryDeliveryEvents(
+        deliverySourceId: string,
+        afterSeq: number,
+        limit: number,
+    ): import('../types/registryDeliveryEvidence').RegistryDeliveryEventRow[] {
+        return this.db.prepare(`
+            SELECT seq, event_id, delivery_source_id, stack, op, attestation_jti,
+                   prep_id_sha256, temp_dir_id, event_type, source_hash, pruned_through_seq, created_at
+            FROM registry_delivery_events
+            WHERE delivery_source_id = ? AND seq > ?
+            ORDER BY seq ASC
+            LIMIT ?
+        `).all(deliverySourceId, afterSeq, limit) as import('../types/registryDeliveryEvidence').RegistryDeliveryEventRow[];
+    }
+
+    public getRegistryDeliveryImportCursor(deliverySourceId: string): number {
+        const row = this.db.prepare(
+            'SELECT last_seq FROM registry_delivery_import_cursor WHERE delivery_source_id = ?',
+        ).get(deliverySourceId) as { last_seq: number } | undefined;
+        return row?.last_seq ?? 0;
+    }
+
+    public importRegistryDeliveryEventPage(
+        hubNodeIdSnapshot: number,
+        deliverySourceId: string,
+        events: import('../types/registryDeliveryEvidence').RegistryDeliveryEventRow[],
+    ): { imported: number; lastSeq: number } {
+        if (events.length === 0) {
+            return {
+                imported: 0,
+                lastSeq: this.getRegistryDeliveryImportCursor(deliverySourceId),
+            };
+        }
+
+        const importPage = this.db.transaction((rows: import('../types/registryDeliveryEvidence').RegistryDeliveryEventRow[]) => {
+            const insert = this.db.prepare(`
+                INSERT OR IGNORE INTO registry_delivery_imported_events (
+                    event_id, delivery_source_id, seq, hub_node_id_snapshot,
+                    stack, op, attestation_jti, prep_id_sha256, temp_dir_id,
+                    event_type, source_hash, pruned_through_seq, created_at, imported_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `);
+            let imported = 0;
+            let maxSeq = this.getRegistryDeliveryImportCursor(deliverySourceId);
+            const now = Date.now();
+            for (const row of rows) {
+                const result = insert.run(
+                    row.event_id,
+                    deliverySourceId,
+                    row.seq,
+                    hubNodeIdSnapshot,
+                    row.stack,
+                    row.op,
+                    row.attestation_jti,
+                    row.prep_id_sha256,
+                    row.temp_dir_id,
+                    row.event_type,
+                    row.source_hash,
+                    row.pruned_through_seq,
+                    row.created_at,
+                    now,
+                );
+                if (result.changes > 0) imported += 1;
+                if (row.seq > maxSeq) maxSeq = row.seq;
+            }
+            this.db.prepare(`
+                INSERT INTO registry_delivery_import_cursor (delivery_source_id, last_seq, updated_at)
+                VALUES (?, ?, ?)
+                ON CONFLICT(delivery_source_id) DO UPDATE SET
+                    last_seq = CASE
+                        WHEN excluded.last_seq > registry_delivery_import_cursor.last_seq
+                        THEN excluded.last_seq
+                        ELSE registry_delivery_import_cursor.last_seq
+                    END,
+                    updated_at = excluded.updated_at
+            `).run(deliverySourceId, maxSeq, now);
+            return { imported, lastSeq: maxSeq };
+        });
+
+        return importPage(events);
+    }
+
+    public cleanupOldDeliveryEvents(daysToKeep = 90): number {
+        const deliverySourceId = this.getGlobalSettings().delivery_source_id;
+        if (!deliverySourceId) return 0;
+
+        const cutoff = Date.now() - (daysToKeep * 24 * 60 * 60 * 1000);
+        const maxPruned = this.db.prepare(`
+            SELECT MAX(seq) as maxSeq FROM registry_delivery_events
+            WHERE delivery_source_id = ? AND created_at < ?
+        `).get(deliverySourceId, cutoff) as { maxSeq: number | null } | undefined;
+        const prunedThrough = maxPruned?.maxSeq ?? null;
+        if (prunedThrough === null) return 0;
+
+        const result = this.db.prepare(`
+            DELETE FROM registry_delivery_events
+            WHERE delivery_source_id = ? AND created_at < ?
+        `).run(deliverySourceId, cutoff);
+
+        if (result.changes > 0) {
+            this.insertRegistryDeliveryEvent({
+                deliverySourceId,
+                eventType: 'retention_gap',
+                prunedThroughSeq: prunedThrough,
+            });
+        }
+        return result.changes;
+    }
+
     public getAuditLogsInRange(from: number, to: number, limit?: number): AuditLogEntry[] {
         this.flushAuditLogBuffer();
         if (limit !== undefined) {