feat: deploy HoloLake mobile capabilities safely

server-tools/lake-lamp-authz/install-architecture-provisioner.test.js

@@ -0,0 +1,40 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const source = fs.readFileSync(
+  path.join(__dirname, "install-architecture-provisioner.sh"),
+  "utf8",
+);
+
+test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
+  for (const file of [
+    "server.js",
+    "guanghu-router.js",
+    "repo-push-broker.js",
+    "hololake-session.js",
+    "hololake-capabilities.js",
+  ]) {
+    assert.match(source, new RegExp(`\\b${file.replaceAll(".", "\\.")}\\b`));
+  }
+  assert.match(source, /HOLOLAKE_SESSION_PEPPER/);
+  assert.match(source, /openssl rand -hex 32/);
+  assert.match(source, /manual-backups\/lake-lamp-authz-/);
+  assert.match(source, /rollback\(\)/);
+  assert.match(source, /setfacl -R -m u:guanghu-authz:rX/);
+  assert.doesNotMatch(source, /cat ["']?\$authorization_env/);
+  assert.doesNotMatch(source, /set -x/);
+});
+
+test("provider migration writes only a private registry and never prints API keys", () => {
+  assert.match(source, /DEEPSEEK_API_KEY/);
+  assert.match(source, /OPENAI_API_KEY/);
+  assert.match(source, /DASHSCOPE_API_KEY/);
+  assert.match(source, /chmod 0640 "\$provider_registry"/);
+  assert.match(source, /chown root:guanghu-authz "\$provider_registry"/);
+  assert.doesNotMatch(source, /echo .*API_KEY/);
+  assert.doesNotMatch(source, /printf .*API_KEY/);
+});