@bongos/core 1.19.1079 → 1.19.1081

package/docs/api/openapi.json

@@ -14645,6 +14645,69 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/render": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_render",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/render",
+        "description": "POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY: the key is the owner's and so is the account it acts in, so an archon on someone else's project gets the same 404 as a stranger. The reply is a receipt; nothing has happened on Render when it is sent.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/render-standup.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesIdRenderRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdRenderResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/repo-private": {
       "post": {
         "operationId": "post_provisioning_instances_id_repo_private",
@@ -26353,6 +26416,66 @@
           "expires_at"
         ]
       },
+      "PostProvisioningInstancesIdRenderRequest": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "owner_id": {
+            "type": "string",
+            "maxLength": 80
+          },
+          "mode": {
+            "type": "string",
+            "maxLength": 20
+          },
+          "service_id": {
+            "type": "string",
+            "maxLength": 80
+          },
+          "web_plan": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "db_plan": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "region": {
+            "type": "string",
+            "maxLength": 40
+          }
+        },
+        "required": [
+          "key",
+          "owner_id",
+          "mode"
+        ],
+        "additionalProperties": false
+      },
+      "PostProvisioningInstancesIdRenderResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "queued": {
+            "type": "boolean"
+          },
+          "action": {},
+          "mode": {},
+          "message": {}
+        },
+        "required": [
+          "ok",
+          "queued",
+          "action",
+          "mode",
+          "message"
+        ]
+      },
       "PostProvisioningInstancesIdRepoPrivateResponse": {
         "type": "object",
         "properties": {
@@ -28072,9 +28195,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 439,
-  "x-schema-count": 471,
+  "x-endpoint-count": 440,
+  "x-schema-count": 473,
   "x-undocumented-bodies": 11,
-  "x-response-schemas": 322,
+  "x-response-schemas": 323,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 439 endpoints across 75 route files.
+> **Generated from the live route files** — the route file is authoritative. 440 endpoints across 76 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -538,7 +538,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: invite a builder into a project (ADR 0141 §5, task 1002115), called by a `project.curate` holder OR the project's… |
 
-## `provisioning` (31)
+## `provisioning` (32)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -563,6 +563,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | GET | `/api/bongos/provisioning/instances/:id/invite-suggestions` | `any-builder` | — | ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the … |
+| POST | `/api/bongos/provisioning/instances/:id/render` | `any-builder` | `key`, `owner_id`, `mode`, `service_id`, `web_plan`, `db_plan`, `region` | POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY: the key is the owner's and so is the account i… |
 | POST | `/api/bongos/provisioning/instances/:id/repo-private` | `any-builder` | validated | POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and OWNER ONLY: no archon override, because the runner f… |
 | POST | `/api/bongos/provisioning/instances/:id/restart` | `any-builder` | — | POST /provisioning/instances/:id/restart — restart an ACTIVE project the heartbeat cannot reach (task 1003238). |
 | GET | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | — | GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). |

package/docs/architecture.md

@@ -261,7 +261,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Authenticated CLI/web: `GET /me` (returns `rank`), `GET /versions[/progress]`, `GET /tasks[?version=&status=&kind=&discipline=]`, `GET /tasks/claimable[?version=&discipline=]`, `GET /tasks/:id`, `POST /tasks` (accepts `discipline` + `criterion_ids`; **metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)), `PATCH /tasks/:id` (supports `parent_task_id`, `kind`, `discipline`, `goal_id` — (re)assign the task's goal; must be a goal in the task's own version, task 1763; **metic+**), `POST /tasks/:id/promote` (**metic+**), `POST /claims`, `POST /claims/:id/resolve`, `POST /cost`.
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
 - Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under `var/module-store/` and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
-- Module store install (ADR 0338 D1, task 1003785), all `requireBuilder` and own-scoped (the holder is the caller): `POST /store/modules/:key/acquire` (`{version?}`; grants a free entitlement — no price row, or a zero price, is free — or `402 payment_required` for a priced module; refuses a delisted one), `GET /store/modules/:key/versions/:version/tarball` (served only to a live entitlement holder; `X-Tarball-Sha256`), `POST /store/modules/:key/acquired` (`{version}` → `recordAcquired`). Read side in `src/bongos/module-store.js` (`resolveAcquirable`, `isFreePrice`, `versionArtifactFile`). No channel check yet (tasks 1003815, 1003805).
+- Module store install (ADR 0338 D1, task 1003785), all `requireBuilder` and own-scoped (the holder is the caller): `POST /store/modules/:key/acquire` (`{version?}`; grants a free entitlement — no price row, or a zero price, is free — or `402 payment_required` for a priced module; refuses a delisted one), `GET /store/modules/:key/versions/:version/tarball` (served only to a live entitlement holder; `X-Tarball-Sha256`), `POST /store/modules/:key/acquired` (`{version}` → `recordAcquired`). Read side in `src/bongos/module-store.js` (`resolveAcquirable`, `isFreePrice`, `versionArtifactFile`). No channel check yet (tasks 1003815, 1003805). `bongos module update` (task 1003786) reuses the same three calls; the acquire route reads price only for a caller with no entitlement, so a holder is never charged again.
 - Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a checkout with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (no authenticated `gh` on the machine, or `<PREFIX>_PUSH_VIA_SERVER=1`); a machine with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
 - Archon monitoring reads backing the `/watch` page (ADR 0036): `GET /builders/roster`, `GET /grades/by-builder[?days=N]` (**archon-only**, [#726](https://example.com/builders#/task/726) — per-builder grade breakdown for the MARKS section; the project-wide aggregate stays public at `/public/grades`), `GET /audit-log`, `GET /override-requests`, `GET /access-requests`, `GET /security/reports`. Personal-prefs writes backing `/settings`: `GET/PATCH /me/skill-prefs`, `PATCH /me/disciplines`.
 - Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).

package/docs/module-api-changelog.md

@@ -2649,5 +2649,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1077 with no explicit bump. run 36600137276. (task 1002620)
   1.19.1079 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1078 with no explicit bump. run 36602720244. (task 1002620)
+  1.19.1080 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1079 with no explicit bump. run 36638268217. (task 1002620)
+  1.19.1081 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1080 with no explicit bump. run 36639564721. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -364,9 +364,15 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - The download is checked with `verifyModuleArtifact`, the same checker the store runs on publish, and must match the version and hashes the store described. A failed check places nothing.
 - A module with no price, or a zero price, is free and granted on the spot. A priced one answers 402 until buying exists (area 8). An entitlement is kept for good, even if a price is added later (ADR 0338 D2).
 - Install never enables. Switch the module on from the hall's Modules tab.
-- A module already on disk is refused; moving one to a newer version is `update`. A module this core cannot mount is refused before download.
+- A module already on disk, in the instance's `modules/` or bundled with the core, is refused; moving one to a newer version is `update`. A module this core cannot mount is refused before download.
 - A delisted module cannot be acquired or downloaded. Channels are not checked yet: every version is general until the channel tasks land.
 
+`bongos module update <key> [--version X.Y.Z]` moves an installed store module forward through the same three calls, so a paid module and a free one take one identical path, and a module you already hold is never charged again (`tests/module_update.mjs` fails if a price-conditional branch appears).
+
+- With no `--version` it takes the newest, and says "up to date" without downloading when that isn't newer. An older `--version` is refused: update only moves forward.
+- The new version is written beside the old one and swapped in; any failure leaves the installed version in place. Files the new version dropped are gone afterwards.
+- The on/off switch is untouched. A module bundled with the core is refused; it updates with the core (`bongos upgrade`).
+
 ## Carving an existing core domain (the `db.js` per-domain pattern)
 
 Most BONGOS-V1 module work is not scaffolding a *new* module — it's **carving an existing core domain out of the monolith** (ADR 0091, criterion C7). The reference carve is the kernel slice `src/bongos/db-kernel.js` (BV1.R69); the feature precedents are `modules/discord/db.js` + `modules/game/db.js`. Every later carve (memory R72, grading R73, …) copies this recipe. The invariant is **OTB byte-identical** at every step — you are *moving* code, not changing behavior.

package/modules/provisioning/migrations/provisioning_028_render_standup.sql

@@ -0,0 +1,46 @@
+-- provisioning_028_render_standup.sql — the Render standup leg (task 1004183; ADR 0327, ADR 0345).
+--
+-- WHY THIS EXISTS. A project's owner lends the platform their Render API key once, so the
+-- runner can create their services on THEIR Render account. Nothing afterwards needs the
+-- key (ADR 0327 §2), so it is never stored — but it must still cross from the web tier,
+-- which receives it, to the runner, which spends it. It rides the intent that asks for the
+-- standup, encrypted with src/bongos/secret-box.js, and the runner clears it within the
+-- drain that claims the intent, whether the standup worked or not.
+--
+-- What the encryption buys, said plainly: it protects the key from a database dump or a
+-- nightly backup taken while the intent waits. It does NOT defend against a compromised web
+-- tier — the key arrives there in plaintext before anything can encrypt it.
+--
+-- WHAT IT ADDS.
+--   provisioning_intents.borrowed_key_enc — the encrypted key, only while the intent is
+--     open. The CHECK below is the backstop: a resolved intent CANNOT keep a key, so a
+--     resolution path that forgets to clear it fails loudly instead of leaving it behind.
+--   provisioning_instances.app_host — where the project's app runs and what the platform
+--     needs to know about it afterwards: {platform, mode, ownerId, serviceId, postgresId,
+--     serviceUrl, webPlan, dbPlan, region, state, error}. Ids, plans and a URL — never the
+--     key and never an env var value. One jsonb column rather than a column per field so
+--     a second platform is an added option (ADR 0345 D3), not a second schema change.
+--     publicInstance() is an allow-list and does not carry it.
+--   'render-standup' in the intents' action allow-list.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS borrowed_key_enc text;
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_borrowed_key_open_only;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_borrowed_key_open_only
+  CHECK (borrowed_key_enc IS NULL OR state IN ('pending', 'running'));
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS app_host jsonb;
+
+-- INTENT_ACTIONS in modules/provisioning/provisioning.js is the other spelling of this list;
+-- tests/provisioning_restart.mjs and tests/core_upgrade_door.mjs fail if the two disagree.
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight', 'repo-private', 'render-standup'));
+
+COMMIT;

package/modules/provisioning/module.json

@@ -18,7 +18,8 @@
       "disconnect",
       "core-upgrade",
       "env-manifest",
-      "repo-private"
+      "repo-private",
+      "render-standup"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/provisioning.js

@@ -59,7 +59,7 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
 // 'core-upgrade' (task 1003159, ADR 0293): move this instance's core pin — the owner's
 // deploy door. The web tier only QUEUES it; the control-plane runner performs it.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private'];
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private', 'render-standup'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1168,9 +1168,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 async function enqueueTeardown(db, instanceId, requestedBy) {
   const { rows: superseded } = await db.query(
     `UPDATE provisioning_intents
-        SET state = 'error', last_error = 'superseded: teardown requested',
+        SET state = 'error', last_error = 'superseded: teardown requested', borrowed_key_enc = NULL,
             updated_at = now(), resolved_at = now()
-      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
+      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup') AND state = 'pending'
         AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
@@ -1248,8 +1248,8 @@ async function claimNextIntent(db) {
 async function resolveIntent(db, id, state, lastError) {
   await db.query(
     `UPDATE provisioning_intents
-        SET state = $2, last_error = $3, updated_at = now(), resolved_at = now()
-      WHERE id = $1`,
+        SET state = $2, last_error = $3, borrowed_key_enc = NULL, updated_at = now(), resolved_at = now()
+      WHERE id = $1`, // a resolved intent never keeps a borrowed key (task 1004183; the table's CHECK is the backstop)
     [id, state, lastError ?? null]
   );
 }

package/modules/provisioning/render-standup.js

@@ -0,0 +1,91 @@
+// modules/provisioning/render-standup.js — the queue half of "set this project up on my
+// Render account" (task 1004183; ADR 0327, ADR 0345).
+//
+// The web tier never calls Render (ADR 0111 §2): it checks the SHAPE of what the owner
+// sent, encrypts their key, and queues a `render-standup` intent carrying it. The runner
+// leg, scripts/gds/provision-render.js, spends the key in one drain and clears it.
+//
+// What the encryption buys, said plainly: it protects the key from a database dump or a
+// nightly backup while the intent waits for the runner. It does NOT defend against a
+// compromised web tier — the key arrives here in plaintext before anything can encrypt
+// it. Nothing here stores the key anywhere else, logs it, or sends it back.
+//
+// Its own file because provisioning.js sits at the size ratchet.
+'use strict';
+
+// The plan and region vocabulary — shared with the runner's payload builder, which
+// requires it from here, so the web tier and the runner can never disagree on a name.
+const WEB_PLANS = ['starter', 'standard', 'pro', 'pro_plus', 'pro_max', 'pro_ultra'];
+const DB_PLANS = ['basic_256mb', 'basic_1gb', 'basic_4gb', 'pro_4gb', 'pro_8gb'];
+const REGIONS = ['virginia', 'ohio', 'oregon', 'frankfurt', 'singapore'];
+const MODES = ['adopt', 'greenfield'];
+
+// Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
+// one); services `srv-…`. Shape checks only — whether the key works, and whether it can
+// reach the workspace, is the runner's to find out, because only the runner calls Render.
+const KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
+const OWNER_RE = /^(tea|usr)-[a-z0-9]{8,64}$/;
+const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
+
+// The reason a request cannot be queued, in the owner's words, or null. `body` is the
+// validated request body.
+function badRequest(body) {
+  const b = body || {};
+  if (!KEY_RE.test(String(b.key || ''))) return 'That doesn’t look like a Render API key. It starts with “rnd_” — create one under Account Settings → API Keys in Render.';
+  if (!OWNER_RE.test(String(b.owner_id || ''))) return 'Choose the Render workspace to use. Its id starts with “tea-” or “usr-”.';
+  if (!MODES.includes(b.mode)) return 'Say whether to link a Render service you already have, or create a new one.';
+  if (b.mode === 'adopt' && !SERVICE_RE.test(String(b.service_id || ''))) return 'Choose the Render service to link. Its id starts with “srv-”.';
+  if (b.mode === 'greenfield' && b.service_id) return 'A new setup creates its own service, so leave the service out.';
+  if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
+  if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;
+  if (b.region != null && !REGIONS.includes(b.region)) return `“${b.region}” is not a Render region.`;
+  return null;
+}
+
+// What the row records about the request — ids and plans, never the key.
+function appHostFrom(body) {
+  const h = { platform: 'render', mode: body.mode, ownerId: body.owner_id, state: 'requested', error: null };
+  if (body.mode === 'adopt') h.serviceId = body.service_id;
+  if (body.web_plan) h.webPlan = body.web_plan;
+  if (body.db_plan) h.dbPlan = body.db_plan;
+  if (body.region) h.region = body.region;
+  return h;
+}
+
+// Queue the standup with the encrypted key, and record the request on the row, in ONE
+// statement: either both land or neither does. A re-request for the same workspace and
+// mode keeps the ids an earlier run recorded, so the runner resumes onto what already
+// exists; a different workspace or mode starts clean, because ids from another workspace
+// would only trip the runner's guard.
+//
+// The partial unique index ux_provisioning_intents_open is the arbiter: if anything is
+// already open for this project the insert collides and NOTHING is written — the key is
+// not stored and the row is not touched. Returns { intent } or { conflict: 'open_intent',
+// intent } with the blocking one.
+async function enqueueRenderStandup(db, instanceId, { keyEnc, appHost, requestedBy }) {
+  await require('./control-plane-guard').assertIntentAllowed(db, instanceId, 'render-standup');
+  try {
+    const { rows } = await db.query(
+      `WITH i AS (
+         INSERT INTO provisioning_intents (instance_id, action, requested_by, state, borrowed_key_enc)
+         VALUES ($1, 'render-standup', $2, 'pending', $3) RETURNING *
+       ), u AS (
+         UPDATE provisioning_instances
+            SET app_host = CASE WHEN app_host->>'ownerId' = $5 AND app_host->>'mode' = $6 THEN app_host ELSE '{}'::jsonb END || $4::jsonb
+          WHERE id = $1 RETURNING id
+       )
+       SELECT i.id, i.instance_id, i.action, i.state, i.created_at FROM i`,
+      [instanceId, requestedBy ?? null, keyEnc, JSON.stringify(appHost), appHost.ownerId, appHost.mode]);
+    return { intent: rows[0] };
+  } catch (e) {
+    if (e && e.code === '23505') {
+      const { rows } = await db.query(
+        `SELECT id, action, state FROM provisioning_intents
+          WHERE instance_id = $1 AND state IN ('pending', 'running') ORDER BY created_at DESC LIMIT 1`, [instanceId]);
+      return { conflict: 'open_intent', intent: rows[0] || { action: 'unknown', state: 'open' } };
+    }
+    throw e;
+  }
+}
+
+module.exports = { WEB_PLANS, DB_PLANS, REGIONS, MODES, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/provisioning/routes/render-standup.js

@@ -0,0 +1,90 @@
+// modules/provisioning/routes/render-standup.js — POST /provisioning/instances/:id/render
+// (task 1004183; ADR 0327, ADR 0345).
+//
+// The owner lends their Render API key once, names the workspace, and says whether to link
+// a service they already run (adopt) or create a new one (greenfield). This route checks
+// the shape, encrypts the key with the secret box, and queues a `render-standup` intent;
+// the runner (scripts/gds/provision-render.js) spends the key in one drain and clears it.
+// This process never calls Render (ADR 0111 §2).
+//
+// What the encryption buys, said plainly: protection from a database dump or a backup
+// while the intent waits. Not from a compromised web tier — the key is in plaintext here
+// before it is encrypted. The key is never logged, never stored anywhere else, and never
+// sent back.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/repo-private.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const renderStandup = require('../render-standup');
+const { failFrom } = require('../public-refusal');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse about the PROJECT, answered here so the owner hears it
+// before lending a key. The runner keeps its own checks.
+function unavailableReason(inst, mode) {
+  if (inst.status === 'torn_down' || inst.status === 'tearing_down') return 'This project has been removed, so it can’t be set up on Render.';
+  if (mode === 'greenfield' && !inst.target_ref) return 'This project has no GitHub repository linked, so Render has nothing to build.';
+  return null;
+}
+
+module.exports = function buildRenderStandupRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
+  // ONLY: the key is the owner's and so is the account it acts in, so an archon on
+  // someone else's project gets the same 404 as a stranger. The reply is a receipt;
+  // nothing has happened on Render when it is sent.
+  router.post('/provisioning/instances/:id/render', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      owner_id: { required: true, type: 'string', maxLength: 80 },
+      mode: { required: true, type: 'string', maxLength: 20 },
+      service_id: { type: 'string', maxLength: 80 },
+      web_plan: { type: 'string', maxLength: 40 },
+      db_plan: { type: 'string', maxLength: 40 },
+      region: { type: 'string', maxLength: 40 },
+    })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      const bad = renderStandup.badRequest(req.body);
+      if (bad) return res.fail('render_request_invalid', { status: 400, message: bad });
+      const why = unavailableReason(inst, req.body.mode);
+      if (why) return res.fail('render_unavailable', { status: 409, message: why, details: { status: inst.status } });
+      if (!api.secretBox.isConfigured()) {
+        return res.fail('render_unavailable', { status: 503, message: 'The platform can’t take a key safely right now, so nothing was sent. Try again later.' });
+      }
+      const appHost = renderStandup.appHostFrom(req.body);
+      const r = await renderStandup.enqueueRenderStandup(pool, id, {
+        keyEnc: api.secretBox.encrypt(req.body.key), appHost, requestedBy: 'api:self',
+      });
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project, so your key was not kept. Try again once it has finished.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-standup',
+        detail: `Render ${appHost.mode === 'adopt' ? 'link' : 'setup'} requested by owner (workspace ${appHost.ownerId})`, actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, queued: true, action: 'render-standup', mode: appHost.mode,
+        message: appHost.mode === 'adopt'
+          ? 'Queued. The platform will check the service in your Render account and link it, without changing anything there. Your key is used once and then thrown away.'
+          : 'Queued. The platform will create your database and web service in your Render account. Your key is used once and then thrown away; Render bills you directly.' });
+    } catch (err) {
+      // Never log the request: it carries the key.
+      log.error('[provisioning] POST /provisioning/instances/:id/render', err && err.message);
+      failFrom(res, err, 'render_standup_failed');
+    }
+  });
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1079",
+  "version": "1.19.1081",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1079",
+      "version": "1.19.1081",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1079",
+  "version": "1.19.1081",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -29,6 +29,6 @@
     "pino": "^9.14.0"
   },
   "overrides": {
-    "undici": "^6.28.0"
+    "undici": "^6.28.1"
   }
 }

package/release-notes.json

@@ -7867,5 +7867,21 @@
       "id": "1003785",
       "text": "You can now install a module from the store with one command. It checks the download is exactly what was published and never switches the module on by itself. Modules without a price are free."
     }
+  ],
+  "1.19.1080": [
+    {
+      "id": "1003786",
+      "text": "Installed modules can now be updated with one command. Paid and free modules update the exact same way, you are never charged twice, and a failed update leaves your working version in place."
+    }
+  ],
+  "1.19.1081": [
+    {
+      "id": "1004183",
+      "text": "Bongos can now set a project up on its owner's own Render account. The owner lends their Render key once; it is used for that one run and then erased, and it can never act in a workspace the owner did not name. Linking an exis"
+    },
+    {
+      "id": "1004364",
+      "text": "Every module in the store will now come with a how-to guide. Publishing is refused without one, and an AI gives each guide a Docs score that buyers can see next to the module's other scores."
+    }
   ]
 }