@bongos/core 1.19.1079 → 1.19.1081

package/scripts/gds/module.js

@@ -61,6 +61,7 @@
 //   bongos upgrade                     pre-check enabled modules vs the core version
 //   bongos module check <key> [--sign-off "Name <email>"]   AGPL/publish pre-check + DCO sign-off
 //   bongos module install <key> [--version X.Y.Z]   acquire from the store, verify, place (not enabled)
+//   bongos module update <key> [--version X.Y.Z]    move an installed store module forward
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -925,30 +926,104 @@ function placeModule(files, target) {
   }
 }
 
+// Every discovery root the loader scans (core + instance, ADR 0108 §1). A key on
+// disk in ANY of them is already taken: the loader treats a repeated key as a hard
+// error, so placing a second copy in the instance root would break boot.
+function discoveryRoots() {
+  return require('../../src/module-loader/loader').DEFAULT_ROOTS;
+}
+
+// Parse `<key> [--version X.Y.Z]` for install and update. Returns { key, wanted }
+// or { code } (2 = usage) after printing why.
+function parseStoreArgs(args, verb, errlog) {
+  const usage = `usage: bongos module ${verb} <key> [--version X.Y.Z]`;
+  const vIdx = args.indexOf('--version');
+  const wanted = vIdx !== -1 ? args[vIdx + 1] : null;
+  const key = args.find((a, i) => !a.startsWith('-') && args[i - 1] !== '--version');
+  if (!key || (vIdx !== -1 && (!wanted || wanted.startsWith('--')))) { errlog(usage); return { code: 2 }; }
+  if (!KEY_RE.test(key)) { errlog(`REFUSING: "${key}" is not a module key (lowercase kebab-case).`); return { code: 2 }; }
+  const { parseVersion } = require('../../src/module-loader/semver');
+  if (wanted && !parseVersion(wanted)) { errlog(`REFUSING: --version must be exact X.Y.Z, not "${wanted}".`); return { code: 2 }; }
+  return { key, wanted };
+}
+
+// The one acquisition path install AND update share (task 1003786): acquire, check
+// the version can mount on this core, download, verify with verifyModuleArtifact and
+// hold the bytes to what the store described. Nothing here reads a price or branches
+// on how the module was obtained — the store decides entitlement, and a holder it has
+// already granted (for any reason) is never asked again. tests/module_update.mjs
+// fails if a price-conditional branch appears in this path.
+//
+// `shouldDownload(described)` lets update stop before the download when the store's
+// version is not newer than what is installed. Resolves { ok, described, verified }
+// or { ok: false, code, upToDate? } after printing why.
+async function fetchVerified(key, { wanted, call, core, log, errlog, verb, shouldDownload = () => true }) {
+  const fail = (code, msg) => { if (msg) errlog(msg); return { ok: false, code }; };
+  const enc = encodeURIComponent(key);
+  let acq;
+  try { acq = await call('POST', `/store/modules/${enc}/acquire`, { json: wanted ? { version: wanted } : {} }); }
+  catch (e) { return fail(1, `bongos module ${verb}: the store could not be reached — ${e.message}`); }
+  if (!acq.ok) return fail(1, `REFUSING: the store would not hand over "${key}" (HTTP ${acq.status}): ${storeError(acq)}`);
+  const described = acq.data;
+  log(`bongos module ${verb} — "${key}" ${described.version} (needs core ${described.core_version})`);
+
+  const stop = shouldDownload(described);
+  if (stop !== true) return { ok: false, code: stop.code, upToDate: stop.upToDate };
+
+  const { satisfies } = require('../../src/module-loader/semver');
+  const coreV = core || require('../../src/module-api').CORE_VERSION;
+  if (!satisfies(coreV, described.core_version)) {
+    return fail(1, `REFUSING: "${key}" ${described.version} needs core ${described.core_version}; this core is ${coreV}, so it could not mount.`);
+  }
+
+  let dl;
+  try { dl = await call('GET', `/store/modules/${enc}/versions/${encodeURIComponent(described.version)}/tarball`, { binary: true }); }
+  catch (e) { return fail(1, `bongos module ${verb}: download failed — ${e.message}`); }
+  if (!dl.ok) return fail(1, `REFUSING: the download was refused (HTTP ${dl.status}): ${storeError(dl)}`);
+
+  const artifact = require('./module-artifact');
+  const verified = await artifact.verifyModuleArtifact(dl.buf, { key, includeFiles: true });
+  if (!verified.ok) return fail(1, `REFUSING: the downloaded tarball failed verification (${verified.code}): ${verified.message}`);
+  if (verified.version !== described.version || verified.tarballSha256 !== described.tarball_sha256 || verified.treeSha256 !== described.tree_sha256) {
+    return fail(1, `REFUSING: the download is not the ${described.version} the store described (version or hash differs).`);
+  }
+  log(`  ✓ verified ${verified.files.length} file(s), ${verified.bytes} bytes — tree ${verified.treeSha256.slice(0, 12)}…`);
+  return { ok: true, described, verified };
+}
+
+// Tell the store which exact version was placed. A failure here never undoes the
+// placement: the files are good, and the next install or update records it.
+async function recordPlaced(key, version, { call, errlog, verb }) {
+  let rec;
+  try { rec = await call('POST', `/store/modules/${encodeURIComponent(key)}/acquired`, { json: { version } }); }
+  catch (e) { rec = { ok: false, status: 0, data: { error: { message: e.message } } }; }
+  if (!rec.ok) {
+    errlog(`WARNING: "${key}" is ${verb === 'update' ? 'updated' : 'installed'}, but the store did not record the version (${storeError(rec)}). Nothing is lost; the next install or update records it.`);
+    return false;
+  }
+  return true;
+}
+
 // `bongos module install <key> [--version X.Y.Z]` — task 1003785. Acquires the
 // module (a free one is granted on the spot; a priced one waits on the buy action,
 // area 8), downloads its tarball, verifies it with verifyModuleArtifact — the one
 // checker the store itself uses on publish — and places it under the instance's
 // modules/. It never enables: the loader discovers what is on disk and the hall's
-// Modules tab decides what mounts. A module already on disk is refused; moving an
-// installed module to a newer version is `update` (task 1003786).
+// Modules tab decides what mounts. A key already on disk in ANY discovery root is
+// refused; moving an installed module to a newer version is `update` (task 1003786).
 async function cmdInstall(args, {
   log = console.log, errlog = console.error,
-  modulesDir, request, core,
+  modulesDir, roots, request, core,
 } = {}) {
-  const usage = 'usage: bongos module install <key> [--version X.Y.Z]';
-  const vIdx = args.indexOf('--version');
-  const wanted = vIdx !== -1 ? args[vIdx + 1] : null;
-  const key = args.find((a, i) => !a.startsWith('-') && args[i - 1] !== '--version');
-  if (!key || (vIdx !== -1 && (!wanted || wanted.startsWith('--')))) { errlog(usage); return 2; }
-  if (!KEY_RE.test(key)) { errlog(`REFUSING: "${key}" is not a module key (lowercase kebab-case).`); return 2; }
-  const { parseVersion, satisfies } = require('../../src/module-loader/semver');
-  if (wanted && !parseVersion(wanted)) { errlog(`REFUSING: --version must be exact X.Y.Z, not "${wanted}".`); return 2; }
+  const parsed = parseStoreArgs(args, 'install', errlog);
+  if (parsed.code) return parsed.code;
+  const { key, wanted } = parsed;
 
   const dir = modulesDir || instanceModulesDir();
   const target = path.join(dir, key);
-  if (fs.existsSync(target)) {
-    errlog(`REFUSING: "${key}" is already on disk at ${target}. Install only adds a new module; updating one is a separate command.`);
+  const taken = [dir, ...(roots || discoveryRoots())].map((r) => path.join(r, key)).find((p) => fs.existsSync(p));
+  if (taken) {
+    errlog(`REFUSING: "${key}" is already on disk at ${taken}. Install only adds a new module; to move an installed one forward, run \`bongos module update ${key}\`.`);
     return 1;
   }
 
@@ -956,47 +1031,99 @@ async function cmdInstall(args, {
   try { call = request || storeRequest(); }
   catch (e) { errlog(`bongos module install: ${e.message}`); return 1; }
 
-  const enc = encodeURIComponent(key);
-  let acq;
-  try { acq = await call('POST', `/store/modules/${enc}/acquire`, { json: wanted ? { version: wanted } : {} }); }
-  catch (e) { errlog(`bongos module install: the store could not be reached — ${e.message}`); return 1; }
-  if (!acq.ok) { errlog(`REFUSING: the store would not hand over "${key}" (HTTP ${acq.status}): ${storeError(acq)}`); return 1; }
-  const a = acq.data;
-  log(`bongos module install — "${key}" ${a.version} (needs core ${a.core_version})`);
+  const got = await fetchVerified(key, { wanted, call, core, log, errlog, verb: 'install' });
+  if (!got.ok) return got.code;
 
-  const coreV = core || require('../../src/module-api').CORE_VERSION;
-  if (!satisfies(coreV, a.core_version)) {
-    errlog(`REFUSING: "${key}" ${a.version} needs core ${a.core_version}; this core is ${coreV}, so it could not mount.`);
-    return 1;
-  }
+  try { placeModule(got.verified.files, target); }
+  catch (e) { errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
+  log(`  ✓ placed at ${target}`);
 
-  let dl;
-  try { dl = await call('GET', `/store/modules/${enc}/versions/${encodeURIComponent(a.version)}/tarball`, { binary: true }); }
-  catch (e) { errlog(`bongos module install: download failed — ${e.message}`); return 1; }
-  if (!dl.ok) { errlog(`REFUSING: the download was refused (HTTP ${dl.status}): ${storeError(dl)}`); return 1; }
+  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'install' }))) return 1;
+  log(`\n✓ Installed "${key}" ${got.described.version}. It is not switched on: enable it from the hall's Modules tab when you want it.`);
+  return 0;
+}
 
-  const artifact = require('./module-artifact');
-  const v = await artifact.verifyModuleArtifact(dl.buf, { key, includeFiles: true });
-  if (!v.ok) { errlog(`REFUSING: the downloaded tarball failed verification (${v.code}): ${v.message}`); return 1; }
-  if (v.version !== a.version || v.tarballSha256 !== a.tarball_sha256 || v.treeSha256 !== a.tree_sha256) {
-    errlog(`REFUSING: the download is not the ${a.version} the store described (version or hash differs).`);
-    return 1;
+// Replace an installed module's directory with a verified new one. The new files
+// are written to a staging dir first; the old dir is moved aside, the new one moved
+// in, and only then is the old one removed — so a failure at any step leaves the
+// previous version in place, never a half-written or missing module.
+function replaceModule(files, target) {
+  const aside = `${target}.previous-${process.pid}-${Date.now()}`;
+  const staging = `${target}.installing-${process.pid}-${Date.now()}`;
+  placeModule(files, staging);
+  try {
+    fs.renameSync(target, aside);
+  } catch (e) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw e;
+  }
+  try {
+    fs.renameSync(staging, target);
+  } catch (e) {
+    fs.renameSync(aside, target);
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw e;
   }
-  log(`  ✓ verified ${v.files.length} file(s), ${v.bytes} bytes — tree ${v.treeSha256.slice(0, 12)}…`);
+  fs.rmSync(aside, { recursive: true, force: true });
+}
 
-  try { placeModule(v.files, target); }
-  catch (e) { errlog(`bongos module install: could not place the module — ${e.message}`); return 1; }
-  log(`  ✓ placed at ${target}`);
+// `bongos module update <key> [--version X.Y.Z]` — task 1003786. Moves an installed
+// store module forward, through exactly the acquisition path install uses
+// (fetchVerified): the same calls whether the module was free or paid, and a module
+// the caller already holds is never charged again (the store's acquire route only
+// looks at price for a caller with no entitlement). Only forward: with no --version
+// it takes the newest, and says so without downloading when that is not newer; an
+// older --version is refused, since rolling back is a different act. Like install it
+// never enables or disables — the module keeps whatever switch it had.
+async function cmdUpdate(args, {
+  log = console.log, errlog = console.error,
+  modulesDir, roots, request, core,
+} = {}) {
+  const parsed = parseStoreArgs(args, 'update', errlog);
+  if (parsed.code) return parsed.code;
+  const { key, wanted } = parsed;
 
-  let rec;
-  try { rec = await call('POST', `/store/modules/${enc}/acquired`, { json: { version: a.version } }); }
-  catch (e) { rec = { ok: false, status: 0, data: { error: { message: e.message } } }; }
-  if (!rec.ok) {
-    errlog(`WARNING: "${key}" is installed, but the store did not record the version (${storeError(rec)}). Nothing is lost; the next install or update records it.`);
+  const dir = modulesDir || instanceModulesDir();
+  const target = path.join(dir, key);
+  if (!fs.existsSync(path.join(target, 'module.json'))) {
+    const bundled = (roots || discoveryRoots()).map((r) => path.join(r, key)).find((p) => p !== target && fs.existsSync(p));
+    errlog(bundled
+      ? `REFUSING: "${key}" at ${bundled} comes with the core, not the store. It updates when the core does (\`bongos upgrade\`).`
+      : `REFUSING: "${key}" is not installed here. Run \`bongos module install ${key}\` first.`);
     return 1;
   }
+  const { parseVersion, cmp } = require('../../src/module-loader/semver');
+  let installed;
+  try { installed = JSON.parse(fs.readFileSync(path.join(target, 'module.json'), 'utf8')).version; }
+  catch (e) { errlog(`REFUSING: could not read the installed ${key}/module.json — ${e.message}`); return 1; }
+  const have = parseVersion(String(installed));
+  if (!have) { errlog(`REFUSING: the installed "${key}" has no exact version in module.json, so there is nothing to compare against.`); return 1; }
+  if (wanted && cmp(parseVersion(wanted), have) < 0) {
+    errlog(`REFUSING: ${wanted} is older than the installed ${installed}. Update only moves forward.`);
+    return 1;
+  }
+
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module update: ${e.message}`); return 1; }
+
+  const got = await fetchVerified(key, {
+    wanted, call, core, log, errlog, verb: 'update',
+    shouldDownload: (d) => {
+      const next = parseVersion(String(d.version));
+      if (next && cmp(next, have) > 0) return true;
+      log(`\n✓ "${key}" is up to date at ${installed}.`);
+      return { code: 0, upToDate: true };
+    },
+  });
+  if (!got.ok) return got.code;
+
+  try { replaceModule(got.verified.files, target); }
+  catch (e) { errlog(`bongos module update: could not replace the module, ${installed} is still in place — ${e.message}`); return 1; }
+  log(`  ✓ replaced ${installed} with ${got.described.version} at ${target}`);
 
-  log(`\n✓ Installed "${key}" ${a.version}. It is not switched on: enable it from the hall's Modules tab when you want it.`);
+  if (!(await recordPlaced(key, got.described.version, { call, errlog, verb: 'update' }))) return 1;
+  log(`\n✓ Updated "${key}" ${installed} → ${got.described.version}. Its on/off switch is unchanged.`);
   return 0;
 }
 
@@ -1015,6 +1142,8 @@ function printHelp(out = console.log) {
   out('                              Pack a module version (tarball + hash manifest) and upload it to the module store');
   out('  bongos module install <key> [--version X.Y.Z]');
   out('                              Acquire a module from the store, verify it and place it under modules/ (not enabled)');
+  out('  bongos module update <key> [--version X.Y.Z]');
+  out('                              Move an installed store module to a newer version (same path, paid or free)');
 }
 
 async function main(argv) {
@@ -1027,6 +1156,7 @@ async function main(argv) {
   if (sub === 'submit') return cmdSubmit(args.slice(1));
   if (sub === 'publish') return cmdPublish(args.slice(1));
   if (sub === 'install') return cmdInstall(args.slice(1));
+  if (sub === 'update') return cmdUpdate(args.slice(1));
   if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
     printHelp();
     return sub ? 0 : 2;
@@ -1037,7 +1167,7 @@ async function main(argv) {
 }
 
 module.exports = {
-  main, cmdNew, cmdList, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, printHelp,
+  main, cmdNew, cmdList, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
   gatherCatalog, formatCatalog, ownProjectName,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, buildManifest,
   formatMaintenanceHint, isPastRemoveAfter,

package/scripts/gds/provision-render.js

@@ -0,0 +1,158 @@
+'use strict';
+// provision-render.js — the Render standup leg: the runner half of the `render-standup`
+// intent (task 1004183; ADR 0327, ADR 0345). Its own file because provision.js sits at
+// the size ratchet; the dispatch there requires it inline.
+//
+// WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
+// lent for this one run:
+//   - ADOPT links a Render service the owner already runs. It reads that service through
+//     the workspace guard and records it. It makes NO write call to their account.
+//   - GREENFIELD creates the Postgres and the web service (render-payload.js decides what
+//     they are), sets the env vars that need the service's URL, and asks for a deploy.
+// Ids are written to the row as each resource is created, so an owner who re-enters their
+// key after a failure resumes onto what already exists instead of creating a second one.
+//
+// THE KEY IS BORROWED, NEVER STORED (ADR 0327 §2). It reaches this leg encrypted on the
+// intent (provisioning_intents.borrowed_key_enc). It is decrypted here, used for this run
+// only, and the column is cleared in a `finally` — on success, on a refusal and on a
+// throw. resolveIntent clears it again, and the table's CHECK refuses a resolved intent
+// that still holds one. What the encryption buys, said plainly: it protects the key from
+// a database dump or a nightly backup while the intent waits. It does NOT defend against
+// a compromised web tier — the key arrives there in plaintext before anything can
+// encrypt it.
+//
+// A FAILURE IS TERMINAL. Every failure returns `terminal: true`, so the runner retires the
+// intent instead of re-queuing it. There is no key left to retry with, and an unattended
+// retry holding someone else's cloud credential is not a thing this platform does: the
+// owner retries by entering their key again.
+//
+// Every Render call goes through scripts/gds/render-api.js, which pins the workspace and
+// asserts it on every response, and which cannot delete.
+
+const { RenderApi } = require('./render-api.js');
+const payload = require('./render-payload.js');
+const { parseTargetRef } = require('./provision-repo-auth.js');
+const { provisionedEnvPrefix } = require('./provision-units.js');
+
+// A key waiting longer than this was lent for a run that never came. It is refused and
+// cleared rather than spent late.
+const KEY_TTL_MS = 30 * 60 * 1000;
+
+function renderApiFor(deps, token, ownerId) {
+  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
+  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
+}
+
+// Merge `patch` into the row's app_host. The runner is the only writer while an intent
+// runs, and the web tier only writes it when enqueuing, which the open-intent index
+// serialises — so a merge needs no read-modify-write.
+async function recordAppHost(db, instId, patch) {
+  await db.query(
+    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
+    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
+}
+
+async function clearBorrowedKey(db, intentId) {
+  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
+}
+
+async function ownerLoginOf(db, inst) {
+  if (!inst.owner_builder_id) return null;
+  const { rows } = await db.query(`SELECT github_login FROM builders WHERE id = $1`, [inst.owner_builder_id]);
+  return (rows[0] && rows[0].github_login) || null;
+}
+
+async function adopt(api, inst, host, { db, log }) {
+  if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
+  const svc = await api.getService(host.serviceId);
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
+  log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
+  return { ok: true };
+}
+
+async function greenfield(api, inst, host, deps) {
+  const { db, log } = deps;
+  const plans = payload.plansFor(host);
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
+  const envPrefix = deps.envPrefix || provisionedEnvPrefix();
+
+  // 1. The database — reused if a previous run got this far.
+  let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
+  if (!pg) {
+    pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
+    await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
+    log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+  }
+  await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
+  const conn = await api.postgresConnectionInfo(pg.id);
+  const dbUrl = conn && conn.internalConnectionString;
+  if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
+
+  // 2. The web service — reused likewise.
+  let svc = host.serviceId ? await api.getService(host.serviceId) : null;
+  if (!svc) {
+    const firstAdmin = (await ownerLoginOf(db, inst)) || repo.owner;
+    const created = await api.createService(payload.renderServicePayload(inst, {
+      ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
+      webPlan: plans.webPlan, region: plans.region, dbUrl, secretKey: payload.freshSecretKey(), envPrefix, firstAdmin,
+    }));
+    svc = created.service;
+    await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
+    log(`  [render] created web service ${svc.id} (${plans.webPlan})`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+
+  // 3. What needs the URL, then one deploy that picks it all up.
+  for (const { key, value } of payload.renderAfterCreateEnv(url, { envPrefix })) await api.putEnvVar(svc.id, key, value);
+  await api.triggerDeploy(svc.id);
+  await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
+  log(`  [render] ${inst.slug} is deploying at ${url}`);
+  return { ok: true };
+}
+
+async function renderStandupInstance(inst, deps, intent) {
+  const { db, log } = deps;
+  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
+  const host = inst.app_host || {};
+  try {
+    if (!intent || !intent.borrowed_key_enc) return refuse('no Render key came with this request — enter it again to retry');
+    if (host.platform !== 'render') return refuse(`this project's app is not set to run on Render (platform '${host.platform || 'none'}')`);
+    if (!host.ownerId) return refuse('no Render workspace was chosen');
+    const age = Date.now() - new Date(intent.created_at || 0).getTime();
+    if (!(age < KEY_TTL_MS)) return refuse('the Render key waited too long to be used and was cleared — enter it again to retry');
+    if (host.mode !== 'adopt' && host.mode !== 'greenfield') return refuse(`unknown Render setup mode '${host.mode}'`);
+
+    const api = renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
+    // Membership, never selection: the workspace is the one the owner named, and it must
+    // be one this key can act in.
+    const owners = await api.listOwners();
+    if (!owners.some((o) => o.id === host.ownerId)) return refuse(`this Render key cannot reach workspace ${host.ownerId}`);
+
+    return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
+  } catch (e) {
+    return refuse(e && e.message ? e.message : String(e));
+  } finally {
+    if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
+  }
+
+  async function refuse(error) {
+    await recordAppHost(db, inst.id, { state: 'failed', error }).catch(() => {});
+    log(`  ✖ [render] ${inst.slug}: ${error}`);
+    return { ok: false, terminal: true, error };
+  }
+}
+
+// Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
+// the row so an operator can still say which services were the project's; the owner
+// deletes them in their own Render dashboard if they want to stop paying.
+async function forgetRenderApp(inst, { db, log, apply }) {
+  const host = inst.app_host;
+  if (!host || host.platform !== 'render') return;
+  const what = [host.serviceId && `service ${host.serviceId}`, host.postgresId && `database ${host.postgresId}`].filter(Boolean).join(' and ') || 'nothing yet';
+  log(`  [render] ${apply ? 'disconnected' : 'would disconnect'} from Render (${what}); nothing on Render is deleted — the owner removes it in their own dashboard`);
+  if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
+}
+
+module.exports = { renderStandupInstance, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };

package/scripts/gds/provision-teardown.js

@@ -42,6 +42,8 @@ async function teardownInstance(inst, deps) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
   parkAddress(inst, { controlExec, log, apply });
+  // The app's Render services are the OWNER's: forget them, never delete them (ADR 0327 §3, task 1004183).
+  await require('./provision-render.js').forgetRenderApp(inst, { db, log, apply });
   // Revoke the instance's deploy key (ADR 0176) and remove its local halves. The
   // checkout itself is deliberately left in place (data is precious), so the key
   // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project

package/scripts/gds/provision.js

@@ -1293,10 +1293,10 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
       else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
-      else if (intent.action === 'repo-private') result = await require('./provision-repo-private.js').repoPrivateInstance(inst, deps); // wire the deploy key, THEN flip (task 1004193); required here — this file is at the size ratchet
+      else if (intent.action === 'repo-private' || intent.action === 'render-standup') result = intent.action === 'repo-private' ? await require('./provision-repo-private.js').repoPrivateInstance(inst, deps) : await require('./provision-render.js').renderStandupInstance(inst, deps, intent); // wire the deploy key, THEN flip (task 1004193) · spend the borrowed Render key once (task 1004183); required here — this file is at the size ratchet
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
-        if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
+        if (intent.attempts >= MAX_INTENT_ATTEMPTS || result.terminal) { // terminal: a leg that must not be retried unattended (the Render leg's key is already gone — task 1004183)
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
           // A retired intent stops silently otherwise (F19): record the reason
           // on the instance WITHOUT changing its lifecycle status — passing the

package/scripts/gds/render-api.js

@@ -0,0 +1,178 @@
+// scripts/gds/render-api.js — a thin Render API v1 client for the control plane, with
+// the workspace (ownerId) guard (task 1004183; ADR 0327).
+//
+// Control-plane code, like its model scripts/gds/do-api.js: only the provisioning runner
+// uses it, never the web tier (ADR 0111 §2). Same skeleton (JsonHttpApi): injectable
+// transport, dry-run by default, and live mode refuses to start without a token.
+//
+// THE GUARD. A Render API key belongs to a USER, not a workspace, and carries that user's
+// rights in every workspace they belong to — measured 2026-09-22: one owner's key reached
+// three workspaces, one of them another builder's, holding live production services. So:
+//
+//   - the client is built for ONE workspace (`ownerId`) and refuses to exist without it —
+//     never defaulted, and never derived by taking the first of GET /owners;
+//   - every call that names an owner sends this one;
+//   - every response that carries an owner is ASSERTED to carry this one, and a missing
+//     or different owner is a hard error (RenderOwnerMismatch). Assert on the response,
+//     not the request: a request you got right says nothing about a response that came
+//     from somewhere else. A list is checked element by element.
+//
+// Render's own shapes decide where the owner sits: a service carries `ownerId`, a
+// Postgres carries `owner.id` (both measured by the pilot, task 1004142). A few calls
+// answer with no owner at all (a database's connection-info, an env-var PUT, a deploy
+// trigger). Those are only reachable through a method that first reads the parent
+// resource through the guard, so nothing is ever sent to or read from a resource whose
+// workspace was not checked.
+//
+// NO DELETE. The platform must not hold the ability to destroy infrastructure in an
+// account it does not own (ADR 0327 §3). There is no delete method, and _req refuses the
+// verb outright, so adding one later is a visible change to this file, not a one-liner.
+
+'use strict';
+
+const { JsonHttpApi, makeApiError } = require('./http-api-client');
+
+const RENDER_API_BASE = 'https://api.render.com/v1';
+
+const RenderApiError = makeApiError('RenderApiError', 'RENDER_API_ERROR');
+const RenderOwnerMismatch = makeApiError('RenderOwnerMismatch', 'RENDER_OWNER_MISMATCH');
+
+// The owner id a Render resource carries, in either of the two shapes Render uses.
+// null when it carries none.
+function ownerOf(resource) {
+  if (!resource || typeof resource !== 'object') return null;
+  if (typeof resource.ownerId === 'string' && resource.ownerId) return resource.ownerId;
+  if (resource.owner && typeof resource.owner.id === 'string' && resource.owner.id) return resource.owner.id;
+  return null;
+}
+
+// Env var values are the owner's secrets on their way to Render. A dry-run log is the one
+// place this client would otherwise print a request body, so it prints the names only.
+function redact(body) {
+  if (!body || typeof body !== 'object') return body;
+  const out = { ...body };
+  if (Array.isArray(out.envVars)) out.envVars = out.envVars.map((v) => ({ key: v && v.key, value: '[redacted]' }));
+  if ('value' in out) out.value = '[redacted]';
+  return out;
+}
+
+class RenderApi extends JsonHttpApi {
+  // opts: { token, ownerId, dryRun=true, fetchImpl=globalThis.fetch, base, log }
+  constructor(opts = {}) {
+    super(opts, { base: RENDER_API_BASE, logTag: 'Render', ErrorClass: RenderApiError });
+    if (typeof opts.ownerId !== 'string' || !opts.ownerId.trim()) {
+      throw new RenderApiError('a Render client needs the workspace it acts in (ownerId) — it is never defaulted');
+    }
+    this.ownerId = opts.ownerId.trim();
+    if (!this.dryRun && !this.token) {
+      throw new RenderApiError('live Render call requested with no API key');
+    }
+    if (!this.dryRun && typeof this.fetchImpl !== 'function') {
+      throw new RenderApiError('no fetch implementation available for live mode');
+    }
+  }
+
+  async _req(method, path, body, opts = {}) {
+    if (method === 'DELETE') throw new RenderApiError(`refusing ${method} ${path}: the platform never deletes in an account it does not own (ADR 0327 §3)`);
+    if (this.dryRun) {
+      this.log(`[dry-run] Render ${method} ${path}${body ? ' ' + JSON.stringify(redact(body)) : ''}`);
+      return { dryRun: true, ...(opts.dryRunResult || {}) };
+    }
+    return super._req(method, path, body, opts);
+  }
+
+  // Throws unless `resource` carries exactly this client's workspace.
+  assertOwned(resource, what) {
+    const got = ownerOf(resource);
+    if (got !== this.ownerId) {
+      throw new RenderOwnerMismatch(
+        got
+          ? `Render answered ${what} from workspace ${got}, not ${this.ownerId} — refusing to go on`
+          : `Render answered ${what} with no workspace on it — refusing to go on`,
+        { body: null });
+    }
+    return resource;
+  }
+
+  // ---- workspaces ------------------------------------------------------------
+
+  // The workspaces the key can reach, as [{ id, name, type }]. Used for MEMBERSHIP only —
+  // "is the workspace the owner named one this key can act in" — never to pick one.
+  async listOwners() {
+    const json = await this._req('GET', '/owners?limit=100', null, {
+      dryRunResult: { items: [{ owner: { id: this.ownerId, name: '(dry-run)', type: 'team' } }] },
+    });
+    const items = Array.isArray(json) ? json : (json && json.items) || [];
+    return items.map((e) => (e && e.owner) || e).filter((o) => o && typeof o.id === 'string');
+  }
+
+  // ---- services --------------------------------------------------------------
+
+  async getService(serviceId) {
+    const json = await this._req('GET', `/services/${encodeURIComponent(serviceId)}`, null, {
+      dryRunResult: { id: serviceId, ownerId: this.ownerId, serviceDetails: { url: null } },
+    });
+    return this.assertOwned(json && json.service ? json.service : json, `service ${serviceId}`);
+  }
+
+  // payload: the POST /services body (render-payload.js). Its ownerId must be ours — the
+  // payload builder takes it as an argument, so this is checked, not overwritten.
+  async createService(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a service payload must name this client\'s workspace');
+    const json = await this._req('POST', '/services', payload, {
+      dryRunResult: { deployId: null, service: { id: `dryrun-srv-${payload.name}`, ownerId: this.ownerId, serviceDetails: { url: null } } },
+    });
+    return { deployId: (json && json.deployId) || null, service: this.assertOwned(json && json.service, 'the new service') };
+  }
+
+  // Set one env var on a service this workspace owns. The PUT answers with no owner, so
+  // the service is read through the guard first.
+  async putEnvVar(serviceId, key, value) {
+    await this.getService(serviceId);
+    return this._req('PUT', `/services/${encodeURIComponent(serviceId)}/env-vars/${encodeURIComponent(key)}`, { value }, { dryRunResult: { key } });
+  }
+
+  async triggerDeploy(serviceId) {
+    await this.getService(serviceId);
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, {}, { dryRunResult: { id: null } });
+  }
+
+  // ---- Postgres --------------------------------------------------------------
+
+  async createPostgres(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a Postgres payload must name this client\'s workspace');
+    const json = await this._req('POST', '/postgres', payload, {
+      dryRunResult: { id: `dryrun-pg-${payload.name}`, status: 'creating', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, 'the new database');
+  }
+
+  async getPostgres(postgresId) {
+    const json = await this._req('GET', `/postgres/${encodeURIComponent(postgresId)}`, null, {
+      dryRunResult: { id: postgresId, status: 'available', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, `database ${postgresId}`);
+  }
+
+  // The database's connection strings. The answer carries no owner, so the database is
+  // read through the guard first.
+  async postgresConnectionInfo(postgresId) {
+    await this.getPostgres(postgresId);
+    return this._req('GET', `/postgres/${encodeURIComponent(postgresId)}/connection-info`, null, {
+      dryRunResult: { internalConnectionString: 'postgres://dry-run' },
+    });
+  }
+
+  // Poll until a new database is 'available'. `sleepFn` lets tests drive it with no clock.
+  async settlePostgres(postgresId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
+    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let i = 0; i < tries; i++) {
+      const pg = await this.getPostgres(postgresId);
+      if (pg.status === 'available') return pg;
+      await sleep(sleepMs);
+    }
+    throw new RenderApiError(`database ${postgresId} did not become available in time`);
+  }
+}
+
+module.exports = { RenderApi, RenderApiError, RenderOwnerMismatch, RENDER_API_BASE, ownerOf, redact };