@bongos/core 1.19.1079 → 1.19.1081

package/scripts/gds/render-payload.js

@@ -0,0 +1,110 @@
+// scripts/gds/render-payload.js — WHAT the Render standup leg creates, kept apart from
+// HOW it creates it (scripts/gds/provision-render.js) (task 1004183).
+//
+// Pure functions, no I/O. They are separate so the thing being stood up can change
+// without touching the guard or the key plumbing: this file builds the Bongos instance
+// the Render pilot proved (task 1004142, docs/recipes/render-pilot.md §4 and its
+// "Corrections" box), and task 1004350 retargets it at the project's own app, per
+// ADR 0345 (we host the hall; the owner's app is what goes to their Render account).
+//
+// The plans are per-instance settings (ADR 0327 §5), never constants. The defaults are
+// what the pilot measured as enough for a new instance at idle: a `starter` web service
+// (48-62 MiB of 512) and a paid `basic_256mb` Postgres, because Render's free Postgres
+// has no backups of any kind.
+
+'use strict';
+
+const crypto = require('node:crypto');
+
+// The vocabulary lives with the web tier's validation, so the two can never disagree.
+const { WEB_PLANS, DB_PLANS, REGIONS } = require('../../modules/provisioning/render-standup.js');
+const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
+
+// A Render resource name from the project's slug. Render allows letters, digits and
+// dashes; the slug already is that, this only makes sure.
+function resourceName(inst, suffix) {
+  const base = String(inst.slug || `project-${inst.id}`).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 50);
+  return suffix ? `${base}-${suffix}` : base;
+}
+
+// The plan and region an instance asked for, with the defaults filled in. A value outside
+// the vocabulary is refused rather than passed through for Render to reject.
+function plansFor(appHost) {
+  const h = appHost || {};
+  const out = {
+    webPlan: h.webPlan || DEFAULTS.webPlan,
+    dbPlan: h.dbPlan || DEFAULTS.dbPlan,
+    region: h.region || DEFAULTS.region,
+  };
+  if (!WEB_PLANS.includes(out.webPlan)) throw new Error(`unknown Render web plan '${out.webPlan}'`);
+  if (!DB_PLANS.includes(out.dbPlan)) throw new Error(`unknown Render database plan '${out.dbPlan}'`);
+  if (!REGIONS.includes(out.region)) throw new Error(`unknown Render region '${out.region}'`);
+  return out;
+}
+
+// POST /postgres. `plan` is never 'free' — see the header.
+function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
+  return { name: resourceName(inst, 'db'), ownerId, plan: dbPlan, region, version: '16' };
+}
+
+// POST /services, for a Bongos instance from its repository. `dbUrl` is the database's
+// internal connection string; `secretKey` is a fresh BUILDER_SECRET_KEY. Both are VALUES
+// sent to Render and held there — the platform keeps neither.
+//
+// What each non-obvious line is for, from the pilot's corrections:
+//   - runtime + startCommand are explicit: a hybrid repo defaults to Python on Render, and
+//     an adopted instance has no `npm start`;
+//   - HOST=0.0.0.0: the server binds 127.0.0.1 otherwise and Render's router never reaches it;
+//   - PGDATABASE = the URL: migrate.sh addresses the database as `psql -d "$PGDATABASE"`;
+//   - BUILDER_SECRET_KEY: Render's disk is wiped each deploy, so the key-file fallback
+//     would mint a new key every time and orphan every stored per-builder secret;
+//   - no PORT: Render injects it.
+// Bongos reads DATABASE_URL first (src/bongos/pool.js), so none of the PG* family the box
+// writes is needed — the one simplification Render buys.
+function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, dbUrl, secretKey, envPrefix, firstAdmin }) {
+  const envVars = [
+    { key: 'NODE_VERSION', value: '22' },
+    { key: 'HOST', value: '0.0.0.0' },
+    { key: 'DATABASE_URL', value: dbUrl },
+    { key: 'PGDATABASE', value: dbUrl },
+    { key: 'PGPOOL_MAX', value: '5' },
+    { key: 'BUILDER_SECRET_KEY', value: secretKey },
+  ];
+  if (firstAdmin) envVars.push({ key: `${envPrefix}_FIRST_ADMIN`, value: firstAdmin });
+  return {
+    type: 'web_service',
+    name: resourceName(inst),
+    ownerId,
+    repo: repoUrl,
+    branch: branch || 'main',
+    autoDeploy: 'yes',
+    serviceDetails: {
+      runtime: 'node',
+      plan: webPlan,
+      region,
+      healthCheckPath: '/healthz',
+      envSpecificDetails: {
+        buildCommand: 'npm ci',
+        startCommand: 'node node_modules/@bongos/core/src/platform-server.js',
+        preDeployCommand: 'bash node_modules/@bongos/core/scripts/migrate.sh',
+      },
+    },
+    envVars,
+  };
+}
+
+// The env vars that can only be set once the service exists, because they name the URL
+// Render gave it. The four origins must all be that one host: a single-host instance has
+// no separate builders./status. subdomain, and without them the hall never loads.
+function renderAfterCreateEnv(serviceUrl, { envPrefix }) {
+  const origin = String(serviceUrl || '').replace(/\/+$/, '');
+  if (!/^https:\/\//.test(origin)) throw new Error(`Render gave the service no https URL (${serviceUrl || 'none'})`);
+  return ['PUBLIC', 'BUILDERS', 'STATUS', 'OAUTH'].map((k) => ({ key: `${envPrefix}_${k}_ORIGIN`, value: origin }));
+}
+
+function freshSecretKey() { return crypto.randomBytes(32).toString('hex'); }
+
+module.exports = {
+  WEB_PLANS, DB_PLANS, REGIONS, DEFAULTS,
+  resourceName, plansFor, renderPostgresPayload, renderServicePayload, renderAfterCreateEnv, freshSecretKey,
+};

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1079'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1081'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_update.mjs

@@ -0,0 +1,232 @@
+// tests/module_update.mjs — `bongos module update <key>` (task 1003786, ADR 0338 D1,
+// criterion wa5-module-economy). No network, no database: cmdUpdate runs against a
+// fake store serving REAL packed tarballs, so verification is the real
+// verifyModuleArtifact.
+//
+// The criterion's teeth are the parity tests: an update to a paid module the caller
+// holds and to a free one make the identical calls with the identical outcome, and
+// the shared acquisition path carries no price-conditional code at all.
+//
+// Run:  node tests/module_update.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { readTar, buildTar } = require('../scripts/gds/artifact-format.js');
+const { cmdUpdate, cmdInstall } = require('../scripts/gds/module.js');
+
+const NOW = () => new Date('2026-09-29T00:00:00Z');
+
+// A real packed tarball for weather@version, with `extra` files beside module.json.
+async function packed(version, extra = {}, mj = {}) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-src-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version, coreVersion: '^1.0.0', contributes: {}, ...mj };
+  const dir = path.join(src, 'weather');
+  const files = { 'module.json': JSON.stringify(manifest, null, 2), 'routes/weather.js': `module.exports = () => '${version}';\n`, ...extra };
+  for (const [rel, body] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  const { tgz } = packModule('weather', { modulesDir: src, now: NOW, modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: 'weather' });
+  assert.ok(v.ok);
+  return { tgz, v };
+}
+
+// An installed weather@version in a fresh modules dir.
+function installedAt(version, extra = {}) {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-dest-'));
+  const dir = path.join(modulesDir, 'weather');
+  const files = { 'module.json': JSON.stringify({ key: 'weather', version }), 'routes/weather.js': `module.exports = () => '${version}';\n`, ...extra };
+  for (const [rel, body] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  return modulesDir;
+}
+
+// A fake store. `source` is how the caller came to hold the module; the store's own
+// acquire route never looks at price for a holder, so nothing else differs.
+function fakeStore({ tgz, v }, { source = 'free', over = {} } = {}) {
+  const calls = [];
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) {
+      return over.acquire || { ok: true, status: 200, data: {
+        ok: true, module_key: 'weather', version: v.version, core_version: v.coreVersion,
+        tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256, tarball_bytes: v.bytes, channel: 'general',
+        entitlement: { module_key: 'weather', holder_kind: 'builder', holder_ref: '42', source, version: '1.2.0' },
+      } };
+    }
+    if (urlPath.endsWith('/tarball')) return { ok: true, status: 200, buf: over.buf || tgz };
+    if (urlPath.endsWith('/acquired')) return { ok: true, status: 200, data: { ok: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  return { calls, request };
+}
+
+const quiet = () => { const out = []; return { out, log: (m) => out.push(m), errlog: (m) => out.push(m) }; };
+const opts = (modulesDir, store, q = quiet()) => ({ ...q, modulesDir, roots: [], request: store.request, core: '1.19.0' });
+const route = (modulesDir) => fs.readFileSync(path.join(modulesDir, 'weather', 'routes', 'weather.js'), 'utf8');
+
+// ---- update ----
+
+test('updates an installed module to the newest version: files replaced, old-only files gone, version recorded', async () => {
+  const modulesDir = installedAt('1.2.0', { 'old-only.js': 'x' });
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 0, q.out.join('\n'));
+  assert.equal(route(modulesDir), "module.exports = () => '1.3.0';\n");
+  assert.ok(!fs.existsSync(path.join(modulesDir, 'weather', 'old-only.js')), 'the new version is exactly what was published');
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather'], 'no staging or previous dir left behind');
+  assert.deepEqual(store.calls.map((c) => `${c.method} ${c.urlPath}`), [
+    'POST /store/modules/weather/acquire',
+    'GET /store/modules/weather/versions/1.3.0/tarball',
+    'POST /store/modules/weather/acquired',
+  ]);
+  assert.deepEqual(store.calls[2].json, { version: '1.3.0' });
+  assert.match(q.out.join('\n'), /1\.2\.0 → 1\.3\.0\. Its on\/off switch is unchanged/);
+});
+
+test('already on the newest version: says so and downloads nothing', async () => {
+  const modulesDir = installedAt('1.3.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 0);
+  assert.deepEqual(store.calls.map((c) => c.urlPath), ['/store/modules/weather/acquire']);
+  assert.match(q.out.join('\n'), /up to date at 1\.3\.0/);
+});
+
+test('an older --version is refused before the store is asked: update only moves forward', async () => {
+  const modulesDir = installedAt('1.3.0');
+  const store = fakeStore(await packed('1.2.0'));
+  assert.equal(await cmdUpdate(['weather', '--version', '1.2.0'], opts(modulesDir, store)), 1);
+  assert.equal(store.calls.length, 0);
+  assert.equal(route(modulesDir), "module.exports = () => '1.3.0';\n");
+});
+
+test('--version asks the store for that exact version', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('1.4.0'));
+  assert.equal(await cmdUpdate(['weather', '--version', '1.4.0'], opts(modulesDir, store)), 0);
+  assert.deepEqual(store.calls[0].json, { version: '1.4.0' });
+});
+
+test('a module that is not installed is refused, pointing at install', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-empty-'));
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /not installed here\. Run `bongos module install weather`/);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a module bundled with the core is refused: it updates with the core', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-empty-'));
+  const coreRoot = installedAt('1.0.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], { ...opts(modulesDir, store, q), roots: [coreRoot] }), 1);
+  assert.match(q.out.join('\n'), /comes with the core, not the store/);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a tampered download leaves the installed version untouched', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const next = await packed('1.3.0');
+  const entries = readTar(next.tgz);
+  entries.find((e) => e.name.endsWith('routes/weather.js')).buf = Buffer.from('evil();\n');
+  const store = fakeStore(next, { over: { buf: buildTar(entries) } });
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /failed verification \(hash_mismatch\)/);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather']);
+  assert.ok(!store.calls.some((c) => c.urlPath.endsWith('/acquired')));
+});
+
+test('a version this core cannot mount is refused before download, the installed one kept', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('2.0.0', {}, { coreVersion: '^2.0.0' }));
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store)), 1);
+  assert.equal(store.calls.length, 1);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+});
+
+test('a store refusal (e.g. a delisted module) keeps the installed version', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('1.3.0'), { over: { acquire: { ok: false, status: 409, data: { error: { code: 'module_delisted', message: 'delisted' } } } } });
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /HTTP 409\): delisted/);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+});
+
+// ---- parity: paid and free take one path (criterion wa5-module-economy) ----
+
+test('a paid module the caller holds and a free one update through identical calls with an identical outcome', async () => {
+  const next = await packed('1.3.0');
+  const runs = {};
+  for (const source of ['free', 'purchase', 'grant', 'core']) {
+    const modulesDir = installedAt('1.2.0');
+    const store = fakeStore(next, { source });
+    const q = quiet();
+    const code = await cmdUpdate(['weather'], opts(modulesDir, store, q));
+    runs[source] = { code, calls: store.calls, out: q.out.join('\n').replaceAll(modulesDir, '<dir>'), route: route(modulesDir) };
+  }
+  for (const source of ['purchase', 'grant', 'core']) {
+    assert.deepEqual(runs[source], runs.free, `an update of a module held as '${source}' must not differ from a free one`);
+  }
+  assert.equal(runs.free.code, 0);
+});
+
+// Strip comments so only code is scanned; a word in an explanation is not a branch.
+function codeOf(src, fnName) {
+  const start = src.indexOf(`function ${fnName}(`);
+  assert.ok(start !== -1, `${fnName} exists`);
+  const next = src.indexOf('\nfunction ', start + 1);
+  const nextAsync = src.indexOf('\nasync function ', start + 1);
+  const end = [next, nextAsync].filter((i) => i > start).sort((a, b) => a - b)[0] ?? src.length;
+  return src.slice(start, end).replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+}
+
+test('the shared acquisition path, install and update carry no price-conditional code', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/module.js'), 'utf8');
+  for (const fn of ['fetchVerified', 'recordPlaced', 'cmdInstall', 'cmdUpdate', 'replaceModule', 'placeModule']) {
+    assert.doesNotMatch(codeOf(src, fn), /\b(price|priced|paid|cents|credits|free|purchase|source)\b/i, `${fn} must not read how the module was obtained`);
+  }
+  // Both commands go through the one path, not two copies of it.
+  assert.match(codeOf(src, 'cmdInstall'), /await fetchVerified\(key,/);
+  assert.match(codeOf(src, 'cmdUpdate'), /await fetchVerified\(key,/);
+});
+
+test('the store only looks at price for a caller who holds no entitlement, so a holder is never charged again', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  const start = src.indexOf("router.post('/store/modules/:key/acquire'");
+  const block = src.slice(start, src.indexOf('router.get(', start));
+  const priceAt = block.indexOf('r.free');
+  const guardAt = block.indexOf('if (!held.entitled) {');
+  assert.ok(guardAt !== -1 && priceAt > guardAt, 'the price check sits inside the not-entitled branch');
+  assert.equal(block.split('r.free').length - 1, 1, 'price is read in exactly one place');
+});
+
+// ---- install: the grader's finding on task 1003785 ----
+
+test('install refuses a key already present in another discovery root (a module bundled with the core)', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-empty-'));
+  const coreRoot = installedAt('1.0.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...opts(modulesDir, store, q), roots: [coreRoot] }), 1);
+  assert.match(q.out.join('\n'), /already on disk at .*run `bongos module update weather`/);
+  assert.equal(store.calls.length, 0);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});

package/tests/provision_render.mjs

@@ -0,0 +1,269 @@
+// tests/provision_render.mjs — the Render standup leg (task 1004183; ADR 0327).
+//
+// scripts/gds/provision-render.js driven over the REAL Render client (render-api.js) and a
+// recording fake of Render's API, so the workspace guard is exercised end to end rather
+// than stubbed away. db and the secret box are fakes. No network, no DB.
+//
+// The load-bearing assertions — the task's DONE WHEN, clause by clause:
+//   • the borrowed key is CLEARED in the drain that spends it: on success, on a refusal,
+//     on a mismatched workspace, on a Render error and on a decrypt failure
+//   • the ownerId guard refuses a mismatched response, and the run stops there — nothing
+//     is created after it
+//   • ADOPT makes no write call to Render at all; GREENFIELD creates the database, then
+//     the service, sets the SVC_URL-dependent env vars, then deploys — in that order
+//   • the plan is read from the project's row, not a constant
+//   • a failure is TERMINAL: the runner retires it instead of re-queuing it, because the
+//     key is gone and the owner retries by entering it again
+//   • teardown forgets the Render app and never calls Render
+//
+// Run:  node tests/provision_render.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const { RenderApi } = require('../scripts/gds/render-api.js');
+const { renderStandupInstance, forgetRenderApp, KEY_TTL_MS } = require('../scripts/gds/provision-render.js');
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const THEIRS = 'tea-theirs000001';
+const SVC_URL = 'https://demo.onrender.com';
+
+// A fake Render account. `over` replaces any answer; a function answer sees the body.
+function fakeRender(over = {}) {
+  const calls = [];
+  const answers = {
+    'GET /owners?limit=100': [{ owner: { id: THEIRS } }, { owner: { id: OURS } }],
+    'POST /postgres': { id: 'dpg-new', status: 'creating', owner: { id: OURS } },
+    'GET /postgres/dpg-new': { id: 'dpg-new', status: 'available', owner: { id: OURS } },
+    'GET /postgres/dpg-new/connection-info': { internalConnectionString: 'postgres://internal' },
+    'POST /services': { deployId: 'dep-1', service: { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } } },
+    'GET /services/srv-new': { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } },
+    'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, serviceDetails: { url: 'https://old.onrender.com' } },
+    'POST /services/srv-new/deploys': { id: 'dep-2' },
+    ...over,
+  };
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    const body = init.body ? JSON.parse(init.body) : null;
+    calls.push({ method: init.method, path, body });
+    let key = `${init.method} ${path}`;
+    if (init.method === 'PUT' && /\/env-vars\//.test(path)) key = 'PUT env';
+    const a = key in answers ? answers[key] : (key === 'PUT env' ? { ok: true } : undefined);
+    if (a === undefined) return { ok: false, status: 404, text: async () => '{"message":"not found"}' };
+    if (a instanceof Error) return { ok: false, status: 500, text: async () => JSON.stringify({ message: a.message }) };
+    return { ok: true, status: 200, text: async () => JSON.stringify(typeof a === 'function' ? a(body) : a) };
+  };
+  return { calls, fetchImpl };
+}
+
+function harness({ host = {}, intent = {}, render = {}, decryptThrows = false } = {}) {
+  const r = fakeRender(render);
+  const writes = [], logs = [];
+  const db = {
+    query: async (sql, params) => {
+      writes.push({ sql: sql.replace(/\s+/g, ' ').trim(), params });
+      if (/FROM builders/.test(sql)) return { rows: [{ github_login: 'owner-login' }] };
+      return { rows: [] };
+    },
+  };
+  const deps = {
+    db, apply: true, log: (l) => logs.push(l), envPrefix: 'BONGOS', sleepFn: async () => {},
+    secretBox: { decrypt: (blob) => { if (decryptThrows) throw new Error('secret-box: bad tag'); assert.equal(blob, 'v1.enc'); return 'rnd_borrowed'; } },
+    renderApiFactory: ({ token, ownerId }) => new RenderApi({ token, ownerId, dryRun: false, fetchImpl: r.fetchImpl }),
+  };
+  const inst = { id: 18, slug: 'demo', owner_builder_id: 7, target_ref: 'example-owner/demo', status: 'active',
+    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, ...host } };
+  const it = { id: 44, action: 'render-standup', borrowed_key_enc: 'v1.enc', created_at: new Date().toISOString(), ...intent };
+  const cleared = () => writes.filter((w) => /UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = \$1/.test(w.sql) && w.params[0] === 44).length;
+  const appHost = () => writes.filter((w) => /SET app_host/.test(w.sql)).map((w) => JSON.parse(w.params[1]));
+  const lastHost = () => Object.assign({}, ...appHost());
+  return { r, writes, logs, deps, inst, it, cleared, lastHost, run: () => renderStandupInstance(inst, deps, it) };
+}
+
+const writesTo = (calls) => calls.filter((c) => c.method !== 'GET');
+
+console.log('greenfield:');
+await ta('creates the database, then the service, sets the origins, then deploys — and clears the key', async () => {
+  const h = harness();
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.method + ' ' + c.path.replace(/env-vars\/.*/, 'env-vars/*')), [
+    'POST /postgres', 'POST /services',
+    'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*',
+    'POST /services/srv-new/deploys',
+  ]);
+  const origins = h.r.calls.filter((c) => c.method === 'PUT').map((c) => [c.path.split('/').pop(), c.body.value]);
+  assert.deepEqual(origins, [['BONGOS_PUBLIC_ORIGIN', SVC_URL], ['BONGOS_BUILDERS_ORIGIN', SVC_URL], ['BONGOS_STATUS_ORIGIN', SVC_URL], ['BONGOS_OAUTH_ORIGIN', SVC_URL]]);
+  assert.equal(h.cleared(), 1, 'the key column is cleared');
+  const host = h.lastHost();
+  assert.deepEqual([host.postgresId, host.serviceId, host.state, host.serviceUrl, host.error], ['dpg-new', 'srv-new', 'deploying', SVC_URL, null], 'the row records what was created');
+});
+
+await ta('the service is the pilot\'s: node runtime, explicit start + migrate, HOST, the database SVC_URL, a fresh secret, the owner seated', async () => {
+  const h = harness();
+  await h.run();
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.equal(svc.ownerId, OURS);
+  assert.equal(svc.repo, 'https://github.com/example-owner/demo');
+  assert.equal(svc.serviceDetails.runtime, 'node');
+  assert.match(svc.serviceDetails.envSpecificDetails.startCommand, /platform-server\.js$/);
+  assert.match(svc.serviceDetails.envSpecificDetails.preDeployCommand, /migrate\.sh$/);
+  const env = Object.fromEntries(svc.envVars.map((v) => [v.key, v.value]));
+  assert.equal(env.HOST, '0.0.0.0');
+  assert.equal(env.DATABASE_URL, 'postgres://internal');
+  assert.equal(env.PGDATABASE, 'postgres://internal');
+  assert.match(env.BUILDER_SECRET_KEY, /^[0-9a-f]{64}$/);
+  assert.equal(env.BONGOS_FIRST_ADMIN, 'owner-login');
+  assert.ok(!('PORT' in env), 'Render injects PORT');
+  const stored = JSON.stringify(h.writes.map((w) => w.params));
+  assert.ok(!stored.includes(env.BUILDER_SECRET_KEY) && !stored.includes('postgres://internal') && !stored.includes('rnd_borrowed'),
+    'no env var value and no key is ever written to our database');
+});
+
+await ta('the plan is the project\'s own setting, not a constant', async () => {
+  const h = harness({ host: { webPlan: 'standard', dbPlan: 'basic_1gb', region: 'frankfurt' } });
+  await h.run();
+  const pg = h.r.calls.find((c) => c.path === '/postgres').body;
+  const svc = h.r.calls.find((c) => c.path === '/services').body;
+  assert.equal(pg.plan, 'basic_1gb');
+  assert.equal(pg.region, 'frankfurt');
+  assert.equal(svc.serviceDetails.plan, 'standard');
+  const d = harness();
+  await d.run();
+  assert.equal(d.r.calls.find((c) => c.path === '/postgres').body.plan, 'basic_256mb', 'the default is paid: free Postgres has no backups');
+  assert.equal(d.r.calls.find((c) => c.path === '/services').body.serviceDetails.plan, 'starter');
+});
+
+await ta('a retry resumes onto what an earlier run created — no second database or service', async () => {
+  const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-new' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.ok(!h.r.calls.some((c) => c.method === 'POST' && (c.path === '/postgres' || c.path === '/services')));
+});
+
+console.log('\nadopt:');
+await ta('links an existing service and makes NO write call to Render', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), [], 'only reads');
+  assert.equal(h.lastHost().state, 'linked');
+  assert.equal(h.lastHost().serviceUrl, 'https://old.onrender.com');
+  assert.equal(h.cleared(), 1);
+});
+await ta('adopting a service from another workspace is refused, and the key still cleared', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: THEIRS } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(out.terminal, true);
+  assert.match(out.error, /from workspace tea-theirs/);
+  assert.equal(h.lastHost().state, 'failed');
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe guard stops the run:');
+await ta('a database answered from another workspace stops everything after it', async () => {
+  const h = harness({ render: { 'POST /postgres': { id: 'dpg-x', status: 'creating', owner: { id: THEIRS } } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /refusing to go on/);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.path), ['/postgres'], 'no service, no env vars, no deploy');
+  assert.equal(h.cleared(), 1);
+});
+await ta('a workspace the key cannot reach is refused before any other call', async () => {
+  const h = harness({ render: { 'GET /owners?limit=100': [{ owner: { id: THEIRS } }] } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /cannot reach workspace/);
+  assert.equal(h.r.calls.length, 1);
+  assert.equal(h.cleared(), 1);
+});
+await ta('the workspace is never taken from the list — with none named, nothing is called', async () => {
+  const h = harness({ host: { ownerId: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe key is cleared whatever happens:');
+for (const [name, opts, re] of [
+  ['Render answers an error', { render: { 'POST /services': new Error('plan not allowed') } }, /plan not allowed/],
+  ['the key cannot be decrypted', { decryptThrows: true }, /bad tag/],
+  ['the key waited too long', { intent: { created_at: new Date(Date.now() - KEY_TTL_MS - 1000).toISOString() } }, /waited too long/],
+  ['no key came with the request', { intent: { borrowed_key_enc: null } }, /no Render key/],
+  ['the project is not set to Render', { host: { platform: 'vercel' } }, /not set to run on Render/],
+  ['an unknown plan', { host: { webPlan: 'huge' } }, /unknown Render web plan/],
+]) {
+  await ta(`${name} → terminal, reason recorded, key cleared`, async () => {
+    const h = harness(opts);
+    const out = await h.run();
+    assert.equal(out.ok, false);
+    assert.equal(out.terminal, true);
+    assert.match(out.error, re);
+    assert.equal(h.lastHost().state, 'failed');
+    assert.equal(h.cleared(), 1);
+  });
+}
+
+console.log('\nthe runner retires a terminal failure — no silent retry:');
+function drain(resultOfLeg) {
+  let claims = 0; const resolved = [], requeued = [];
+  const h = harness(resultOfLeg);
+  const deps = {
+    ...h.deps, exec: () => '', controlExec: () => '', sleep: async () => {},
+    db: { query: async (sql, params) => { if (/state='pending'/.test(sql)) requeued.push(params); return h.deps.db.query(sql, params); } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { ...h.it, instance_id: 18, attempts: 1 } : null),
+      getInstanceById: async () => ({ ...h.inst }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async () => {}, recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  return { deps, resolved, requeued, h };
+}
+await ta("cmdRunIntents routes 'render-standup' to the leg, and a success resolves done", async () => {
+  const d = drain({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 0, JSON.stringify(out));
+  assert.deepEqual(d.resolved, [{ id: 44, state: 'done', err: null }]);
+});
+await ta('a failure is retired on its FIRST attempt, never re-queued', async () => {
+  const d = drain({ render: { 'GET /owners?limit=100': [] } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 1);
+  assert.deepEqual(d.requeued, [], 'not put back to pending');
+  assert.equal(d.resolved.length, 1);
+  assert.equal(d.resolved[0].state, 'error');
+  assert.match(d.resolved[0].err, /cannot reach workspace/);
+});
+
+console.log('\nteardown forgets, never deletes:');
+await ta('forgetRenderApp records the disconnect and calls nothing', async () => {
+  const writes = [], logs = [];
+  const inst = { id: 18, app_host: { platform: 'render', serviceId: 'srv-new', postgresId: 'dpg-new' } };
+  await forgetRenderApp(inst, { db: { query: async (sql, p) => { writes.push(p); return { rows: [] }; } }, log: (l) => logs.push(l), apply: true });
+  assert.equal(JSON.parse(writes[0][1]).state, 'disconnected');
+  assert.match(logs.join('\n'), /nothing on Render is deleted/);
+  await forgetRenderApp({ id: 19, app_host: null }, { db: { query: async () => { throw new Error('must not write'); } }, log: () => {}, apply: true });
+});
+await ta('the teardown leg reaches forgetRenderApp, and the leg has no path to a Render delete', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision-teardown.js', import.meta.url), 'utf8');
+  assert.match(src, /forgetRenderApp\(inst/);
+  const leg = readFileSync(new URL('../scripts/gds/provision-render.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(leg, /'DELETE'|\.delete[A-Z]/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);