@bongos/core 1.19.1080 → 1.19.1081

package/tests/provision_render.mjs

@@ -0,0 +1,269 @@
+// tests/provision_render.mjs — the Render standup leg (task 1004183; ADR 0327).
+//
+// scripts/gds/provision-render.js driven over the REAL Render client (render-api.js) and a
+// recording fake of Render's API, so the workspace guard is exercised end to end rather
+// than stubbed away. db and the secret box are fakes. No network, no DB.
+//
+// The load-bearing assertions — the task's DONE WHEN, clause by clause:
+//   • the borrowed key is CLEARED in the drain that spends it: on success, on a refusal,
+//     on a mismatched workspace, on a Render error and on a decrypt failure
+//   • the ownerId guard refuses a mismatched response, and the run stops there — nothing
+//     is created after it
+//   • ADOPT makes no write call to Render at all; GREENFIELD creates the database, then
+//     the service, sets the SVC_URL-dependent env vars, then deploys — in that order
+//   • the plan is read from the project's row, not a constant
+//   • a failure is TERMINAL: the runner retires it instead of re-queuing it, because the
+//     key is gone and the owner retries by entering it again
+//   • teardown forgets the Render app and never calls Render
+//
+// Run:  node tests/provision_render.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const { RenderApi } = require('../scripts/gds/render-api.js');
+const { renderStandupInstance, forgetRenderApp, KEY_TTL_MS } = require('../scripts/gds/provision-render.js');
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const THEIRS = 'tea-theirs000001';
+const SVC_URL = 'https://demo.onrender.com';
+
+// A fake Render account. `over` replaces any answer; a function answer sees the body.
+function fakeRender(over = {}) {
+  const calls = [];
+  const answers = {
+    'GET /owners?limit=100': [{ owner: { id: THEIRS } }, { owner: { id: OURS } }],
+    'POST /postgres': { id: 'dpg-new', status: 'creating', owner: { id: OURS } },
+    'GET /postgres/dpg-new': { id: 'dpg-new', status: 'available', owner: { id: OURS } },
+    'GET /postgres/dpg-new/connection-info': { internalConnectionString: 'postgres://internal' },
+    'POST /services': { deployId: 'dep-1', service: { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } } },
+    'GET /services/srv-new': { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } },
+    'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, serviceDetails: { url: 'https://old.onrender.com' } },
+    'POST /services/srv-new/deploys': { id: 'dep-2' },
+    ...over,
+  };
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    const body = init.body ? JSON.parse(init.body) : null;
+    calls.push({ method: init.method, path, body });
+    let key = `${init.method} ${path}`;
+    if (init.method === 'PUT' && /\/env-vars\//.test(path)) key = 'PUT env';
+    const a = key in answers ? answers[key] : (key === 'PUT env' ? { ok: true } : undefined);
+    if (a === undefined) return { ok: false, status: 404, text: async () => '{"message":"not found"}' };
+    if (a instanceof Error) return { ok: false, status: 500, text: async () => JSON.stringify({ message: a.message }) };
+    return { ok: true, status: 200, text: async () => JSON.stringify(typeof a === 'function' ? a(body) : a) };
+  };
+  return { calls, fetchImpl };
+}
+
+function harness({ host = {}, intent = {}, render = {}, decryptThrows = false } = {}) {
+  const r = fakeRender(render);
+  const writes = [], logs = [];
+  const db = {
+    query: async (sql, params) => {
+      writes.push({ sql: sql.replace(/\s+/g, ' ').trim(), params });
+      if (/FROM builders/.test(sql)) return { rows: [{ github_login: 'owner-login' }] };
+      return { rows: [] };
+    },
+  };
+  const deps = {
+    db, apply: true, log: (l) => logs.push(l), envPrefix: 'BONGOS', sleepFn: async () => {},
+    secretBox: { decrypt: (blob) => { if (decryptThrows) throw new Error('secret-box: bad tag'); assert.equal(blob, 'v1.enc'); return 'rnd_borrowed'; } },
+    renderApiFactory: ({ token, ownerId }) => new RenderApi({ token, ownerId, dryRun: false, fetchImpl: r.fetchImpl }),
+  };
+  const inst = { id: 18, slug: 'demo', owner_builder_id: 7, target_ref: 'example-owner/demo', status: 'active',
+    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, ...host } };
+  const it = { id: 44, action: 'render-standup', borrowed_key_enc: 'v1.enc', created_at: new Date().toISOString(), ...intent };
+  const cleared = () => writes.filter((w) => /UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = \$1/.test(w.sql) && w.params[0] === 44).length;
+  const appHost = () => writes.filter((w) => /SET app_host/.test(w.sql)).map((w) => JSON.parse(w.params[1]));
+  const lastHost = () => Object.assign({}, ...appHost());
+  return { r, writes, logs, deps, inst, it, cleared, lastHost, run: () => renderStandupInstance(inst, deps, it) };
+}
+
+const writesTo = (calls) => calls.filter((c) => c.method !== 'GET');
+
+console.log('greenfield:');
+await ta('creates the database, then the service, sets the origins, then deploys — and clears the key', async () => {
+  const h = harness();
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.method + ' ' + c.path.replace(/env-vars\/.*/, 'env-vars/*')), [
+    'POST /postgres', 'POST /services',
+    'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*', 'PUT /services/srv-new/env-vars/*',
+    'POST /services/srv-new/deploys',
+  ]);
+  const origins = h.r.calls.filter((c) => c.method === 'PUT').map((c) => [c.path.split('/').pop(), c.body.value]);
+  assert.deepEqual(origins, [['BONGOS_PUBLIC_ORIGIN', SVC_URL], ['BONGOS_BUILDERS_ORIGIN', SVC_URL], ['BONGOS_STATUS_ORIGIN', SVC_URL], ['BONGOS_OAUTH_ORIGIN', SVC_URL]]);
+  assert.equal(h.cleared(), 1, 'the key column is cleared');
+  const host = h.lastHost();
+  assert.deepEqual([host.postgresId, host.serviceId, host.state, host.serviceUrl, host.error], ['dpg-new', 'srv-new', 'deploying', SVC_URL, null], 'the row records what was created');
+});
+
+await ta('the service is the pilot\'s: node runtime, explicit start + migrate, HOST, the database SVC_URL, a fresh secret, the owner seated', async () => {
+  const h = harness();
+  await h.run();
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.equal(svc.ownerId, OURS);
+  assert.equal(svc.repo, 'https://github.com/example-owner/demo');
+  assert.equal(svc.serviceDetails.runtime, 'node');
+  assert.match(svc.serviceDetails.envSpecificDetails.startCommand, /platform-server\.js$/);
+  assert.match(svc.serviceDetails.envSpecificDetails.preDeployCommand, /migrate\.sh$/);
+  const env = Object.fromEntries(svc.envVars.map((v) => [v.key, v.value]));
+  assert.equal(env.HOST, '0.0.0.0');
+  assert.equal(env.DATABASE_URL, 'postgres://internal');
+  assert.equal(env.PGDATABASE, 'postgres://internal');
+  assert.match(env.BUILDER_SECRET_KEY, /^[0-9a-f]{64}$/);
+  assert.equal(env.BONGOS_FIRST_ADMIN, 'owner-login');
+  assert.ok(!('PORT' in env), 'Render injects PORT');
+  const stored = JSON.stringify(h.writes.map((w) => w.params));
+  assert.ok(!stored.includes(env.BUILDER_SECRET_KEY) && !stored.includes('postgres://internal') && !stored.includes('rnd_borrowed'),
+    'no env var value and no key is ever written to our database');
+});
+
+await ta('the plan is the project\'s own setting, not a constant', async () => {
+  const h = harness({ host: { webPlan: 'standard', dbPlan: 'basic_1gb', region: 'frankfurt' } });
+  await h.run();
+  const pg = h.r.calls.find((c) => c.path === '/postgres').body;
+  const svc = h.r.calls.find((c) => c.path === '/services').body;
+  assert.equal(pg.plan, 'basic_1gb');
+  assert.equal(pg.region, 'frankfurt');
+  assert.equal(svc.serviceDetails.plan, 'standard');
+  const d = harness();
+  await d.run();
+  assert.equal(d.r.calls.find((c) => c.path === '/postgres').body.plan, 'basic_256mb', 'the default is paid: free Postgres has no backups');
+  assert.equal(d.r.calls.find((c) => c.path === '/services').body.serviceDetails.plan, 'starter');
+});
+
+await ta('a retry resumes onto what an earlier run created — no second database or service', async () => {
+  const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-new' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.ok(!h.r.calls.some((c) => c.method === 'POST' && (c.path === '/postgres' || c.path === '/services')));
+});
+
+console.log('\nadopt:');
+await ta('links an existing service and makes NO write call to Render', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), [], 'only reads');
+  assert.equal(h.lastHost().state, 'linked');
+  assert.equal(h.lastHost().serviceUrl, 'https://old.onrender.com');
+  assert.equal(h.cleared(), 1);
+});
+await ta('adopting a service from another workspace is refused, and the key still cleared', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: THEIRS } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(out.terminal, true);
+  assert.match(out.error, /from workspace tea-theirs/);
+  assert.equal(h.lastHost().state, 'failed');
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe guard stops the run:');
+await ta('a database answered from another workspace stops everything after it', async () => {
+  const h = harness({ render: { 'POST /postgres': { id: 'dpg-x', status: 'creating', owner: { id: THEIRS } } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /refusing to go on/);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.path), ['/postgres'], 'no service, no env vars, no deploy');
+  assert.equal(h.cleared(), 1);
+});
+await ta('a workspace the key cannot reach is refused before any other call', async () => {
+  const h = harness({ render: { 'GET /owners?limit=100': [{ owner: { id: THEIRS } }] } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /cannot reach workspace/);
+  assert.equal(h.r.calls.length, 1);
+  assert.equal(h.cleared(), 1);
+});
+await ta('the workspace is never taken from the list — with none named, nothing is called', async () => {
+  const h = harness({ host: { ownerId: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe key is cleared whatever happens:');
+for (const [name, opts, re] of [
+  ['Render answers an error', { render: { 'POST /services': new Error('plan not allowed') } }, /plan not allowed/],
+  ['the key cannot be decrypted', { decryptThrows: true }, /bad tag/],
+  ['the key waited too long', { intent: { created_at: new Date(Date.now() - KEY_TTL_MS - 1000).toISOString() } }, /waited too long/],
+  ['no key came with the request', { intent: { borrowed_key_enc: null } }, /no Render key/],
+  ['the project is not set to Render', { host: { platform: 'vercel' } }, /not set to run on Render/],
+  ['an unknown plan', { host: { webPlan: 'huge' } }, /unknown Render web plan/],
+]) {
+  await ta(`${name} → terminal, reason recorded, key cleared`, async () => {
+    const h = harness(opts);
+    const out = await h.run();
+    assert.equal(out.ok, false);
+    assert.equal(out.terminal, true);
+    assert.match(out.error, re);
+    assert.equal(h.lastHost().state, 'failed');
+    assert.equal(h.cleared(), 1);
+  });
+}
+
+console.log('\nthe runner retires a terminal failure — no silent retry:');
+function drain(resultOfLeg) {
+  let claims = 0; const resolved = [], requeued = [];
+  const h = harness(resultOfLeg);
+  const deps = {
+    ...h.deps, exec: () => '', controlExec: () => '', sleep: async () => {},
+    db: { query: async (sql, params) => { if (/state='pending'/.test(sql)) requeued.push(params); return h.deps.db.query(sql, params); } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { ...h.it, instance_id: 18, attempts: 1 } : null),
+      getInstanceById: async () => ({ ...h.inst }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async () => {}, recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  return { deps, resolved, requeued, h };
+}
+await ta("cmdRunIntents routes 'render-standup' to the leg, and a success resolves done", async () => {
+  const d = drain({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 0, JSON.stringify(out));
+  assert.deepEqual(d.resolved, [{ id: 44, state: 'done', err: null }]);
+});
+await ta('a failure is retired on its FIRST attempt, never re-queued', async () => {
+  const d = drain({ render: { 'GET /owners?limit=100': [] } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 1);
+  assert.deepEqual(d.requeued, [], 'not put back to pending');
+  assert.equal(d.resolved.length, 1);
+  assert.equal(d.resolved[0].state, 'error');
+  assert.match(d.resolved[0].err, /cannot reach workspace/);
+});
+
+console.log('\nteardown forgets, never deletes:');
+await ta('forgetRenderApp records the disconnect and calls nothing', async () => {
+  const writes = [], logs = [];
+  const inst = { id: 18, app_host: { platform: 'render', serviceId: 'srv-new', postgresId: 'dpg-new' } };
+  await forgetRenderApp(inst, { db: { query: async (sql, p) => { writes.push(p); return { rows: [] }; } }, log: (l) => logs.push(l), apply: true });
+  assert.equal(JSON.parse(writes[0][1]).state, 'disconnected');
+  assert.match(logs.join('\n'), /nothing on Render is deleted/);
+  await forgetRenderApp({ id: 19, app_host: null }, { db: { query: async () => { throw new Error('must not write'); } }, log: () => {}, apply: true });
+});
+await ta('the teardown leg reaches forgetRenderApp, and the leg has no path to a Render delete', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision-teardown.js', import.meta.url), 'utf8');
+  assert.match(src, /forgetRenderApp\(inst/);
+  const leg = readFileSync(new URL('../scripts/gds/provision-render.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(leg, /'DELETE'|\.delete[A-Z]/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/provisioning_render_route.mjs

@@ -0,0 +1,216 @@
+// tests/provisioning_render_route.mjs — POST /provisioning/instances/:id/render and its
+// queue seam (task 1004183; ADR 0327).
+//
+// The load-bearing assertions:
+//   • OWNER ONLY: the key and the Render account are the owner's, so an archon on someone
+//     else's project gets the same 404 as a stranger, and nothing is encrypted or queued
+//   • only CIPHERTEXT reaches the queue — the plaintext key is never passed on, never in
+//     the reply, never in the audit event
+//   • the shape is checked before anything is kept; the web tier makes no Render call
+//   • no secret box → 503, and the key is not kept
+//   • a conflicting open intent → 409, and the key is not kept
+//   • the queue seam writes the intent AND the row in ONE statement, so a collision on
+//     the open-intent index stores nothing at all
+//
+// DB-free: data access is stubbed on the cached module objects, over a real mounted
+// router. No network beyond localhost. Run:  node tests/provisioning_render_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const renderStandup = require('../modules/provisioning/render-standup.js');
+const secretBox = require('../src/bongos/secret-box.js');
+const guard = require('../modules/provisioning/control-plane-guard.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const KEY = 'rnd_abcdefghijklmnopqrstuvwx';
+let instance = null, enqueueCalls = [], enqueueResult = null, events = [], boxOn = true;
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+const realEnqueue = renderStandup.enqueueRenderStandup;
+renderStandup.enqueueRenderStandup = async (_db, id, args) => {
+  enqueueCalls.push({ id, ...args });
+  return enqueueResult || { intent: { id: 9, action: 'render-standup', state: 'pending' } };
+};
+secretBox.isConfigured = () => boxOn;
+secretBox.encrypt = (plain) => `v1.sealed(${plain.length})`;
+
+const api = require('../src/module-api.js');
+let builder = null;
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/render-standup.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(Array.isArray(details) ? { details } : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+const LIVE = { owner_builder_id: 7, slug: 'spike', status: 'active', hosting_shape: 'cloud-host', target_ref: 'example-owner/spike' };
+function reset(patch = {}) {
+  instance = { ...LIVE, ...patch };
+  enqueueCalls = []; enqueueResult = null; events = []; boxOn = true;
+  builder = { id: 7, github_login: 'owner', rank: 'thetes' };
+}
+const PATH = '/provisioning/instances/18/render';
+const GREEN = { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'greenfield' };
+const noKeyAnywhere = (...xs) => xs.forEach((x) => assert.ok(!JSON.stringify(x).includes(KEY), 'the plaintext key leaked: ' + JSON.stringify(x)));
+
+console.log('who may ask:');
+await ta('the owner queues it: ciphertext only, the request recorded on the row, one audit event', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, web_plan: 'standard' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls.length, 1);
+  assert.equal(enqueueCalls[0].keyEnc, `v1.sealed(${KEY.length})`);
+  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null, webPlan: 'standard' });
+  assert.equal(events.length, 1);
+  noKeyAnywhere(enqueueCalls, events, r.body);
+});
+await ta('an ARCHON on someone else\'s project gets 404 — nothing encrypted, queued or recorded', async () => {
+  reset();
+  builder = { id: 42, github_login: 'arch', rank: 'archon' };
+  let sealed = 0; const enc = secretBox.encrypt; secretBox.encrypt = (p) => { sealed++; return enc(p); };
+  const r = await post(PATH, GREEN);
+  secretBox.encrypt = enc;
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(sealed, 0);
+  assert.equal(enqueueCalls.length, 0);
+  assert.equal(events.length, 0);
+});
+await ta('a missing project is 404', async () => {
+  reset(); instance = null;
+  assert.equal((await post(PATH, GREEN)).status, 404);
+});
+
+console.log('\nthe shape is checked first:');
+for (const [name, body, re] of [
+  ['a key that is not a Render key', { ...GREEN, key: 'ghp_notrender' }, /Render API key/],
+  ['a workspace id of the wrong shape', { ...GREEN, owner_id: 'srv-abcdefgh1234' }, /workspace/],
+  ['an unknown mode', { ...GREEN, mode: 'migrate' }, /link a Render service/],
+  ['adopt with no service', { ...GREEN, mode: 'adopt' }, /service to link/],
+  ['greenfield naming a service', { ...GREEN, service_id: 'srv-abcdefgh1234' }, /leave the service out/],
+  ['an unknown plan', { ...GREEN, db_plan: 'free' }, /not a Render database plan/],
+]) {
+  await ta(`${name} → 400, nothing kept`, async () => {
+    reset();
+    const r = await post(PATH, body);
+    assert.equal(r.status, 400, r.raw);
+    assert.match(r.body.error.message, re);
+    assert.equal(enqueueCalls.length, 0);
+    noKeyAnywhere(r.body);
+  });
+}
+await ta('an unknown field is refused by the strict validator', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, value: 'x' });
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('adopt with a service id is accepted and records it', async () => {
+  reset();
+  const r = await post(PATH, { ...GREEN, mode: 'adopt', service_id: 'srv-abcdefgh1234' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueueCalls[0].appHost.serviceId, 'srv-abcdefgh1234');
+});
+
+console.log('\nrefusals keep nothing:');
+await ta('greenfield with no repository → 409', async () => {
+  reset({ target_ref: null });
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 409, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('a removed project → 409', async () => {
+  reset({ status: 'torn_down' });
+  assert.equal((await post(PATH, GREEN)).status, 409);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('no secret box → 503, and the key is not kept', async () => {
+  reset(); boxOn = false;
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 503, r.raw);
+  assert.equal(enqueueCalls.length, 0);
+});
+await ta('something already open → 409 saying the key was not kept', async () => {
+  reset(); enqueueResult = { conflict: 'open_intent', intent: { action: 'provision', state: 'running' } };
+  const r = await post(PATH, GREEN);
+  assert.equal(r.status, 409, r.raw);
+  assert.match(r.body.error.message, /not kept/);
+  assert.equal(events.length, 0);
+});
+
+console.log('\nthe queue seam:');
+const realGuard = guard.assertIntentAllowed;
+guard.assertIntentAllowed = async () => {};
+await ta('one statement writes the intent with the ciphertext and merges the row', async () => {
+  const sqls = [];
+  const db = { query: async (sql, params) => { sqls.push({ sql, params }); return { rows: [{ id: 5, action: 'render-standup', state: 'pending' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234' }, requestedBy: 'api:self' });
+  assert.equal(out.intent.id, 5);
+  assert.equal(sqls.length, 1, 'a single statement — both land or neither does');
+  assert.match(sqls[0].sql, /INSERT INTO provisioning_intents[\s\S]*borrowed_key_enc[\s\S]*UPDATE provisioning_instances[\s\S]*app_host/);
+  assert.equal(sqls[0].params[2], 'v1.x');
+  assert.doesNotMatch(sqls[0].sql, /RETURNING \*[\s\S]*SELECT i\.\*/, 'the ciphertext is not read back');
+});
+await ta('a collision on the open-intent index stores nothing and names the blocker', async () => {
+  let n = 0;
+  const db = { query: async () => { if (n++ === 0) throw Object.assign(new Error('dup'), { code: '23505' }); return { rows: [{ id: 3, action: 'teardown', state: 'pending' }] }; } };
+  const out = await realEnqueue(db, 18, { keyEnc: 'v1.x', appHost: { mode: 'greenfield', ownerId: 'tea-abcdefgh1234' } });
+  assert.equal(out.conflict, 'open_intent');
+  assert.equal(out.intent.action, 'teardown');
+});
+guard.assertIntentAllowed = realGuard;
+
+console.log('\nwiring:');
+await ta('module.json mounts the route; the action is in the vocabulary and the newest CHECK', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.routes.includes('render-standup'));
+  assert.ok(provisioning.INTENT_ACTIONS.includes('render-standup'));
+  const mig = readFileSync(new URL('../modules/provisioning/migrations/provisioning_028_render_standup.sql', import.meta.url), 'utf8');
+  assert.match(mig, /borrowed_key_enc IS NULL OR state IN \('pending', 'running'\)/, 'a resolved intent cannot keep a key');
+});
+await ta('every path that resolves an intent clears the key', () => {
+  const src = readFileSync(new URL('../modules/provisioning/provisioning.js', import.meta.url), 'utf8');
+  const resolve = src.slice(src.indexOf('async function resolveIntent'), src.indexOf('async function resolveIntent') + 400);
+  assert.match(resolve, /borrowed_key_enc = NULL/);
+  const teardown = src.slice(src.indexOf('async function enqueueTeardown'), src.indexOf('async function enqueueTeardown') + 600);
+  assert.match(teardown, /borrowed_key_enc = NULL/, 'a superseded standup drops its key');
+  assert.match(teardown, /'render-standup'\) AND state = 'pending'/);
+});
+
+server.close();
+console.log(`\nprovisioning_render_route: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_settings_apply.mjs

@@ -169,7 +169,7 @@ await ta('enqueueTeardown supersedes a PENDING settings push (a push into a proj
   const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.superseded, true, 'the queued push was cancelled so the teardown could take the slot');
-  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
+  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
 });
 
 // ── the route, over a real mounted router (stubbed data access) ─────────────────

package/tests/provisioning_teardown_intent.mjs

@@ -31,7 +31,7 @@ const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
 
 // The actions a teardown supersedes, mirroring enqueueTeardown's SQL.
-const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private']);
+const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private', 'render-standup']);
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -81,7 +81,7 @@ function fakeIntentDb(seed = [], { shape = 'co-tenant' } = {}) {
         // dead work in front of a teardown (task 1003140 widened it to the settings
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
-        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/);
+        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup'\) AND state = 'pending'/);
         updates++;
         // The supersede must skip the platform's own row IN ITS OWN SQL (task 1004286): the
         // guard refuses that teardown only afterwards, in enqueueIntent. Modelled, not assumed.