@bongos/core 1.19.1080 → 1.20.1

package/scripts/gds/grade-correlation-audit.js

@@ -57,8 +57,11 @@ const INDEPENDENT_KAPPA = 0.4;
 // A worker's vote on one grade: 1 objects, 0 clears, null no signal.
 function voteOf(w) {
   if (!w || typeof w !== 'object') return null;
-  const issues = Array.isArray(w.issues) ? w.issues : [];
-  const substantive = issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+  // A stored attempt keeps severities only (task 1004292); a full grade keeps issues.
+  const severities = Array.isArray(w.severities)
+    ? w.severities
+    : (Array.isArray(w.issues) ? w.issues : []).map((i) => i && i.severity);
+  const substantive = severities.some((sv) => sv === 'blocker' || sv === 'major');
   if (w.error && !substantive) return null;
   if (w.verdict === 'pass') return 0;
   if (w.verdict === 'concerns' || w.verdict === 'fail') return 1;
@@ -148,23 +151,47 @@ function classify(kappa) {
 // One stored grade → the slim row the audit reads (review prose hashed, as in
 // the replay corpus): { task_id, task_status, passed, workers }, or null when
 // it is not a panel grade.
+//
+// task 1004292: grade.attempts (every round that kept its verdicts, oldest first,
+// served beside the grade) becomes `rounds`; a task with none falls back to its
+// final grade alone, exactly as before.
 function toAuditRow({ task_id, task_status, grade }) {
+  const attempts = grade && Array.isArray(grade.attempts) ? grade.attempts : [];
+  const rounds = attempts.map((a) => (a && Array.isArray(a.workers) ? a.workers : null)).filter((w) => w && w.length);
   const row = trimRecordedGrade({ task_id, grade });
-  return row ? { task_id: row.task_id, task_status: task_status || null, passed: !!(grade && grade.passed === true), workers: row.workers } : null;
+  if (!row && rounds.length === 0) return null;
+  return {
+    task_id: String(task_id),
+    task_status: task_status || null,
+    passed: !!(grade && grade.passed === true),
+    workers: row ? row.workers : rounds[rounds.length - 1],
+    ...(rounds.length ? { rounds } : {}),
+  };
+}
+
+// The panels one dataset row contributes: every recorded round when there are
+// any (the LAST one is the final grade, the one the owner's decision is about),
+// else the final grade alone.
+function panelsOf(g) {
+  const sets = Array.isArray(g.rounds) && g.rounds.length ? g.rounds : [g.workers];
+  return sets
+    .map((workers, i) => ({ task_id: String(g.task_id), final: i === sets.length - 1, votes: panelVotes(workers) }))
+    .filter((p) => Object.keys(p.votes).length > 0);
 }
 
 // The whole report, pure over a dataset { grades: [toAuditRow…], overrides: [{task_id, status}] }.
 function audit(dataset, { minN = MIN_N } = {}) {
   const floor = Math.max(MIN_N, Number(minN) || MIN_N);
-  const panels = (dataset.grades || [])
-    .map((g) => ({ task_id: String(g.task_id), votes: panelVotes(g.workers) }))
-    .filter((p) => Object.keys(p.votes).length > 0);
+  // Agreement between workers reads EVERY round; the owner's decision is about
+  // the work as it landed, so the owner-facing statistics read final rounds only.
+  const panels = (dataset.grades || []).flatMap(panelsOf);
+  const finals = panels.filter((p) => p.final);
   const labels = ownerLabels(dataset);
   // 1 when the worker's vote disagrees with the owner (objected to accepted
   // work, or cleared rejected work); only on labelled tasks it voted on.
-  const errorOf = (p, kind) => (labels.has(p.task_id) && kind in p.votes
+  const errorOf = (p, kind) => (!p.final ? null : (labels.has(p.task_id) && kind in p.votes
     ? Number(p.votes[kind] !== (labels.get(p.task_id).label === 'reject' ? 1 : 0))
-    : null);
+    : null));
 
   const pairwise = [];
   for (let i = 0; i < PANEL.length; i++) {
@@ -186,7 +213,7 @@ function audit(dataset, { minN = MIN_N } = {}) {
   const byLabel = { accept: 0, reject: 0 };
   for (const v of labels.values()) byLabel[v.label]++;
   const perWorker = PANEL.map((kind) => {
-    const pairs = panels
+    const pairs = finals
       .filter((p) => labels.has(p.task_id) && kind in p.votes)
       .map((p) => [p.votes[kind], labels.get(p.task_id).label === 'reject' ? 1 : 0]);
     return { kind, ...guardedStats(pairs, floor) };
@@ -195,6 +222,7 @@ function audit(dataset, { minN = MIN_N } = {}) {
   return {
     min_n: floor,
     panels: panels.length,
+    tasks: finals.length,
     pairwise,
     mean_pairwise_phi: meanPhi,
     effective_votes: meanPhi == null ? null : effectiveVotes(PANEL.length, meanPhi),
@@ -223,7 +251,7 @@ const statLine = (s) => (s.refused ? `REFUSED — ${s.refused}` : `n=${s.n}  agr
 
 function printReport(r) {
   const out = [];
-  out.push(`grade correlation audit — ${r.panels} recorded panel grade(s), minimum n = ${r.min_n}`);
+  out.push(`grade correlation audit — ${r.panels} recorded panel round(s) over ${r.tasks} task(s), minimum n = ${r.min_n}`);
   out.push('A vote is OBJECTS (concerns/fail) or CLEARS (pass); an errored worker with no finding casts none.');
   out.push('');
   out.push('(a) Do the workers fail differently? — agreement between each pair on the same task');
@@ -247,8 +275,9 @@ function printReport(r) {
   out.push('');
   out.push('Caveats: labels exist only where a person decided — override requests and manual confirms of work the');
   out.push('panel did not pass — so they are a selected set, not a sample. A grade that auto-landed on a pass is');
-  out.push('never a label (that is the grader agreeing with itself). Only each task\'s LATEST grade keeps per-worker');
-  out.push('verdicts (grade_attempts stores pass/score only), so a re-graded task counts once, as its final round.');
+  out.push('never a label (that is the grader agreeing with itself). Agreement (a) reads every round that kept its');
+  out.push('per-worker verdicts (grade_attempts.worker_verdicts); rounds graded before that column existed are lost,');
+  out.push('and such a task counts once, as its final grade. Owner comparisons (b) and error correlation read final rounds only.');
   console.log(out.join('\n'));
 }
 
@@ -271,6 +300,7 @@ module.exports = {
   effectiveVotes,
   ownerLabels,
   panelVotes,
+  panelsOf,
   toAuditRow,
   voteOf,
 };

package/scripts/gds/grade-replay.js

@@ -160,7 +160,7 @@ async function fetchRecentGrades({ recent = 150, statuses = ['shipped', 'complet
   const out = new Array(picked.length).fill(null);
   for (let i = 0; i < picked.length; i += FETCH_CONCURRENCY) {
     await Promise.all(picked.slice(i, i + FETCH_CONCURRENCY).map(async (t, j) => {
-      const r = await api.tasks.getTasksId({ id: t.id, query: { include: 'grade' } });
+      const r = await api.tasks.getTasksId({ id: t.id, query: { include: 'grade,grade_attempts' } });
       if (r.ok && r.data && r.data.grade) out[i + j] = { task_id: t.id, task_status: t.status, at: t.at, grade: r.data.grade };
     }));
   }

package/scripts/gds/provision-core-upgrade.js

@@ -35,6 +35,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
 const { appUser, dbName, instanceUser, parseTargetRef, resolveOwnerGithubToken, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
+const { ensurePinWriteKey, hasOwnAccount, pinKeyPath, pinSshCommand } = require('./provision-pin-key.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const { RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES, parseChangeRecords, notesBetween } = require('./release-notes.js');
 
@@ -329,16 +330,20 @@ async function coreUpgradeInstance(inst, deps, intent) {
 // on top of them would change what the live box runs with no restart and no health check.
 // That is reported for an operator to reconcile, never resolved here.
 //
-// THE LIMIT, stated so nobody mistakes this for durable: the owner's token is kept for an
-// hour after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js
-// — one wizard sitting). An upgrade days later usually finds none; the box's own remote
-// is then tried, and it can only read a private repo. The note says so in words.
+// WHAT MAKES IT DURABLE (task 1004291, ADR 0350). The owner's token is kept for an hour
+// after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js — one
+// wizard sitting), so on its own it cannot carry an upgrade days later. The hub therefore
+// holds a per-project WRITE deploy key (provision-pin-key.js) and tries it FIRST: write key
+// → owner token (when fresh) → the box's own remote, which can only read a private repo.
+// A fresh token also mints the key when the project has none, so reconnecting GitHub once
+// is enough for every later upgrade. The note says which of these is missing, in words.
 
 const REPO_NOTE_PREFIX = 'repo_not_updated';
 const REPO_NOTES = Object.freeze({
   no_repo: 'This project has no GitHub repository on record, so the new version was saved on the server only.',
   no_branch: 'The server\'s copy of the project is not on a branch, so there was nothing to save to GitHub.',
-  no_access: 'The hub had no permission to write to the project\'s GitHub repository: the owner\'s GitHub access is only kept for an hour after they connect GitHub, and the server\'s own key can only read the repository.',
+  no_access: 'The hub had no permission to write to the project\'s GitHub repository: it holds no write key for it yet, the owner\'s GitHub access is only kept for an hour after they connect GitHub, and the server\'s own key can only read the repository. Reconnecting GitHub with repository access sets up lasting access.',
+  needs_account: 'The hub could not set up lasting write access to the project\'s GitHub repository: this project needs its own account on the server first. Once it has one, reconnecting GitHub with repository access sets up lasting access.',
   refused: 'GitHub turned down the owner\'s GitHub access — it may have expired, or lack permission to write to the repository.',
   behind: 'GitHub has changes the server does not have, so the new version could not be added on top of them. An operator needs to bring the two back in line; the site itself is running normally.',
   failed: 'The hub could not save the new version to GitHub.',
@@ -399,6 +404,9 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   };
   const repo = parseTargetRef(inst.target_ref);
   if (!repo) return miss('no_repo');
+  // Exported and callable on its own, and the slug reaches shell strings below (the write
+  // key's path), so it is checked here rather than trusting coreUpgradeInstance's own guard.
+  if (!isValidSlug(inst.slug)) return miss('failed', '(the project name is not a valid slug)');
   const head = exec(`git -C ${instanceDir} symbolic-ref --short HEAD`, { allowFail: true });
   const branch = failedRun(head) ? '' : String(head.stdout || '').trim();
   if (!BRANCH_RE.test(branch)) return miss('no_branch');
@@ -407,6 +415,26 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const env = { GIT_TERMINAL_PROMPT: '0' };   // a refused credential fails; it never waits at a prompt
 
   const token = await resolveOwnerGithubToken(inst, deps, { tag: '[core-upgrade]' });
+
+  // 1. The hub's own WRITE key (ADR 0350). A fresh token mints it when the project has
+  // none yet — the reconnect the deploy page asks for — and the mint is best effort: a
+  // miss falls through to the token, then to the box's remote, exactly as before.
+  const fsImpl = deps.fsImpl || fs;
+  const keyPath = pinKeyPath(inst, deps);
+  if (token && !fsImpl.existsSync(keyPath)) await ensurePinWriteKey(inst, deps, { token });
+  if (fsImpl.existsSync(keyPath)) {
+    const r = exec(`${hardened} -c ${pinSshCommand(keyPath)} push git@github.com:${repo.owner}/${repo.name}.git HEAD:${branch}`,
+      { allowFail: true, env });
+    if (!failedRun(r)) {
+      log(`  ✓ pushed the pin to ${at} from the hub, over its write deploy key`);
+      return { pushed: true, via: 'write-key', branch };
+    }
+    const fault = pushFault(r);
+    // The key WORKED and the history stopped it: no other credential changes that.
+    if (fault === 'behind') return miss('behind', gitLine(r));
+    log(`  • ${inst.slug}: the write key did not push (${fault}) — trying the next credential`);
+  }
+
   if (token) {
     const credFile = path.join(os.tmpdir(), `bongos-gitcred-upgrade-${inst.slug}-${process.pid}-${crypto.randomBytes(6).toString('hex')}`);
     let r = null;
@@ -436,7 +464,10 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const fault = pushFault(r);
   // A refusal here is not the owner's access being turned down — there was none to turn
   // down. It is the read-only key, which is the no-access case.
-  return miss(fault === 'refused' ? 'no_access' : fault, gitLine(r));
+  // ...unless the project has no account of its own, in which case no key CAN be minted
+  // for it (ADR 0350) and reconnecting GitHub alone will not help: say that instead.
+  if (fault === 'refused') return miss(hasOwnAccount(inst, exec) ? 'no_access' : 'needs_account', gitLine(r));
+  return miss(fault, gitLine(r));
 }
 
 // The pre-flight lines a dry run emits, and the refusal when it has one. upgrade.js writes
@@ -990,4 +1021,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/provision-pin-key.js

@@ -0,0 +1,176 @@
+'use strict';
+// provision-pin-key.js — the hub's per-project WRITE deploy key (task 1004291, ADR 0350,
+// amending ADR 0176).
+//
+// WHY. A hosted project's upgrade commits a new core pin in the project's checkout, and
+// the hub pushes it to the owner's GitHub repo (task 1004065, pushUpgradePin). The owner's
+// token that would do that is stored for one hour only, and the checkout's own `origin`
+// is a READ-ONLY deploy key (ADR 0176) — so most pushes ended "GitHub was not updated" and
+// the box and the repo drifted. A second deploy key, registered WRITABLE and held by the
+// runner alone, is the lasting credential.
+//
+// WHERE IT LIVES AND WHO CAN READ IT. Outside every project checkout, in a directory of
+// the RUNNER's own account (mode 0700, key 0600). The project's own unix account
+// (bongos-<slug>, ADR 0281) can read neither. A project still running as the shared app
+// user has the SAME uid as the runner and could read it, so it is REFUSED a key
+// ("needs its own account first") rather than handed one.
+//
+// NEVER THROWS. A failure to mint is a missed convenience, not a broken standup: every
+// path returns `{ skipped }` and logs. The read-only pull key (deployKeyPath in
+// provision-repo.js) is untouched by anything here.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
+const { instanceUser, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo.js');
+
+const NEEDS_OWN_ACCOUNT = 'needs its own account first';
+
+// Both names below reach a shell (ssh-keygen -C/-f, rm -f), so the slug is checked HERE, at
+// the point of use, rather than trusting that some caller validated it first.
+function safeSlug(inst) {
+  const slug = inst && inst.slug;
+  if (!isValidSlug(slug)) throw new Error(`refusing to build a write-key path from an invalid slug ${JSON.stringify(slug)}`);
+  return slug;
+}
+function pinKeyTitle(inst) { return `cloudbongos-pin-${safeSlug(inst)}`; }
+
+// The runner-only directory. PROVISION_PIN_KEY_DIR pins it; otherwise it sits under the
+// runner account's own home. Never under standaloneBase, so it can never ride along with
+// (or be reached through) a project checkout.
+function pinKeyDir(deps = {}) {
+  const pinned = deps.pinKeyDir || process.env.PROVISION_PIN_KEY_DIR;
+  if (pinned) return String(pinned).replace(/\\/g, '/');
+  return path.posix.join(os.homedir().replace(/\\/g, '/'), '.config', 'cloudbongos', 'pin-keys');
+}
+function pinKeyPath(inst, deps = {}) { return path.posix.join(pinKeyDir(deps), `${safeSlug(inst)}.key`); }
+
+const failed = (r) => !r || r.softFailed === true || r.ok === false;
+
+// Does this project have a unix account of its own? Fail CLOSED: only a positive answer
+// counts, because the wrong guess hands a tenant process the key that pushes to the
+// owner's repo.
+function hasOwnAccount(inst, exec) {
+  let account;
+  try { account = instanceUser(inst); } catch { return false; }
+  const r = exec(`id -u ${account}`, { allowFail: true });
+  return !failed(r) && /^\d+$/.test(String((r && r.stdout) || '').trim());
+}
+
+// Create the directory (0700) and mint the key (0600), then PROVE the modes: a key that
+// GitHub trusts to write must never be group- or world-readable.
+function mintLocal(inst, exec, deps) {
+  const dir = pinKeyDir(deps), keyPath = pinKeyPath(inst, deps), title = pinKeyTitle(inst);
+  exec(`(umask 077 && mkdir -p ${dir}) && chmod 700 ${dir}`);
+  exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+  exec(`(umask 077 && ssh-keygen -q -t ed25519 -N '' -C ${title} -f ${keyPath})`);
+  exec(`chmod 600 ${keyPath}`);
+  const modes = exec(`stat -c '%a' ${dir} ${keyPath}`, { allowFail: true });
+  const got = String((modes && modes.stdout) || '').trim().split(/\s+/);
+  if (failed(modes) || got[0] !== '700' || got[1] !== '600') {
+    exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+    throw new Error(`the write key's permissions could not be confirmed as 700/600 (saw ${got.join('/') || 'nothing'})`);
+  }
+  return keyPath;
+}
+
+const keyBody = (k) => String(k || '').trim().split(/\s+/).slice(0, 2).join(' ');
+
+/**
+ * Make sure a per-project WRITE deploy key exists locally and is registered on the repo
+ * with `read_only: false`. `opts.token` is an owner token already in hand. Idempotent
+ * (by title; a stale or read-only same-title registration is replaced). NEVER THROWS.
+ * Returns `{ minted, keyPath }` or `{ skipped: <why>, note }`.
+ */
+async function ensurePinWriteKey(inst, deps, opts = {}) {
+  const log = deps.log || (() => {});
+  const exec = deps.controlExec || deps.exec;
+  if (!inst || inst.hosting_shape !== 'cloud-host') return { skipped: 'shape' };
+  if (!isValidSlug(inst.slug)) return { skipped: 'invalid_slug' };
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) return { skipped: 'no_repo' };
+  if (deps.apply === false) {
+    log(`  [pin-key] would mint a writable deploy key "${pinKeyTitle(inst)}" for ${repo.owner}/${repo.name}, held by the runner outside the checkout (ADR 0350)`);
+    return { planned: true };
+  }
+  try {
+    if (!hasOwnAccount(inst, exec)) {
+      log(`  [pin-key] ${inst.slug} ${NEEDS_OWN_ACCOUNT} — no write key minted (it runs as the runner's own user and could read it; ADR 0350)`);
+      return { skipped: 'needs_own_account', note: `This project ${NEEDS_OWN_ACCOUNT}.` };
+    }
+    const token = opts.token || await resolveOwnerGithubToken(inst, deps, { tag: '[pin-key]' });
+    if (!token) return { skipped: 'no_token' };
+    const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
+    const info = await gh.getUserRepo(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+    if (info && info.admin === false) {
+      log(`  [pin-key] the owner's credential is not admin on ${repo.owner}/${repo.name}; a deploy key needs admin — no write key minted`);
+      return { skipped: 'not_admin' };
+    }
+    const fsImpl = deps.fsImpl || fs;
+    const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
+    const target = { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl };
+    if (!fsImpl.existsSync(keyPath) || !fsImpl.existsSync(`${keyPath}.pub`)) mintLocal(inst, exec, deps);
+    let pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+    const ours = (await gh.listDeployKeys(token, target)).find((k) => k.title === title);
+    if (ours && keyBody(ours.key) === keyBody(pub) && ours.read_only === false) {
+      return { minted: false, keyPath };
+    }
+    if (ours) await gh.deleteDeployKey(token, { ...target, keyId: ours.id });
+    const add = () => gh.addDeployKey(token, { ...target, title, key: pub, readOnly: false });
+    let added;
+    try { added = await add(); } catch (e) {
+      if (!e || e.code !== 'key_in_use') throw e;
+      mintLocal(inst, exec, deps);
+      pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+      added = await add();
+    }
+    if (added && added.read_only === true) {
+      // GitHub registered it read-only anyway: it would never write, and a key that looks
+      // like a write key but is not is worse than none.
+      await gh.deleteDeployKey(token, { ...target, keyId: added.id }).catch(() => {});
+      return { skipped: 'registered_read_only' };
+    }
+    log(`  [pin-key] registered writable deploy key "${title}" on ${repo.owner}/${repo.name}`);
+    return { minted: true, keyPath };
+  } catch (e) {
+    log(`  [pin-key] write key not set up for ${inst.slug}: ${(e && e.message) || e}`);
+    return { skipped: 'failed', note: String((e && e.message) || e).slice(0, 160) };
+  }
+}
+
+// The `-c` that points ONE git push at the write key. IdentitiesOnly + -F /dev/null so no
+// agent or ~/.ssh/config identity can answer instead. PURE.
+function pinSshCommand(keyPath) {
+  return `core.sshCommand="ssh -F /dev/null -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`;
+}
+
+/**
+ * Remove the write key: the registration (when a token is at hand) and the local files.
+ * Best effort, never throws. `keys` is an already-fetched deploy-key list, to save a call.
+ */
+async function revokePinWriteKey(inst, deps, { token = null, repo = null, keys = null } = {}) {
+  const log = deps.log || (() => {});
+  const exec = deps.controlExec || deps.exec;
+  const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
+  if (token && repo) {
+    try {
+      const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
+      const list = keys || await gh.listDeployKeys(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+      const ours = list.find((k) => k.title === title);
+      if (ours) {
+        if (deps.apply === false) log(`  would revoke the "${title}" deploy key on ${repo.owner}/${repo.name} if present`);
+        else {
+          await gh.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
+          log(`  revoked the "${title}" write deploy key on ${repo.owner}/${repo.name}`);
+        }
+      }
+    } catch (e) { log(`  (write-key revoke skipped: ${(e && e.message) || e})`); }
+  } else if (repo) {
+    log(`  (write-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${title}" deploy key, remove it in the repo's settings)`);
+  }
+  if (deps.apply !== false) exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+}
+
+module.exports = { NEEDS_OWN_ACCOUNT, hasOwnAccount, pinKeyTitle, pinKeyDir, pinKeyPath, ensurePinWriteKey, revokePinWriteKey, pinSshCommand };

package/scripts/gds/provision-render.js

@@ -0,0 +1,189 @@
+'use strict';
+// provision-render.js — the Render standup leg: the runner half of the `render-standup`
+// intent (task 1004183; ADR 0327, ADR 0345). What it stands up is the project's APP, from
+// the project's own repository — never the Bongos hall, which we host (task 1004350). Its own file because provision.js sits at
+// the size ratchet; the dispatch there requires it inline.
+//
+// WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
+// lent for this one run:
+//   - ADOPT links a Render service the owner already runs for this repository. It reads
+//     that service through the workspace guard, checks it builds this project's
+//     repository, and records it. It makes NO write call to their account.
+//   - GREENFIELD creates the Postgres when the owner asked for one, then the web service
+//     (render-payload.js decides what they are). Render deploys a new service on its own.
+// Ids are written to the row as each resource is created, so an owner who re-enters their
+// key after a failure resumes onto what already exists instead of creating a second one.
+//
+// THE KEY IS BORROWED, NEVER STORED (ADR 0327 §2). It reaches this leg encrypted on the
+// intent (provisioning_intents.borrowed_key_enc). It is decrypted here, used for this run
+// only, and the column is cleared in a `finally` — on success, on a refusal and on a
+// throw. resolveIntent clears it again, and the table's CHECK refuses a resolved intent
+// that still holds one. What the encryption buys, said plainly: it protects the key from
+// a database dump or a nightly backup while the intent waits. It does NOT defend against
+// a compromised web tier — the key arrives there in plaintext before anything can
+// encrypt it.
+//
+// A FAILURE IS TERMINAL. Every failure returns `terminal: true`, so the runner retires the
+// intent instead of re-queuing it. There is no key left to retry with, and an unattended
+// retry holding someone else's cloud credential is not a thing this platform does: the
+// owner retries by entering their key again.
+//
+// Every Render call goes through scripts/gds/render-api.js, which pins the workspace and
+// asserts it on every response, and which cannot delete.
+
+const { RenderApi } = require('./render-api.js');
+const payload = require('./render-payload.js');
+const { parseTargetRef } = require('./provision-repo-auth.js');
+
+// A key waiting longer than this was lent for a run that never came. It is refused and
+// cleared rather than spent late.
+const KEY_TTL_MS = 30 * 60 * 1000;
+
+function renderApiFor(deps, token, ownerId) {
+  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
+  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
+}
+
+// Merge `patch` into the row's app_host. The runner is the only writer while an intent
+// runs, and the web tier only writes it when enqueuing, which the open-intent index
+// serialises — so a merge needs no read-modify-write.
+async function recordAppHost(db, instId, patch) {
+  await db.query(
+    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
+    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
+}
+
+async function clearBorrowedKey(db, intentId) {
+  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
+}
+
+// Whether a Render service's repository is this project's. Render reports it as a URL;
+// compared as owner/name, case-insensitively, the way GitHub resolves them.
+function sameRepo(renderRepo, targetRef) {
+  const a = parseTargetRef(renderRepo), b = parseTargetRef(targetRef);
+  return !!(a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase());
+}
+
+async function adopt(api, inst, host, { db, log }) {
+  if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
+  const svc = await api.getService(host.serviceId);
+  // Linking someone's other service to this project would show its URL as this app's.
+  if (!sameRepo(svc.repo, inst.target_ref)) {
+    throw new Error(`Render service ${svc.id} builds ${svc.repo || 'no repository'}, not ${inst.target_ref}`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
+  log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
+  return { ok: true };
+}
+
+async function greenfield(api, inst, host, deps) {
+  const { db, log } = deps;
+  const plans = payload.plansFor(host);
+  const build = payload.buildFor(host);
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
+
+  // 1. The database, only when the owner asked for one — reused if a previous run got
+  //    this far.
+  let dbUrl = null;
+  if (host.database === true) {
+    let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
+    if (!pg) {
+      pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
+      await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
+      log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+    }
+    await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
+    const conn = await api.postgresConnectionInfo(pg.id);
+    dbUrl = conn && conn.internalConnectionString;
+    if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
+  }
+
+  // 2. The app's web service — reused likewise. Render starts its first deploy itself.
+  let svc = host.serviceId ? await api.getService(host.serviceId) : null;
+  if (!svc) {
+    const created = await api.createService(payload.renderServicePayload(inst, {
+      ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
+      webPlan: plans.webPlan, region: plans.region, build, dbUrl,
+    }));
+    svc = created.service;
+    await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
+    log(`  [render] created web service ${svc.id} (${plans.webPlan}, ${build.runtime})`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
+  log(`  [render] ${inst.slug} is deploying at ${url}`);
+  return { ok: true };
+}
+
+async function renderStandupInstance(inst, deps, intent) {
+  const { db, log } = deps;
+  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
+  const host = inst.app_host || {};
+  try {
+    if (!intent || !intent.borrowed_key_enc) return refuse('no Render key came with this request — enter it again to retry');
+    if (host.platform !== 'render') return refuse(`this project's app is not set to run on Render (platform '${host.platform || 'none'}')`);
+    if (!host.ownerId) return refuse('no Render workspace was chosen');
+    const age = Date.now() - new Date(intent.created_at || 0).getTime();
+    if (!(age < KEY_TTL_MS)) return refuse('the Render key waited too long to be used and was cleared — enter it again to retry');
+    if (host.mode !== 'adopt' && host.mode !== 'greenfield') return refuse(`unknown Render setup mode '${host.mode}'`);
+
+    const api = renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
+    // Membership, never selection: the workspace is the one the owner named, and it must
+    // be one this key can act in.
+    const owners = await api.listOwners();
+    if (!owners.some((o) => o.id === host.ownerId)) return refuse(`this Render key cannot reach workspace ${host.ownerId}`);
+
+    return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
+  } catch (e) {
+    return refuse(e && e.message ? e.message : String(e));
+  } finally {
+    if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
+  }
+
+  async function refuse(error) {
+    await recordAppHost(db, inst.id, { state: 'failed', error }).catch(() => {});
+    log(`  ✖ [render] ${inst.slug}: ${error}`);
+    return { ok: false, terminal: true, error };
+  }
+}
+
+// The wizard's path (task 1004352): Create queues the project's `provision` run, and the
+// key the owner lent arrives on THAT run a moment later (render-standup.js
+// attachToProvision). So after the project is set up, this runs the Render leg in the same
+// drain. The key is re-read from the row, because it may have been attached after this
+// run was claimed. Whatever happens the key is gone when this returns:
+//   - project up → the Render leg spends and clears it. Its failure is the APP's, recorded
+//     on app_host; the project itself is still up, so the provision run stays a success;
+//   - project not up → the key is cleared now and the app marked failed, so a provision
+//     retry never carries a key into a later run. The owner connects Render again once the
+//     project is up.
+async function afterProvision(inst, deps, intent, result) {
+  const { db } = deps;
+  const { rows } = await db.query(`SELECT borrowed_key_enc FROM provisioning_intents WHERE id = $1`, [intent.id]);
+  const keyEnc = rows[0] && rows[0].borrowed_key_enc;
+  if (!keyEnc) return result;
+  if (!result || result.ok === false) {
+    await clearBorrowedKey(db, intent.id);
+    await recordAppHost(db, inst.id, { state: 'failed', error: 'the project could not be set up, so its app was not set up on Render — connect Render again once the project is live' }).catch(() => {});
+    return result;
+  }
+  const fresh = (await deps.provisioning.getInstanceById(db, inst.id)) || inst;
+  const app = await renderStandupInstance(fresh, deps, { ...intent, borrowed_key_enc: keyEnc });
+  if (app.ok) return result;
+  return { ...result, doneNote: `project is up, but its app was not set up on Render: ${app.error}` };
+}
+
+// Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
+// the row so an operator can still say which services were the project's; the owner
+// deletes them in their own Render dashboard if they want to stop paying.
+async function forgetRenderApp(inst, { db, log, apply }) {
+  const host = inst.app_host;
+  if (!host || host.platform !== 'render') return;
+  const what = [host.serviceId && `service ${host.serviceId}`, host.postgresId && `database ${host.postgresId}`].filter(Boolean).join(' and ') || 'nothing yet';
+  log(`  [render] ${apply ? 'disconnected' : 'would disconnect'} from Render (${what}); nothing on Render is deleted — the owner removes it in their own dashboard`);
+  if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
+}
+
+module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };

package/scripts/gds/provision-teardown.js

@@ -12,6 +12,7 @@
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
 const { dbName, deployKeyPath, deployKeyTitle, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo.js');
+const { pinKeyPath, pinKeyTitle, revokePinWriteKey } = require('./provision-pin-key.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { caddySnippetPath, dnsReleaseEnv } = require('./provision-net.js');
 const apexMod = require('./instance-apex.js');
@@ -42,6 +43,8 @@ async function teardownInstance(inst, deps) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
   parkAddress(inst, { controlExec, log, apply });
+  // The app's Render services are the OWNER's: forget them, never delete them (ADR 0327 §3, task 1004183).
+  await require('./provision-render.js').forgetRenderApp(inst, { db, log, apply });
   // Revoke the instance's deploy key (ADR 0176) and remove its local halves. The
   // checkout itself is deliberately left in place (data is precious), so the key
   // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project
@@ -61,12 +64,16 @@ async function teardownInstance(inst, deps) {
               await ghRepos.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
               log(`  revoked the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name}`);
             }
-          } else log(`  would revoke the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name} if present`);
+            // The hub's WRITE key (ADR 0350) — the more dangerous of the two to leave behind.
+            await revokePinWriteKey(inst, { ...deps, controlExec: boxExec, apply: true, githubRepos: ghRepos }, { token, repo, keys });
+          } else log(`  would revoke the "${deployKeyTitle(inst)}" and write deploy keys on ${repo.owner}/${repo.name} if present`);
         } else {
-          log(`  (deploy-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${deployKeyTitle(inst)}" deploy key, remove it in the repo's settings)`);
+          log(`  (deploy-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${deployKeyTitle(inst)}" or "${pinKeyTitle(inst)}" deploy key, remove it in the repo's settings)`);
         }
       } catch (e) { log(`  (deploy-key revoke skipped: ${e && e.message})`); }
       boxExec(`rm -f ${deployKeyPath(inst)} ${deployKeyPath(inst)}.pub`, { allowFail: true });
+      // The write key's local half goes whatever happened above (lookup failed, no token).
+      boxExec(`rm -f ${pinKeyPath(inst, deps)} ${pinKeyPath(inst, deps)}.pub`, { allowFail: true });
     }
   }
   if (apply) {