@bongos/core 1.19.1080 → 1.20.1

package/scripts/gds/provision-units.js

@@ -390,6 +390,36 @@ function upsertEnvVars(body, vars) {
   return text;
 }
 
+// Env names a rename retired, carried forward ON THE BOX by the settings push (task
+// 1004395). The prelaunch-gate rename (task 1003152, ADR 0182) made PRELAUNCH_PASSWORD
+// primary and kept STEALTH_PASSWORD as an alias; the alias can only be dropped (task
+// 1003830) once every live web.env carries the new name, and before this the only way
+// to add it was the owner's SSH (blocker 1000147). [from, to] pairs.
+const ENV_RENAMES = Object.freeze([['STEALTH_PASSWORD', 'PRELAUNCH_PASSWORD']]);
+
+// Which renamed names does this web.env still hold ONLY under the old name? Returns
+// { vars, carried }: `vars` is the new name → the old line's right-hand side, copied
+// verbatim (quotes and all, so systemd reads the same value), for upsertEnvVars;
+// `carried` names the pairs and is the ONLY part that may reach a log or an event —
+// the value is a secret read on the box and it never leaves it. A new name that is
+// already set wins, even when it differs. The last line of a key counts, as systemd
+// reads it. PURE.
+function renamedEnvCarry(body) {
+  const lines = String(body == null ? '' : body).split(/\r?\n/);
+  const rhs = (key) => {
+    let v = null;
+    for (const l of lines) if (l.startsWith(`${key}=`)) v = l.slice(key.length + 1);
+    return v;
+  };
+  const isSet = (v) => v !== null && !['', '""', "''"].includes(v.trim());
+  const vars = {}, carried = [];
+  for (const [from, to] of ENV_RENAMES) {
+    const oldV = rhs(from);
+    if (isSet(oldV) && !isSet(rhs(to))) { vars[to] = oldV; carried.push(`${from} -> ${to}`); }
+  }
+  return { vars, carried };
+}
+
 // ── Cross-site identity: federate a hosted instance's sign-in through the hub ───
 // (ADR 0141 §4, task #1002109). The control plane IS the hub (cloudbongos.com), so
 // registration is a direct in-process call against the hub pool — no HTTP hop.
@@ -415,6 +445,7 @@ module.exports = {
   serviceUnitPath,
   settingsConsumed,
   settingsEnvVarsFor,
+  renamedEnvCarry,
   upsertEnvVars,
   webEnvBody,
   webEnvPath,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { accountPreflight, appGroupExpr, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -374,10 +374,10 @@ async function provisionInstance(inst, deps) {
     // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
     if (inst.hosting_shape === 'cloud-host') {
       await scaffoldStandaloneRepo(inst, deps);
-      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's
-      // `git pull --ff-only origin main` — the pull that failed unauthenticated
-      // on every private standup (walk finding N4; ADR 0176).
+      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's `git pull
+      // --ff-only origin main`, which failed unauthenticated on every private standup (N4; ADR 0176).
       await ensurePrivateRepoAccess(inst, deps);
+      await require('./provision-pin-key.js').ensurePinWriteKey(inst, deps); // the hub's WRITE key for later pin pushes, public repos too (task 1004291, ADR 0350)
     }
   }
   if (!inst.db_name) { patch.db_name = inst.slug; inst = { ...inst, db_name: inst.slug }; }
@@ -904,7 +904,7 @@ async function settingsApplyInstance(inst, deps) {
   // exists to avoid). An unreadable or empty file is refused, never "patched":
   // writing two lines over a missing PORT/PGDATABASE would take the instance down.
   const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
-  const current = String((read && read.stdout) || '');
+  const current = String((read && read.stdout) || ''), carry = renamedEnvCarry(current); // task 1004395: only its NAMES are ever logged
   if (!apply) {
     log(`  [config] would patch ${Object.keys(vars).join(', ')} in ${webEnvPath(inst)} in place (every other line untouched)`);
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
@@ -916,8 +916,8 @@ async function settingsApplyInstance(inst, deps) {
     return { ok: false, error: `cannot read ${webEnvPath(inst)} — nothing to patch (was this instance provisioned by the runner?)` };
   }
   try {
-    log('  [config] patch the settings lines of web.env in place (creds + origins untouched)');
-    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, settingsEnvVarsFor(inst, current)), { mode: 0o600, sudo: true });
+    log(`  [config] patch the settings lines of web.env in place (creds + origins untouched)${carry.carried.length ? `; carry the renamed env forward: ${carry.carried.join(', ')} (value copied on the box, never shown)` : ''}`);
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, { ...settingsEnvVarsFor(inst, current), ...carry.vars }), { mode: 0o600, sudo: true });
     log('  [service] restart so the memoized branding pack re-reads them');
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
   } catch (e) {
@@ -960,7 +960,7 @@ async function settingsApplyInstance(inst, deps) {
   if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'settings-apply').catch(() => {});
   await provisioning.recordEvent(db, {
     instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'settings-applied',
-    detail: `settings pushed (${shown}) — web.env patched in place; ${outcome}`,
+    detail: `settings pushed (${shown}) — web.env patched in place${carry.carried.length ? `; carried ${carry.carried.join(', ')}` : ''}; ${outcome}`,
     actor: 'runner',
   }).catch(() => {});
   log(healthy && consumed !== false
@@ -1285,7 +1285,7 @@ async function cmdRunIntents(deps) {
       // Dispatch EXPLICITLY per action — an unrecognized action must surface as an
       // error, never fall through to the destructive teardown leg (task 1002692).
       let result;
-      if (intent.action === 'provision') result = await provisionInstance(inst, deps);
+      if (intent.action === 'provision') result = await require('./provision-render.js').afterProvision(inst, deps, intent, await provisionInstance(inst, deps)); // then the app on Render, when the wizard lent a key (task 1004352)
       else if (intent.action === 'teardown') result = await teardownInstance(inst, deps);
       else if (intent.action === 'domain-attach') result = await domainAttachInstance(inst, deps);
       else if (intent.action === 'settings-apply') result = await settingsApplyInstance(inst, deps);
@@ -1293,10 +1293,10 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
       else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
-      else if (intent.action === 'repo-private') result = await require('./provision-repo-private.js').repoPrivateInstance(inst, deps); // wire the deploy key, THEN flip (task 1004193); required here — this file is at the size ratchet
+      else if (intent.action === 'repo-private' || intent.action === 'render-standup') result = intent.action === 'repo-private' ? await require('./provision-repo-private.js').repoPrivateInstance(inst, deps) : await require('./provision-render.js').renderStandupInstance(inst, deps, intent); // wire the deploy key, THEN flip (task 1004193) · spend the borrowed Render key once (task 1004183); required here — this file is at the size ratchet
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
-        if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
+        if (intent.attempts >= MAX_INTENT_ATTEMPTS || result.terminal) { // terminal: a leg that must not be retried unattended (the Render leg's key is already gone — task 1004183)
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
           // A retired intent stops silently otherwise (F19): record the reason
           // on the instance WITHOUT changing its lifecycle status — passing the
@@ -1489,7 +1489,7 @@ module.exports = {
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
   domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
-  settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
+  settingsApplyInstance, upsertEnvVars, renamedEnvCarry, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch
   restartInstance,
   // GitHub App Manifest flow (task 2080, ADR 0133)

package/scripts/gds/publish-manifest.js

@@ -72,6 +72,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/provisioning/',   // instance-hosting control plane — CORE (its do-api toolchain is core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
   'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
   'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
+  'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---
   'config/branding.neutral.json',

package/scripts/gds/render-api.js

@@ -0,0 +1,197 @@
+// scripts/gds/render-api.js — a thin Render API v1 client for the control plane, with
+// the workspace (ownerId) guard (task 1004183; ADR 0327).
+//
+// Control-plane code, like its model scripts/gds/do-api.js: only the provisioning runner
+// uses it, never the web tier (ADR 0111 §2). Same skeleton (JsonHttpApi): injectable
+// transport, dry-run by default, and live mode refuses to start without a token.
+//
+// THE GUARD. A Render API key belongs to a USER, not a workspace, and carries that user's
+// rights in every workspace they belong to — measured 2026-09-22: one owner's key reached
+// three workspaces, one of them another builder's, holding live production services. So:
+//
+//   - the client is built for ONE workspace (`ownerId`) and refuses to exist without it —
+//     never defaulted, and never derived by taking the first of GET /owners;
+//   - every call that names an owner sends this one;
+//   - every response that carries an owner is ASSERTED to carry this one, and a missing
+//     or different owner is a hard error (RenderOwnerMismatch). Assert on the response,
+//     not the request: a request you got right says nothing about a response that came
+//     from somewhere else. A list is checked element by element.
+//
+// Render's own shapes decide where the owner sits: a service carries `ownerId`, a
+// Postgres carries `owner.id` (both measured by the pilot, task 1004142). A few calls
+// answer with no owner at all (a database's connection-info, an env-var PUT, a deploy
+// trigger). Those are only reachable through a method that first reads the parent
+// resource through the guard, so nothing is ever sent to or read from a resource whose
+// workspace was not checked.
+//
+// NO DELETE. The platform must not hold the ability to destroy infrastructure in an
+// account it does not own (ADR 0327 §3). There is no delete method, and _req refuses the
+// verb outright, so adding one later is a visible change to this file, not a one-liner.
+
+'use strict';
+
+const { JsonHttpApi, makeApiError } = require('./http-api-client');
+
+const RENDER_API_BASE = 'https://api.render.com/v1';
+
+const RenderApiError = makeApiError('RenderApiError', 'RENDER_API_ERROR');
+const RenderOwnerMismatch = makeApiError('RenderOwnerMismatch', 'RENDER_OWNER_MISMATCH');
+
+// The owner id a Render resource carries, in either of the two shapes Render uses.
+// null when it carries none.
+function ownerOf(resource) {
+  if (!resource || typeof resource !== 'object') return null;
+  if (typeof resource.ownerId === 'string' && resource.ownerId) return resource.ownerId;
+  if (resource.owner && typeof resource.owner.id === 'string' && resource.owner.id) return resource.owner.id;
+  return null;
+}
+
+// Env var values are the owner's secrets on their way to Render. A dry-run log is the one
+// place this client would otherwise print a request body, so it prints the names only.
+function redact(body) {
+  if (!body || typeof body !== 'object') return body;
+  const out = { ...body };
+  if (Array.isArray(out.envVars)) out.envVars = out.envVars.map((v) => ({ key: v && v.key, value: '[redacted]' }));
+  if ('value' in out) out.value = '[redacted]';
+  return out;
+}
+
+class RenderApi extends JsonHttpApi {
+  // opts: { token, ownerId, dryRun=true, fetchImpl=globalThis.fetch, base, log }
+  constructor(opts = {}) {
+    super(opts, { base: RENDER_API_BASE, logTag: 'Render', ErrorClass: RenderApiError });
+    if (typeof opts.ownerId !== 'string' || !opts.ownerId.trim()) {
+      throw new RenderApiError('a Render client needs the workspace it acts in (ownerId) — it is never defaulted');
+    }
+    this.ownerId = opts.ownerId.trim();
+    if (!this.dryRun && !this.token) {
+      throw new RenderApiError('live Render call requested with no API key');
+    }
+    if (!this.dryRun && typeof this.fetchImpl !== 'function') {
+      throw new RenderApiError('no fetch implementation available for live mode');
+    }
+  }
+
+  async _req(method, path, body, opts = {}) {
+    if (method === 'DELETE') throw new RenderApiError(`refusing ${method} ${path}: the platform never deletes in an account it does not own (ADR 0327 §3)`);
+    if (this.dryRun) {
+      this.log(`[dry-run] Render ${method} ${path}${body ? ' ' + JSON.stringify(redact(body)) : ''}`);
+      return { dryRun: true, ...(opts.dryRunResult || {}) };
+    }
+    return super._req(method, path, body, opts);
+  }
+
+  // Throws unless `resource` carries exactly this client's workspace.
+  assertOwned(resource, what) {
+    const got = ownerOf(resource);
+    if (got !== this.ownerId) {
+      throw new RenderOwnerMismatch(
+        got
+          ? `Render answered ${what} from workspace ${got}, not ${this.ownerId} — refusing to go on`
+          : `Render answered ${what} with no workspace on it — refusing to go on`,
+        { body: null });
+    }
+    return resource;
+  }
+
+  // ---- workspaces ------------------------------------------------------------
+
+  // The workspaces the key can reach, as [{ id, name, type }]. Used for MEMBERSHIP only —
+  // "is the workspace the owner named one this key can act in" — never to pick one.
+  async listOwners() {
+    const json = await this._req('GET', '/owners?limit=100', null, {
+      dryRunResult: { items: [{ owner: { id: this.ownerId, name: '(dry-run)', type: 'team' } }] },
+    });
+    const items = Array.isArray(json) ? json : (json && json.items) || [];
+    return items.map((e) => (e && e.owner) || e).filter((o) => o && typeof o.id === 'string');
+  }
+
+  // ---- services --------------------------------------------------------------
+
+  async getService(serviceId) {
+    const json = await this._req('GET', `/services/${encodeURIComponent(serviceId)}`, null, {
+      dryRunResult: { id: serviceId, ownerId: this.ownerId, serviceDetails: { url: null } },
+    });
+    return this.assertOwned(json && json.service ? json.service : json, `service ${serviceId}`);
+  }
+
+  // payload: the POST /services body (render-payload.js). Its ownerId must be ours — the
+  // payload builder takes it as an argument, so this is checked, not overwritten.
+  async createService(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a service payload must name this client\'s workspace');
+    const json = await this._req('POST', '/services', payload, {
+      dryRunResult: { deployId: null, service: { id: `dryrun-srv-${payload.name}`, ownerId: this.ownerId, serviceDetails: { url: null } } },
+    });
+    return { deployId: (json && json.deployId) || null, service: this.assertOwned(json && json.service, 'the new service') };
+  }
+
+  // Set one env var on a service this workspace owns. The PUT answers with no owner, so
+  // the service is read through the guard first.
+  async putEnvVar(serviceId, key, value) {
+    await this.getService(serviceId);
+    return this._req('PUT', `/services/${encodeURIComponent(serviceId)}/env-vars/${encodeURIComponent(key)}`, { value }, { dryRunResult: { key } });
+  }
+
+  async triggerDeploy(serviceId) {
+    await this.getService(serviceId);
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, {}, { dryRunResult: { id: null } });
+  }
+
+  // A service's deploys, newest first, as the bare deploy objects (Render wraps each in
+  // `{ deploy, cursor }`; both shapes are read). The list carries no owner, so the
+  // service is read through the guard first (the deploy hall's history, task 1004270).
+  async listDeploys(serviceId, { limit = 30 } = {}) {
+    await this.getService(serviceId);
+    const n = Math.max(1, Math.min(100, Number.parseInt(limit, 10) || 30));
+    const json = await this._req('GET', `/services/${encodeURIComponent(serviceId)}/deploys?limit=${n}`, null, { dryRunResult: { items: [] } });
+    const items = Array.isArray(json) ? json : (json && json.items) || [];
+    return items.map((e) => (e && e.deploy) || e).filter((d) => d && typeof d.id === 'string');
+  }
+
+  // Roll the service back to one of its earlier deploys. The answer carries no owner, so
+  // the service is read through the guard first. This is a write on the owner's account;
+  // the caller (the deploy hall) asks the owner twice before it reaches here.
+  async rollbackTo(serviceId, deployId) {
+    await this.getService(serviceId);
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/rollback`, { deployId }, { dryRunResult: { id: null } });
+  }
+
+  // ---- Postgres --------------------------------------------------------------
+
+  async createPostgres(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a Postgres payload must name this client\'s workspace');
+    const json = await this._req('POST', '/postgres', payload, {
+      dryRunResult: { id: `dryrun-pg-${payload.name}`, status: 'creating', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, 'the new database');
+  }
+
+  async getPostgres(postgresId) {
+    const json = await this._req('GET', `/postgres/${encodeURIComponent(postgresId)}`, null, {
+      dryRunResult: { id: postgresId, status: 'available', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, `database ${postgresId}`);
+  }
+
+  // The database's connection strings. The answer carries no owner, so the database is
+  // read through the guard first.
+  async postgresConnectionInfo(postgresId) {
+    await this.getPostgres(postgresId);
+    return this._req('GET', `/postgres/${encodeURIComponent(postgresId)}/connection-info`, null, {
+      dryRunResult: { internalConnectionString: 'postgres://dry-run' },
+    });
+  }
+
+  // Poll until a new database is 'available'. `sleepFn` lets tests drive it with no clock.
+  async settlePostgres(postgresId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
+    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let i = 0; i < tries; i++) {
+      const pg = await this.getPostgres(postgresId);
+      if (pg.status === 'available') return pg;
+      await sleep(sleepMs);
+    }
+    throw new RenderApiError(`database ${postgresId} did not become available in time`);
+  }
+}
+
+module.exports = { RenderApi, RenderApiError, RenderOwnerMismatch, RENDER_API_BASE, ownerOf, redact };

package/scripts/gds/render-payload.js

@@ -0,0 +1,84 @@
+// scripts/gds/render-payload.js — WHAT the Render standup leg creates, kept apart from
+// HOW it creates it (scripts/gds/provision-render.js) (task 1004183; retargeted by
+// task 1004350).
+//
+// Pure functions, no I/O. What goes to the owner's Render account is their APP, not the
+// Bongos hall: we host every project's hall, and the app deploys where its owner
+// chooses (ADR 0345 D1, D3). So the service is built from the project's own repository
+// and started the way that repository says — the owner's runtime and commands, or the
+// repository's own Dockerfile — never the Bongos core.
+//
+// A database is optional (some apps need none). When there is one, its internal
+// connection string is handed to the app as DATABASE_URL, the one name every mainstream
+// framework reads. That is the only env var the platform sets: every other variable is
+// the owner's to set on Render, and Bongos keeps their NAMES only (task 1004062's
+// manifest) — never a value.
+//
+// The plans are per-project settings (ADR 0327 §5), never constants. The defaults are
+// what the Render pilot (task 1004142) found enough at idle: a `starter` web service and
+// a paid `basic_256mb` Postgres, because Render's free Postgres has no backups.
+
+'use strict';
+
+// The vocabulary lives with the web tier's validation, so the two can never disagree.
+const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES } = require('../../modules/provisioning/render-standup.js');
+const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
+
+// A Render resource name from the project's slug. Render allows letters, digits and
+// dashes; the slug already is that, this only makes sure.
+function resourceName(inst, suffix) {
+  const base = String(inst.slug || `project-${inst.id}`).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 50);
+  return suffix ? `${base}-${suffix}` : base;
+}
+
+// The plan and region a project asked for, with the defaults filled in. A value outside
+// the vocabulary is refused rather than passed through for Render to reject.
+function plansFor(appHost) {
+  const h = appHost || {};
+  const out = {
+    webPlan: h.webPlan || DEFAULTS.webPlan,
+    dbPlan: h.dbPlan || DEFAULTS.dbPlan,
+    region: h.region || DEFAULTS.region,
+  };
+  if (!WEB_PLANS.includes(out.webPlan)) throw new Error(`unknown Render web plan '${out.webPlan}'`);
+  if (!DB_PLANS.includes(out.dbPlan)) throw new Error(`unknown Render database plan '${out.dbPlan}'`);
+  if (!REGIONS.includes(out.region)) throw new Error(`unknown Render region '${out.region}'`);
+  return out;
+}
+
+// How the app is built and started, as the owner said. `docker` builds the repository's
+// own Dockerfile and needs no commands; every other runtime needs a start command, and a
+// build command if the app has a build step.
+function buildFor(appHost) {
+  const h = appHost || {};
+  if (!RUNTIMES.includes(h.runtime)) throw new Error(`unknown Render runtime '${h.runtime || 'none'}'`);
+  if (h.runtime === 'docker') return { runtime: 'docker' };
+  if (!h.startCommand) throw new Error('the app needs a start command');
+  return { runtime: h.runtime, buildCommand: h.buildCommand || null, startCommand: h.startCommand };
+}
+
+// POST /postgres. `plan` is never 'free' — see the header.
+function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
+  return { name: resourceName(inst, 'db'), ownerId, plan: dbPlan, region, version: '16' };
+}
+
+// POST /services, for the owner's app from their repository. `dbUrl` is the database's
+// internal connection string, or null when the app has no database. It is a VALUE sent
+// to Render and held there — the platform keeps none.
+function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, build, dbUrl }) {
+  const envSpecificDetails = build.runtime === 'docker'
+    ? {}
+    : { ...(build.buildCommand ? { buildCommand: build.buildCommand } : {}), startCommand: build.startCommand };
+  return {
+    type: 'web_service',
+    name: resourceName(inst),
+    ownerId,
+    repo: repoUrl,
+    branch: branch || 'main',
+    autoDeploy: 'yes',
+    serviceDetails: { runtime: build.runtime, plan: webPlan, region, envSpecificDetails },
+    envVars: dbUrl ? [{ key: 'DATABASE_URL', value: dbUrl }] : [],
+  };
+}
+
+module.exports = { DEFAULTS, resourceName, plansFor, buildFor, renderPostgresPayload, renderServicePayload };

package/scripts/gds/run-unit-tests.js

@@ -102,6 +102,13 @@ const INTEGRATION = new Set([
   // never was a dedicated consumer-layout-boot workflow, whatever older notes say.
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase',
+  // task 1003457: proves the blocker-resolve auto-promotion trigger (migration
+  // 009, tightened by core_223) fires on the HALL'S OWN write path — the real
+  // buildGdsRouter() HTTP routes, not a static SQL-text pin (blocker_resolve_guard.mjs,
+  // blocker_unlink.mjs) or a pure-predicate unit test (blocker_link.mjs, which never
+  // touches a database). Only a real transaction engine behind a real router proves
+  // that; self-skips without a reachable Postgres.
+  'blocker_hall_live_proof',
   // task 1002709: core_221's re-keyed backstop index against a real Postgres.
   // The DB-free sibling pins the guard and the migration's text; this proves the
   // index actually refuses the commingling INSERT and still allows the parallel
@@ -122,6 +129,9 @@ const INTEGRATION = new Set([
   // dev box session. The claims foreign key that failed the live upgrade is a
   // schema fact only a transaction engine enforces. Always rolled back.
   'core_258_box_session_claims_db',
+  // task 1004360: core_262 drops the four builders columns migration 104 added, against a real
+  // Postgres, with the foreign key live, then re-runs it. Always rolled back.
+  'core_262_drop_box_blocked_db',
   'discord_autojoin', 'discord_oauth',
   // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
   // The three DB-free sibling suites stub the client and SIMULATE the

package/scripts/gds/ship-finish.js

@@ -14,7 +14,8 @@ const { cliClient, printOnboardingNudge, rewardPolicy, cardFlagsFromMe } = requi
 const { closeoutPlan } = require('../../modules/lifecycle/ship-preflight');
 const { syncMemoryOnShip } = require('./ship-memory-sync.js');
 const { uploadSessionOnShip } = require('./ship-session-upload.js');
-const { gitOk, shellOk } = require('./ship-git.js');
+const { execFileSync } = require('node:child_process');
+const { gitOk } = require('./ship-git.js');
 const { fetchDeployedVersion } = require('./ship-deploy-target.js');
 const { landBailed, reconciledCardStatus } = require('./ship-land.js');
 const { autoMerge, publishHeld } = require('./ship-merge.js');
@@ -142,18 +143,23 @@ async function onboardingNudgeBestEffort() {
 // close-out, folded into the delivery process (NOT a separate skill). After a
 // ship lands, scratch often lingers uncommitted — untracked files the preflight
 // lets through, generated artifacts, post-commit edits — making the session
-// hard to archive cleanly. This reports what's left and stashes it under a
-// labeled, RECOVERABLE stash so the tree is left clean + archive-ready and
-// nothing is lost. STRICTLY fail-open: the ship has already succeeded by the
-// time this runs, so nothing here may throw, prompt, or change the exit status —
-// a messy tree (or a stash failure) must never surface as a ship failure. The
-// caller gates this on a SUCCESSFUL land so a grade-failed 'completed' tree the
-// builder still needs to fix is never stashed out from under them.
+// hard to archive cleanly. This REPORTS what's left and leaves it in place.
+// task 1004254: it used to `git stash push -u` the leftover, but the stash stack
+// is repo-global across every worktree (task 1003344), so one builder's scratch
+// landed where a parallel agent's pop could apply it to the wrong branch — and
+// it swallowed review renders an owner still needed. It never touches the stash.
+// STRICTLY fail-open: the ship has already succeeded by the time this runs, so
+// nothing here may throw, prompt, or change the exit status — a messy tree must
+// never surface as a ship failure. The caller gates this on a SUCCESSFUL land.
 function postShipCloseout(taskId) {
   try {
-    const out = gitOk('git status --porcelain');
-    if (out == null) return; // git unavailable / not a repo — nothing to reconcile
-    const plan = closeoutPlan(out, taskId);
+    // Untrimmed: gitOk's trim() eats the first line's leading status column, so
+    // " M a.txt" was listed as ".txt" (task 1004254).
+    let out;
+    try {
+      out = execFileSync('git', ['status', '--porcelain'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    } catch (_) { return; } // git unavailable / not a repo — nothing to reconcile
+    const plan = closeoutPlan(out);
     if (plan.clean) {
       console.log('Close-out: working tree clean — session is archive-ready.');
       return;
@@ -162,15 +168,7 @@ function postShipCloseout(taskId) {
     console.log(`Close-out: ${plan.leftover.length} uncommitted/untracked path(s) remain after the ship:`);
     for (const f of plan.leftover.slice(0, 15)) console.log(`  ${f}`);
     if (plan.leftover.length > 15) console.log(`  … and ${plan.leftover.length - 15} more`);
-    // --include-untracked so scratch the preflight waved through is captured too.
-    // Label is `otb-postship-<numericId>` — no shell metacharacters.
-    const stashed = shellOk(`git stash push --include-untracked -m "${plan.stashLabel}"`);
-    if (stashed) {
-      console.log(`Close-out: stashed the leftover as "${plan.stashLabel}" — tree is now clean + archive-ready.`);
-      console.log('           Recover anytime:  git stash list  →  git stash pop');
-    } else {
-      console.log('Close-out: could not stash the leftover; left it in place (the ship already succeeded — tidy up manually when convenient).');
-    }
+    console.log(`Close-out: left in place (task ${taskId} already shipped) — commit, move or delete them before archiving this worktree.`);
   } catch (err) {
     // Fail-open — a post-ship close-out problem must never look like a ship failure.
     console.log(`Close-out: skipped (${err && err.message ? err.message : 'error'}).`);
@@ -404,6 +402,7 @@ module.exports = {
   finishHeld,
   mergeAndDeploy,
   onboardingNudgeBestEffort,
+  postShipCloseout,
   postShipSync,
   printCompletionCard,
 };

package/scripts/gds/smoke-dependencies.sh

@@ -10,9 +10,12 @@
 #   5. Promote A manually (the route allows it; the gate is at claim time)
 #   6. Try to claim A — still 409 DEPS_NOT_SHIPPED
 #   7. Claim B, ship B (active → completed → confirmed → shipped)
-#   8. Verify A auto-promoted backlog→ready (or stays ready if step 5 ran)
+#   8. Verify C — a second dependent of B that NOTHING ever promoted by hand —
+#      flipped backlog→ready. This is the only assertion that can fail if the
+#      auto-promotion trigger is broken (task 1004191): A was already 'ready'
+#      from the manual step, so A's status proves nothing about the trigger.
 #   9. Claim A — succeeds
-#  10. Release A, abandon A (B is shipped and cannot be abandoned)
+#  10. Release A, abandon A and C (B is shipped and cannot be abandoned)
 #
 # Run from any environment with a valid CLI session (/builder-setup).
 # Requires curl.
@@ -44,7 +47,22 @@ A=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
 A_ID=$(echo "$A" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  A id=$A_ID"
 
-echo "=== 3. Wire A → depends_on B ==="
+echo "=== 2b. Create task C (dependent, status=backlog, NEVER promoted by hand) ==="
+# task 1004191 (finding 62 of the task 1000379 audit): A is promoted manually in
+# step 4, so "A is ready after B ships" held whether or not the auto-promotion
+# trigger fired. C exists to be the dependent only the trigger can flip.
+C=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test C $SUFFIX\",\"description\":\"smoke\",\"status\":\"backlog\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-C-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-C-$SUFFIX\"}")
+C_ID=$(echo "$C" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
+echo "  C id=$C_ID"
+
+echo "=== 3. Wire A → depends_on B, and C → depends_on B ==="
+curl -sS -X POST "$BASE/api/bongos/tasks/$C_ID/dependencies" \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data "{\"depends_on_task_id\": $B_ID}" >/dev/null
+C_PRE=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$C_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+[ "$C_PRE" = "backlog" ] && echo "  PASS: C is backlog before B ships" || (echo "  FAIL: C is '$C_PRE' before B ships — the auto-promotion check below would prove nothing"; exit 1)
 curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/dependencies" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"depends_on_task_id\": $B_ID}" | python3 -m json.tool
@@ -69,15 +87,18 @@ curl -sS -X POST "$BASE/api/bongos/claims/by-task/$B_ID/resolve" \
 curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
 curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
 
-echo "=== 7. Verify A auto-promoted (status should still be 'ready' from manual step 4, or auto-flipped from backlog) ==="
-A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
-echo "  A status: $A_STATUS"
-[ "$A_STATUS" = "ready" ] && echo "  PASS" || (echo "  FAIL: A not ready"; exit 1)
+echo "=== 7. Verify the auto-promotion trigger fired: C backlog → ready ==="
+# C was never promoted by hand, so only promote_dependents_on_ship can have made
+# it 'ready'. (A is 'ready' from the manual step 4 regardless, so A is not asserted
+# here — that is the assertion that used to pass with the trigger broken.)
+C_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$C_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+echo "  C status: $C_STATUS"
+[ "$C_STATUS" = "ready" ] && echo "  PASS: C auto-promoted" || (echo "  FAIL: C is '$C_STATUS' — B shipped but the auto-promotion trigger did not flip its dependent"; exit 1)
 
 echo "=== 8. Claim A — must succeed now ==="
 node scripts/gds/claim.js "$A_ID" --worktree "smoke-$SUFFIX-A"
 
-echo "=== 9. Cleanup — abandon A; B is shipped and stays ==="
+echo "=== 9. Cleanup — abandon A and C; B is shipped and stays ==="
 # task 1004026: this step used to ANNOUNCE "release A; mark both abandoned" and then
 # only release A. Neither task reached a terminal state, so every run leaked two
 # __smoke__ rows into the live tasks table — invisibly, because anyone grepping the
@@ -108,6 +129,14 @@ case "${A_CLEANUP_CODE:-000}" in
   000) echo "  SKIP cleanup — POST /tasks/$A_ID/abandon got no response; task #$A_ID left in the ledger" ;;
   *)   echo "  SKIP cleanup — POST /tasks/$A_ID/abandon returned HTTP $A_CLEANUP_CODE; task #$A_ID left in the ledger" ;;
 esac
+C_CLEANUP_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data '{"reason":"smoke cleanup (task 1004191) - auto-promotion witness; the throwaway row has served its purpose"}' \
+  "$BASE/api/bongos/tasks/$C_ID/abandon") || true
+case "${C_CLEANUP_CODE:-000}" in
+  2*) echo "  PASS cleaned up throwaway task #$C_ID (abandoned)" ;;
+  *)  echo "  SKIP cleanup — POST /tasks/$C_ID/abandon returned HTTP ${C_CLEANUP_CODE:-000}; task #$C_ID left in the ledger" ;;
+esac
 echo "  NOTE task #$B_ID is SHIPPED and is deliberately left in the ledger — the abandon route refuses shipped work (cannot_abandon_shipped)."
 
 echo