@bongos/core 1.19.1080 → 1.20.1

package/tests/provision_render.mjs

@@ -0,0 +1,362 @@
+// tests/provision_render.mjs — the Render standup leg (task 1004183; ADR 0327).
+//
+// scripts/gds/provision-render.js driven over the REAL Render client (render-api.js) and a
+// recording fake of Render's API, so the workspace guard is exercised end to end rather
+// than stubbed away. db and the secret box are fakes. No network, no DB.
+//
+// The load-bearing assertions — the task's DONE WHEN, clause by clause:
+//   • the borrowed key is CLEARED in the drain that spends it: on success, on a refusal,
+//     on a mismatched workspace, on a Render error and on a decrypt failure
+//   • the ownerId guard refuses a mismatched response, and the run stops there — nothing
+//     is created after it
+//   • ADOPT makes no write call to Render at all, and links only a service that builds
+//     THIS project's repository; GREENFIELD creates the database only when asked for, then
+//     the app's service — built from the project's own repository the way its owner said,
+//     never the Bongos core (task 1004350, ADR 0345)
+//   • the plan is read from the project's row, not a constant
+//   • a failure is TERMINAL: the runner retires it instead of re-queuing it, because the
+//     key is gone and the owner retries by entering it again
+//   • teardown forgets the Render app and never calls Render
+//
+// Run:  node tests/provision_render.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const { RenderApi } = require('../scripts/gds/render-api.js');
+const { renderStandupInstance, forgetRenderApp, KEY_TTL_MS } = require('../scripts/gds/provision-render.js');
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const THEIRS = 'tea-theirs000001';
+const SVC_URL = 'https://demo.onrender.com';
+
+// A fake Render account. `over` replaces any answer; a function answer sees the body.
+function fakeRender(over = {}) {
+  const calls = [];
+  const answers = {
+    'GET /owners?limit=100': [{ owner: { id: THEIRS } }, { owner: { id: OURS } }],
+    'POST /postgres': { id: 'dpg-new', status: 'creating', owner: { id: OURS } },
+    'GET /postgres/dpg-new': { id: 'dpg-new', status: 'available', owner: { id: OURS } },
+    'GET /postgres/dpg-new/connection-info': { internalConnectionString: 'postgres://internal' },
+    'POST /services': { deployId: 'dep-1', service: { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } } },
+    'GET /services/srv-new': { id: 'srv-new', ownerId: OURS, serviceDetails: { url: SVC_URL } },
+    'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, repo: 'https://github.com/Example-Owner/demo', serviceDetails: { url: 'https://old.onrender.com' } },
+    'POST /services/srv-new/deploys': { id: 'dep-2' },
+    ...over,
+  };
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    const body = init.body ? JSON.parse(init.body) : null;
+    calls.push({ method: init.method, path, body });
+    let key = `${init.method} ${path}`;
+    if (init.method === 'PUT' && /\/env-vars\//.test(path)) key = 'PUT env';
+    const a = key in answers ? answers[key] : (key === 'PUT env' ? { ok: true } : undefined);
+    if (a === undefined) return { ok: false, status: 404, text: async () => '{"message":"not found"}' };
+    if (a instanceof Error) return { ok: false, status: 500, text: async () => JSON.stringify({ message: a.message }) };
+    return { ok: true, status: 200, text: async () => JSON.stringify(typeof a === 'function' ? a(body) : a) };
+  };
+  return { calls, fetchImpl };
+}
+
+function harness({ host = {}, intent = {}, render = {}, decryptThrows = false } = {}) {
+  const r = fakeRender(render);
+  const writes = [], logs = [];
+  const db = {
+    query: async (sql, params) => {
+      writes.push({ sql: sql.replace(/\s+/g, ' ').trim(), params });
+      if (/FROM builders/.test(sql)) return { rows: [{ github_login: 'owner-login' }] };
+      return { rows: [] };
+    },
+  };
+  const deps = {
+    db, apply: true, log: (l) => logs.push(l), envPrefix: 'BONGOS', sleepFn: async () => {},
+    secretBox: { decrypt: (blob) => { if (decryptThrows) throw new Error('secret-box: bad tag'); assert.equal(blob, 'v1.enc'); return 'rnd_borrowed'; } },
+    renderApiFactory: ({ token, ownerId }) => new RenderApi({ token, ownerId, dryRun: false, fetchImpl: r.fetchImpl }),
+  };
+  const inst = { id: 18, slug: 'demo', owner_builder_id: 7, target_ref: 'example-owner/demo', status: 'active',
+    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, runtime: 'node', buildCommand: 'npm ci', startCommand: 'npm start', database: true, ...host } };
+  const it = { id: 44, action: 'render-standup', borrowed_key_enc: 'v1.enc', created_at: new Date().toISOString(), ...intent };
+  const cleared = () => writes.filter((w) => /UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = \$1/.test(w.sql) && w.params[0] === 44).length;
+  const appHost = () => writes.filter((w) => /SET app_host/.test(w.sql)).map((w) => JSON.parse(w.params[1]));
+  const lastHost = () => Object.assign({}, ...appHost());
+  return { r, writes, logs, deps, inst, it, cleared, lastHost, run: () => renderStandupInstance(inst, deps, it) };
+}
+
+const writesTo = (calls) => calls.filter((c) => c.method !== 'GET');
+
+console.log("greenfield — the owner's app:");
+await ta("with a database: the database, then the app's service — and the key cleared", async () => {
+  const h = harness();
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.method + ' ' + c.path), ['POST /postgres', 'POST /services'],
+    'no env var PUTs and no extra deploy: Render deploys a new service on its own');
+  assert.equal(h.cleared(), 1, 'the key column is cleared');
+  const host = h.lastHost();
+  assert.deepEqual([host.postgresId, host.serviceId, host.state, host.serviceUrl, host.webPlan, host.error], ['dpg-new', 'srv-new', 'deploying', SVC_URL, 'starter', null], 'the row records the service, its URL and the plan');
+});
+
+await ta('without a database: no Postgres is created and the app gets no DATABASE_URL', async () => {
+  const h = harness({ host: { database: false } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.ok(!h.r.calls.some((c) => c.path.startsWith('/postgres')), 'nothing about a database is called');
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.deepEqual(svc.envVars, []);
+  assert.equal(h.lastHost().postgresId, undefined);
+});
+
+await ta("the service is the owner's app: their repository, runtime and commands — not the Bongos core", async () => {
+  const h = harness();
+  await h.run();
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.equal(svc.ownerId, OURS);
+  assert.equal(svc.repo, 'https://github.com/example-owner/demo');
+  assert.equal(svc.serviceDetails.runtime, 'node');
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { buildCommand: 'npm ci', startCommand: 'npm start' });
+  const src = JSON.stringify(svc);
+  assert.doesNotMatch(src, /bongos|platform-server|migrate[.]sh|FIRST_ADMIN|BUILDER_SECRET_KEY|_ORIGIN/i, 'nothing of the hall rides along');
+  assert.deepEqual(svc.envVars, [{ key: 'DATABASE_URL', value: 'postgres://internal' }], 'the only value the platform sets');
+  const stored = JSON.stringify(h.writes.map((w) => w.params));
+  assert.ok(!stored.includes('postgres://internal') && !stored.includes('rnd_borrowed'), 'no env var value and no key is ever written to our database');
+});
+
+await ta("docker builds the repository's own Dockerfile, with no commands", async () => {
+  const h = harness({ host: { runtime: 'docker', buildCommand: undefined, startCommand: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.equal(svc.serviceDetails.runtime, 'docker');
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, {});
+});
+
+await ta('a native runtime with no start command is refused before anything is created', async () => {
+  const h = harness({ host: { startCommand: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /start command/);
+  assert.deepEqual(writesTo(h.r.calls), []);
+  assert.equal(h.cleared(), 1);
+});
+
+await ta("the plan is the project's own setting, not a constant", async () => {
+  const h = harness({ host: { webPlan: 'standard', dbPlan: 'basic_1gb', region: 'frankfurt' } });
+  await h.run();
+  const pg = h.r.calls.find((c) => c.path === '/postgres').body;
+  const svc = h.r.calls.find((c) => c.path === '/services').body;
+  assert.equal(pg.plan, 'basic_1gb');
+  assert.equal(pg.region, 'frankfurt');
+  assert.equal(svc.serviceDetails.plan, 'standard');
+  const d = harness();
+  await d.run();
+  assert.equal(d.r.calls.find((c) => c.path === '/postgres').body.plan, 'basic_256mb', 'the default is paid: free Postgres has no backups');
+  assert.equal(d.r.calls.find((c) => c.path === '/services').body.serviceDetails.plan, 'starter');
+});
+
+await ta('a retry resumes onto what an earlier run created — no second database or service', async () => {
+  const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-new' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), []);
+});
+
+console.log('\nadopt:');
+await ta('links an existing service and makes NO write call to Render', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), [], 'only reads');
+  assert.equal(h.lastHost().state, 'linked');
+  assert.equal(h.lastHost().serviceUrl, 'https://old.onrender.com');
+  assert.equal(h.cleared(), 1);
+});
+await ta('a service that builds a DIFFERENT repository is refused — its URL would pose as this app', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: OURS, repo: 'https://github.com/example-owner/other-app' } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.ok(out.error.includes('other-app, not example-owner/demo'), out.error);
+  assert.deepEqual(writesTo(h.r.calls), []);
+  assert.equal(h.lastHost().state, 'failed');
+  assert.equal(h.cleared(), 1);
+});
+await ta('adopting a service from another workspace is refused, and the key still cleared', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' }, render: { 'GET /services/srv-old': { id: 'srv-old', ownerId: THEIRS } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(out.terminal, true);
+  assert.match(out.error, /from workspace tea-theirs/);
+  assert.equal(h.lastHost().state, 'failed');
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe guard stops the run:');
+await ta('a database answered from another workspace stops everything after it', async () => {
+  const h = harness({ render: { 'POST /postgres': { id: 'dpg-x', status: 'creating', owner: { id: THEIRS } } } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /refusing to go on/);
+  assert.deepEqual(writesTo(h.r.calls).map((c) => c.path), ['/postgres'], 'no service, no env vars, no deploy');
+  assert.equal(h.cleared(), 1);
+});
+await ta('a workspace the key cannot reach is refused before any other call', async () => {
+  const h = harness({ render: { 'GET /owners?limit=100': [{ owner: { id: THEIRS } }] } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.match(out.error, /cannot reach workspace/);
+  assert.equal(h.r.calls.length, 1);
+  assert.equal(h.cleared(), 1);
+});
+await ta('the workspace is never taken from the list — with none named, nothing is called', async () => {
+  const h = harness({ host: { ownerId: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 1);
+});
+
+console.log('\nthe key is cleared whatever happens:');
+for (const [name, opts, re] of [
+  ['Render answers an error', { render: { 'POST /services': new Error('plan not allowed') } }, /plan not allowed/],
+  ['the key cannot be decrypted', { decryptThrows: true }, /bad tag/],
+  ['the key waited too long', { intent: { created_at: new Date(Date.now() - KEY_TTL_MS - 1000).toISOString() } }, /waited too long/],
+  ['no key came with the request', { intent: { borrowed_key_enc: null } }, /no Render key/],
+  ['the project is not set to Render', { host: { platform: 'vercel' } }, /not set to run on Render/],
+  ['an unknown plan', { host: { webPlan: 'huge' } }, /unknown Render web plan/],
+]) {
+  await ta(`${name} → terminal, reason recorded, key cleared`, async () => {
+    const h = harness(opts);
+    const out = await h.run();
+    assert.equal(out.ok, false);
+    assert.equal(out.terminal, true);
+    assert.match(out.error, re);
+    assert.equal(h.lastHost().state, 'failed');
+    assert.equal(h.cleared(), 1);
+  });
+}
+
+console.log('\nthe runner retires a terminal failure — no silent retry:');
+function drain(resultOfLeg) {
+  let claims = 0; const resolved = [], requeued = [];
+  const h = harness(resultOfLeg);
+  const deps = {
+    ...h.deps, exec: () => '', controlExec: () => '', sleep: async () => {},
+    db: { query: async (sql, params) => { if (/state='pending'/.test(sql)) requeued.push(params); return h.deps.db.query(sql, params); } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { ...h.it, instance_id: 18, attempts: 1 } : null),
+      getInstanceById: async () => ({ ...h.inst }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async () => {}, recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  return { deps, resolved, requeued, h };
+}
+await ta("cmdRunIntents routes 'render-standup' to the leg, and a success resolves done", async () => {
+  const d = drain({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 0, JSON.stringify(out));
+  assert.deepEqual(d.resolved, [{ id: 44, state: 'done', err: null }]);
+});
+await ta('a failure is retired on its FIRST attempt, never re-queued', async () => {
+  const d = drain({ render: { 'GET /owners?limit=100': [] } });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 1);
+  assert.deepEqual(d.requeued, [], 'not put back to pending');
+  assert.equal(d.resolved.length, 1);
+  assert.equal(d.resolved[0].state, 'error');
+  assert.match(d.resolved[0].err, /cannot reach workspace/);
+});
+
+console.log('\nthe wizard path — the app straight after the project, in the same run (task 1004352):');
+const { afterProvision } = require('../scripts/gds/provision-render.js');
+function afterHarness({ keyOnRow = 'v1.enc', host = {} } = {}) {
+  const h = harness({ host });
+  const base = h.deps.db.query;
+  h.deps.db = { query: async (sql, params) => (/SELECT borrowed_key_enc FROM provisioning_intents/.test(sql) ? { rows: [{ borrowed_key_enc: keyOnRow }] } : base(sql, params)) };
+  h.deps.provisioning = { getInstanceById: async () => ({ ...h.inst }) };
+  return h;
+}
+await ta('the project is up and a key rode the run → the app is set up, the key cleared, the run a success', async () => {
+  const h = afterHarness();
+  const out = await afterProvision(h.inst, h.deps, { id: 44, created_at: new Date().toISOString() }, { ok: true, port: 3100 });
+  assert.deepEqual(out, { ok: true, port: 3100 });
+  assert.ok(h.r.calls.some((c) => c.method === 'POST' && c.path === '/services'));
+  assert.equal(h.cleared(), 1);
+});
+await ta('the key is re-read from the row — one attached after the run was claimed is still spent', async () => {
+  const h = afterHarness();
+  await afterProvision(h.inst, h.deps, { id: 44, created_at: new Date().toISOString(), borrowed_key_enc: null }, { ok: true });
+  assert.ok(h.r.calls.length > 0);
+  assert.equal(h.cleared(), 1);
+});
+await ta('the app fails but the project is up → the run stays a success, with a note, and the key cleared', async () => {
+  const h = afterHarness();
+  h.r.calls.length = 0;
+  const hh = afterHarness({ host: { ownerId: 'tea-unreachable1' } });
+  const out = await afterProvision(hh.inst, hh.deps, { id: 44, created_at: new Date().toISOString() }, { ok: true });
+  assert.equal(out.ok, true);
+  assert.match(out.doneNote, /not set up on Render: this Render key cannot reach workspace/);
+  assert.equal(hh.lastHost().state, 'failed');
+  assert.equal(hh.cleared(), 1);
+});
+await ta('the project failed → Render is never called, the key cleared, the app marked failed', async () => {
+  const h = afterHarness();
+  const out = await afterProvision(h.inst, h.deps, { id: 44 }, { ok: false, error: 'DNS preflight failed' });
+  assert.deepEqual(out, { ok: false, error: 'DNS preflight failed' }, 'the provision result is passed through, so its retry rules are unchanged');
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 1, 'a provision retry never carries a key into a later run');
+  assert.match(h.lastHost().error, /connect Render again/);
+});
+await ta('no key on the run → the provision result is untouched and Render is never called', async () => {
+  const h = afterHarness({ keyOnRow: null });
+  const r = { ok: true, already: true };
+  assert.equal(await afterProvision(h.inst, h.deps, { id: 44 }, r), r);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.cleared(), 0);
+});
+await ta('the runner reaches afterProvision on every provision run', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  assert.match(src, /intent\.action === 'provision'\) result = await require\('\.\/provision-render\.js'\)\.afterProvision\(inst, deps, intent, await provisionInstance\(inst, deps\)\)/);
+});
+await ta('a link needs a repository to check the service against (1004350 review)', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-old' } });
+  h.inst.target_ref = null;
+  const out = await h.run();
+  assert.equal(out.ok, false);
+  assert.equal(h.cleared(), 1);
+});
+await ta('an app with no build step sends no build command at all (1004350 review)', async () => {
+  const h = harness({ host: { buildCommand: undefined } });
+  await h.run();
+  const svc = h.r.calls.find((c) => c.method === 'POST' && c.path === '/services').body;
+  assert.deepEqual(svc.serviceDetails.envSpecificDetails, { startCommand: 'npm start' });
+});
+
+console.log('\nteardown forgets, never deletes:');
+await ta('forgetRenderApp records the disconnect and calls nothing', async () => {
+  const writes = [], logs = [];
+  const inst = { id: 18, app_host: { platform: 'render', serviceId: 'srv-new', postgresId: 'dpg-new' } };
+  await forgetRenderApp(inst, { db: { query: async (sql, p) => { writes.push(p); return { rows: [] }; } }, log: (l) => logs.push(l), apply: true });
+  assert.equal(JSON.parse(writes[0][1]).state, 'disconnected');
+  assert.match(logs.join('\n'), /nothing on Render is deleted/);
+  await forgetRenderApp({ id: 19, app_host: null }, { db: { query: async () => { throw new Error('must not write'); } }, log: () => {}, apply: true });
+});
+await ta('the teardown leg reaches forgetRenderApp, and the leg has no path to a Render delete', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision-teardown.js', import.meta.url), 'utf8');
+  assert.match(src, /forgetRenderApp\(inst/);
+  const leg = readFileSync(new URL('../scripts/gds/provision-render.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(leg, /'DELETE'|\.delete[A-Z]/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/provision_settings_apply.mjs

@@ -567,5 +567,67 @@ await ta('cmdRunIntents (--apply): a dedicated refusal RETIRES at the cap with t
   assert.match(statusWrites[0].patch.error_note, /dedicated/);
 });
 
+console.log('\nrenamedEnvCarry — the prelaunch password carried on the box (task 1004395):');
+
+// A value that could never appear anywhere by accident, so "not in the text" means something.
+const SECRET = 'zq7-Wall-Pass-$&-9x';
+
+t('carries the old name to the new one when ONLY the old name is set, copying the right-hand side verbatim', () => {
+  const r = P.renamedEnvCarry(`PORT=3002\nSTEALTH_PASSWORD=${SECRET}\n`);
+  assert.deepEqual(r.vars, { PRELAUNCH_PASSWORD: SECRET });
+  assert.deepEqual(r.carried, ['STEALTH_PASSWORD -> PRELAUNCH_PASSWORD']);
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD="quoted pw"\n').vars, { PRELAUNCH_PASSWORD: '"quoted pw"' }, 'quotes kept, so systemd reads the same value');
+  assert.deepEqual(P.renamedEnvCarry(`A=1\r\nSTEALTH_PASSWORD=${SECRET}\r\n`).vars, { PRELAUNCH_PASSWORD: SECRET }, 'a CRLF file carries no stray \\r');
+});
+
+t('no-op when the new name is already set — even to a different value', () => {
+  for (const body of [`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=${SECRET}\n`, `STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=other\n`, `PRELAUNCH_PASSWORD=${SECRET}\n`]) {
+    assert.deepEqual(P.renamedEnvCarry(body), { vars: {}, carried: [] }, body);
+  }
+});
+
+t('no-op when the old name is absent, empty or commented out; an EMPTY new line is still filled', () => {
+  for (const body of ['PORT=3002\n', 'STEALTH_PASSWORD=\n', 'STEALTH_PASSWORD=""\n', `# STEALTH_PASSWORD=${SECRET}\n`, 'X_STEALTH_PASSWORD=abc\n', '', null]) {
+    assert.deepEqual(P.renamedEnvCarry(body), { vars: {}, carried: [] }, String(body));
+  }
+  assert.deepEqual(P.renamedEnvCarry(`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=\n`).vars, { PRELAUNCH_PASSWORD: SECRET });
+});
+
+t('the last line of a key wins, as systemd reads an EnvironmentFile', () => {
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD=first\nSTEALTH_PASSWORD=second\n').vars, { PRELAUNCH_PASSWORD: 'second' });
+  assert.deepEqual(P.renamedEnvCarry('STEALTH_PASSWORD=pw\nPRELAUNCH_PASSWORD=set\nPRELAUNCH_PASSWORD=\n').vars, { PRELAUNCH_PASSWORD: 'pw' }, 'a later blank line unsets it');
+});
+
+await ta('the leg carries it in the SAME in-place patch: every other line untouched, the old name kept, the value in NO log, event or result', async () => {
+  const envBody = `${LIVE_ENV}STEALTH_PASSWORD=${SECRET}\n`;
+  const { deps, writes, events, logs } = recorder({ apply: true, envBody });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, true, JSON.stringify(r));
+  const out = writes[0].body;
+  assert.ok(out.endsWith(`STEALTH_PASSWORD=${SECRET}\nPRELAUNCH_PASSWORD=${SECRET}\n`), 'appended after the old line, which stays for task 1003830 to retire');
+  assert.equal(out.split('\n').length, envBody.split('\n').length + 1, 'exactly one line added');
+  assert.match(out, /_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567/, 'creds untouched');
+  assert.match(events[0].detail, /carried STEALTH_PASSWORD -> PRELAUNCH_PASSWORD/, 'the event names the carry — how the owner verifies it without reading the file');
+  assert.ok(logs.some((l) => /carry the renamed env forward: STEALTH_PASSWORD -> PRELAUNCH_PASSWORD/.test(l)));
+  const said = [...logs, ...events.map((e) => e.detail), JSON.stringify(r)].join('\n');
+  assert.ok(!said.includes(SECRET) && !said.includes('zq7-Wall'), 'the password never leaves the file');
+});
+
+await ta('nothing to carry → the leg is byte-identical to before: no extra line, no carry wording', async () => {
+  const { deps, writes, events, logs } = recorder({ apply: true });
+  await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(writes[0].body.split('\n').length, LIVE_ENV.split('\n').length);
+  assert.doesNotMatch(writes[0].body, /PRELAUNCH_PASSWORD/);
+  assert.doesNotMatch(events[0].detail, /carried/);
+  assert.ok(!logs.some((l) => /carry the renamed env/.test(l)));
+});
+
+await ta('a failed write reports the error without the value', async () => {
+  const { deps } = recorder({ apply: true, writeThrows: true, envBody: `${LIVE_ENV}STEALTH_PASSWORD=${SECRET}\n` });
+  const r = await P.settingsApplyInstance(activeStandalone, deps);
+  assert.equal(r.ok, false);
+  assert.ok(!r.error.includes(SECRET), r.error);
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provisioning_app_status.mjs

@@ -0,0 +1,204 @@
+// tests/provisioning_app_status.mjs — what the owner is told about their app's setup on
+// Render, and the knock that says when it is live (task 1004353).
+//
+// The load-bearing assertions:
+//   • the read is OWNER ONLY, returns env var NAMES only, and never the key or a value
+//   • a failure comes back as one sentence, with the answers a Retry re-sends — the
+//     answers only, never a key
+//   • an app address is only ever an onrender.com one, and a Render link is only ever
+//     built from a checked service id — a stored value cannot shape either
+//   • the poller marks an app live only when it answers at that address, never on
+//     Render's no-deploy page, never on a 5xx; it follows no redirect; and its write is
+//     compare-and-set, so it never overwrites what the runner wrote since
+//
+// DB-free and network-free. Run:  node tests/provisioning_app_status.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers } = require('../modules/provisioning/app-status.js');
+const liveness = require('../modules/provisioning/pollers/app-liveness.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOST = { platform: 'render', mode: 'greenfield', ownerId: 'tea-aaaaaaaa1111', serviceId: 'srv-aaaaaaaa1111', serviceUrl: 'https://demo.onrender.com',
+  runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', webPlan: 'starter', database: true, dbPlan: 'basic_256mb' };
+
+console.log('the status (app-status.js):');
+await ta('no app host, or another platform → null', () => {
+  assert.equal(appStatus(null), null);
+  assert.equal(appStatus({ platform: 'vercel' }), null);
+});
+await ta('each runner state maps to the stage the owner sees', () => {
+  const stage = (state) => appStatus({ ...HOST, state }).stage;
+  assert.equal(stage('requested'), 'creating');
+  assert.equal(stage('creating'), 'creating');
+  assert.equal(stage('deploying'), 'building');
+  assert.equal(stage('linked'), 'building', 'a link waits for the app to answer too');
+  assert.equal(stage('live'), 'live');
+  assert.equal(appStatus({ ...HOST, state: 'failed', error: 'x' }).stage, null, 'a failure is not a stage');
+});
+await ta('a live app carries its address and the two Render links', () => {
+  const s = appStatus({ ...HOST, state: 'live' });
+  assert.equal(s.url, 'https://demo.onrender.com');
+  assert.deepEqual(s.links, { service: 'https://dashboard.render.com/web/srv-aaaaaaaa1111', env: 'https://dashboard.render.com/web/srv-aaaaaaaa1111/env' });
+  assert.equal(s.error, null);
+  assert.equal(s.retry, null);
+});
+await ta('a stored value cannot shape the address or a link', () => {
+  assert.equal(appUrl('https://evil.example.com'), null);
+  assert.equal(appUrl('http://demo.onrender.com'), null, 'https only');
+  assert.equal(appUrl('https://demo.onrender.com.evil.io'), null);
+  assert.equal(appUrl('javascript:alert(1)'), null);
+  assert.equal(serviceLinks('srv-x/../../account'), null);
+  assert.equal(serviceLinks(null), null);
+});
+await ta('a failure is ONE sentence, and a Retry re-sends the answers — never a key', () => {
+  const s = appStatus({ ...HOST, state: 'failed', error: 'this Render key cannot reach workspace tea-aaaaaaaa1111\nstack…' });
+  assert.equal(s.error, 'This Render key cannot reach workspace tea-aaaaaaaa1111.');
+  assert.deepEqual(s.retry, { owner_id: 'tea-aaaaaaaa1111', mode: 'greenfield', runtime: 'node', start_command: 'npm start', build_command: 'npm ci', web_plan: 'starter', database: true, db_plan: 'basic_256mb' });
+  assert.ok(!('key' in s.retry));
+  assert.equal(oneSentence(''), 'The setup stopped without saying why.');
+  assert.deepEqual(retryAnswers({ mode: 'adopt', ownerId: 'tea-aaaaaaaa1111', serviceId: 'srv-aaaaaaaa1111' }), { owner_id: 'tea-aaaaaaaa1111', mode: 'adopt', service_id: 'srv-aaaaaaaa1111' });
+  assert.deepEqual(retryAnswers({ mode: 'greenfield', ownerId: 'tea-aaaaaaaa1111', runtime: 'docker', startCommand: 'ignored' }), { owner_id: 'tea-aaaaaaaa1111', mode: 'greenfield', runtime: 'docker', database: false });
+});
+await ta('a run still holding the lent key reads as waiting, not as something to retry', () => {
+  const s = appStatus({ ...HOST, state: 'requested' }, { keyWaiting: true });
+  assert.equal(s.waiting, true);
+  assert.equal(s.retry, null);
+});
+
+console.log('\nGET /provisioning/instances/:id/render:');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const envManifest = require('../modules/provisioning/env-manifest.js');
+const api = require('../src/module-api.js');
+let instance = null, builder = null, waiting = false, queries = [];
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+envManifest.listEnvVars = async () => [
+  { name: 'DATABASE_URL', required: true, description: 'x' },
+  { name: 'SESSION_SECRET', required: true },
+  { name: 'STRIPE_KEY', required: false },
+];
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+Object.defineProperty(api, 'pool', { configurable: true, get: () => ({ query: async (sql, p) => { queries.push(sql); return { rows: [{ waiting }] }; } }) });
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/render-standup.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => { res.fail = (code, opts) => res.status((opts && opts.status) || (typeof opts === 'number' ? opts : 400)).json({ error: { code } }); next(); });
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const get = (id) => new Promise((resolve, reject) => {
+  http.get(`http://127.0.0.1:${server.address().port}/api/bongos/provisioning/instances/${id}/render`, (res) => {
+    let d = ''; res.on('data', (c) => { d += c; }); res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d || '{}'), raw: d }));
+  }).on('error', reject);
+});
+function reset(host) { instance = { owner_builder_id: 7, slug: 'demo', status: 'active', app_host: host }; builder = { id: 7 }; waiting = false; queries = []; }
+
+await ta('the owner reads the status, with env var NAMES only, and DATABASE_URL marked as set for them', async () => {
+  reset({ ...HOST, state: 'live' });
+  const r = await get(18);
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.app.stage, 'live');
+  assert.deepEqual(r.body.env_vars, [
+    { name: 'DATABASE_URL', required: true, set_for_you: true },
+    { name: 'SESSION_SECRET', required: true, set_for_you: false },
+    { name: 'STRIPE_KEY', required: false, set_for_you: false },
+  ]);
+  assert.equal(r.body.values_held, false);
+  assert.doesNotMatch(r.raw, /description|borrowed_key|rnd_/, 'no description, no key column, no key');
+});
+await ta('someone else\'s project — even for an archon — and a missing one are the same 404', async () => {
+  reset({ ...HOST, state: 'live' }); builder = { id: 42, rank: 'archon' };
+  assert.equal((await get(18)).status, 404);
+  reset(null); instance = null;
+  assert.equal((await get(18)).status, 404);
+});
+await ta('no platform chosen → app null, and no env list', async () => {
+  reset(null);
+  const r = await get(18);
+  assert.equal(r.status, 200);
+  assert.equal(r.body.app, null);
+  assert.deepEqual(r.body.env_vars, []);
+});
+await ta('a lent key still waiting on a run reads as waiting', async () => {
+  reset({ ...HOST, state: 'requested' }); waiting = true;
+  const r = await get(18);
+  assert.equal(r.body.app.waiting, true);
+  assert.match(queries[0], /borrowed_key_enc IS NOT NULL/, 'asked as a yes/no — the key column is never selected');
+  assert.doesNotMatch(queries[0], /SELECT borrowed_key_enc/);
+});
+await ta('the read is capped per builder — two surfaces polling fit well inside it', async () => {
+  reset({ ...HOST, state: 'live' }); builder = { id: 777 };
+  let last = null;
+  for (let i = 0; i < 61; i++) last = await get(18);
+  assert.equal(last.status, 429);
+});
+server.close();
+
+console.log('\nthe knock (pollers/app-liveness.js):');
+const res = (status, routing) => ({ status, headers: { get: (h) => (h === 'x-render-routing' ? routing || null : null) } });
+await ta('live only when the app answers: not on the no-deploy page, not on a 5xx, not on an error', async () => {
+  const f = (r) => async () => r;
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(200)) }), true);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(404)) }), true, 'a 404 at the root is still an app answering');
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(502, 'no-deploy')) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(404, 'no-deploy')) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: f(res(503)) }), false);
+  assert.equal(await liveness.appAnswers('https://demo.onrender.com', { fetchImpl: async () => { throw new Error('ECONNRESET'); } }), false);
+});
+await ta('it knocks only on an onrender.com address, and follows no redirect', async () => {
+  const seen = [];
+  const fetchImpl = async (url, init) => { seen.push({ url, redirect: init.redirect, auth: init.headers.Authorization }); return res(200); };
+  assert.equal(await liveness.appAnswers('https://10.0.0.1', { fetchImpl }), false);
+  assert.equal(await liveness.appAnswers('https://metadata.google.internal', { fetchImpl }), false);
+  assert.equal(seen.length, 0, 'never even asked');
+  await liveness.appAnswers('https://demo.onrender.com', { fetchImpl });
+  assert.equal(seen[0].redirect, 'manual');
+  assert.equal(seen[0].auth, undefined, 'no credential of any kind');
+});
+await ta('a sweep marks only answering apps live, compare-and-set on the state it read', async () => {
+  const writes = [];
+  const db = { query: async (sql, params) => {
+    if (/^\s*SELECT/.test(sql)) {
+      assert.match(sql, /app_host->>'state' IN \('deploying', 'linked'\)/);
+      return { rows: [
+        { id: 1, slug: 'up', app_host: { state: 'deploying', serviceUrl: 'https://up.onrender.com' } },
+        { id: 2, slug: 'building', app_host: { state: 'deploying', serviceUrl: 'https://building.onrender.com' } },
+        { id: 3, slug: 'linked', app_host: { state: 'linked', serviceUrl: 'https://linked.onrender.com' } },
+      ] };
+    }
+    writes.push({ sql: sql.replace(/\s+/g, ' '), params });
+    return { rowCount: 1 };
+  } };
+  const fetchImpl = async (url) => (url.includes('building') ? res(502, 'no-deploy') : res(200));
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 3, live: 2 });
+  assert.deepEqual(writes.map((w) => w.params), [[1, 'deploying'], [3, 'linked']]);
+  assert.match(writes[0].sql, /WHERE id = \$1 AND app_host->>'state' = \$2/, 'never overwrites what the runner wrote since');
+});
+await ta('the knocks run a few at a time, never all at once and never one by one', async () => {
+  let inFlight = 0, peak = 0;
+  const rows = Array.from({ length: 12 }, (_, i) => ({ id: i + 1, slug: `a${i}`, app_host: { state: 'deploying', serviceUrl: `https://a${i}.onrender.com` } }));
+  const db = { query: async (sql) => (/^\s*SELECT/.test(sql) ? { rows } : { rowCount: 1 }) };
+  const fetchImpl = async () => { inFlight++; peak = Math.max(peak, inFlight); await new Promise((r) => setTimeout(r, 5)); inFlight--; return res(200); };
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 12, live: 12 });
+  assert.equal(peak, 5);
+});
+await ta('the module starts the poller', () => {
+  const manifest = JSON.parse(readFileSync(new URL('../modules/provisioning/module.json', import.meta.url), 'utf8'));
+  assert.ok(manifest.contributes.pollers.includes('app-liveness'));
+});
+
+console.log(`\nprovisioning_app_status: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);