@bongos/core 1.19.1081 → 1.20.1

package/scripts/gds/grade-correlation-audit.js

@@ -57,8 +57,11 @@ const INDEPENDENT_KAPPA = 0.4;
 // A worker's vote on one grade: 1 objects, 0 clears, null no signal.
 function voteOf(w) {
   if (!w || typeof w !== 'object') return null;
-  const issues = Array.isArray(w.issues) ? w.issues : [];
-  const substantive = issues.some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+  // A stored attempt keeps severities only (task 1004292); a full grade keeps issues.
+  const severities = Array.isArray(w.severities)
+    ? w.severities
+    : (Array.isArray(w.issues) ? w.issues : []).map((i) => i && i.severity);
+  const substantive = severities.some((sv) => sv === 'blocker' || sv === 'major');
   if (w.error && !substantive) return null;
   if (w.verdict === 'pass') return 0;
   if (w.verdict === 'concerns' || w.verdict === 'fail') return 1;
@@ -148,23 +151,47 @@ function classify(kappa) {
 // One stored grade → the slim row the audit reads (review prose hashed, as in
 // the replay corpus): { task_id, task_status, passed, workers }, or null when
 // it is not a panel grade.
+//
+// task 1004292: grade.attempts (every round that kept its verdicts, oldest first,
+// served beside the grade) becomes `rounds`; a task with none falls back to its
+// final grade alone, exactly as before.
 function toAuditRow({ task_id, task_status, grade }) {
+  const attempts = grade && Array.isArray(grade.attempts) ? grade.attempts : [];
+  const rounds = attempts.map((a) => (a && Array.isArray(a.workers) ? a.workers : null)).filter((w) => w && w.length);
   const row = trimRecordedGrade({ task_id, grade });
-  return row ? { task_id: row.task_id, task_status: task_status || null, passed: !!(grade && grade.passed === true), workers: row.workers } : null;
+  if (!row && rounds.length === 0) return null;
+  return {
+    task_id: String(task_id),
+    task_status: task_status || null,
+    passed: !!(grade && grade.passed === true),
+    workers: row ? row.workers : rounds[rounds.length - 1],
+    ...(rounds.length ? { rounds } : {}),
+  };
+}
+
+// The panels one dataset row contributes: every recorded round when there are
+// any (the LAST one is the final grade, the one the owner's decision is about),
+// else the final grade alone.
+function panelsOf(g) {
+  const sets = Array.isArray(g.rounds) && g.rounds.length ? g.rounds : [g.workers];
+  return sets
+    .map((workers, i) => ({ task_id: String(g.task_id), final: i === sets.length - 1, votes: panelVotes(workers) }))
+    .filter((p) => Object.keys(p.votes).length > 0);
 }
 
 // The whole report, pure over a dataset { grades: [toAuditRow…], overrides: [{task_id, status}] }.
 function audit(dataset, { minN = MIN_N } = {}) {
   const floor = Math.max(MIN_N, Number(minN) || MIN_N);
-  const panels = (dataset.grades || [])
-    .map((g) => ({ task_id: String(g.task_id), votes: panelVotes(g.workers) }))
-    .filter((p) => Object.keys(p.votes).length > 0);
+  // Agreement between workers reads EVERY round; the owner's decision is about
+  // the work as it landed, so the owner-facing statistics read final rounds only.
+  const panels = (dataset.grades || []).flatMap(panelsOf);
+  const finals = panels.filter((p) => p.final);
   const labels = ownerLabels(dataset);
   // 1 when the worker's vote disagrees with the owner (objected to accepted
   // work, or cleared rejected work); only on labelled tasks it voted on.
-  const errorOf = (p, kind) => (labels.has(p.task_id) && kind in p.votes
+  const errorOf = (p, kind) => (!p.final ? null : (labels.has(p.task_id) && kind in p.votes
     ? Number(p.votes[kind] !== (labels.get(p.task_id).label === 'reject' ? 1 : 0))
-    : null);
+    : null));
 
   const pairwise = [];
   for (let i = 0; i < PANEL.length; i++) {
@@ -186,7 +213,7 @@ function audit(dataset, { minN = MIN_N } = {}) {
   const byLabel = { accept: 0, reject: 0 };
   for (const v of labels.values()) byLabel[v.label]++;
   const perWorker = PANEL.map((kind) => {
-    const pairs = panels
+    const pairs = finals
       .filter((p) => labels.has(p.task_id) && kind in p.votes)
       .map((p) => [p.votes[kind], labels.get(p.task_id).label === 'reject' ? 1 : 0]);
     return { kind, ...guardedStats(pairs, floor) };
@@ -195,6 +222,7 @@ function audit(dataset, { minN = MIN_N } = {}) {
   return {
     min_n: floor,
     panels: panels.length,
+    tasks: finals.length,
     pairwise,
     mean_pairwise_phi: meanPhi,
     effective_votes: meanPhi == null ? null : effectiveVotes(PANEL.length, meanPhi),
@@ -223,7 +251,7 @@ const statLine = (s) => (s.refused ? `REFUSED — ${s.refused}` : `n=${s.n}  agr
 
 function printReport(r) {
   const out = [];
-  out.push(`grade correlation audit — ${r.panels} recorded panel grade(s), minimum n = ${r.min_n}`);
+  out.push(`grade correlation audit — ${r.panels} recorded panel round(s) over ${r.tasks} task(s), minimum n = ${r.min_n}`);
   out.push('A vote is OBJECTS (concerns/fail) or CLEARS (pass); an errored worker with no finding casts none.');
   out.push('');
   out.push('(a) Do the workers fail differently? — agreement between each pair on the same task');
@@ -247,8 +275,9 @@ function printReport(r) {
   out.push('');
   out.push('Caveats: labels exist only where a person decided — override requests and manual confirms of work the');
   out.push('panel did not pass — so they are a selected set, not a sample. A grade that auto-landed on a pass is');
-  out.push('never a label (that is the grader agreeing with itself). Only each task\'s LATEST grade keeps per-worker');
-  out.push('verdicts (grade_attempts stores pass/score only), so a re-graded task counts once, as its final round.');
+  out.push('never a label (that is the grader agreeing with itself). Agreement (a) reads every round that kept its');
+  out.push('per-worker verdicts (grade_attempts.worker_verdicts); rounds graded before that column existed are lost,');
+  out.push('and such a task counts once, as its final grade. Owner comparisons (b) and error correlation read final rounds only.');
   console.log(out.join('\n'));
 }
 
@@ -271,6 +300,7 @@ module.exports = {
   effectiveVotes,
   ownerLabels,
   panelVotes,
+  panelsOf,
   toAuditRow,
   voteOf,
 };

package/scripts/gds/grade-replay.js

@@ -160,7 +160,7 @@ async function fetchRecentGrades({ recent = 150, statuses = ['shipped', 'complet
   const out = new Array(picked.length).fill(null);
   for (let i = 0; i < picked.length; i += FETCH_CONCURRENCY) {
     await Promise.all(picked.slice(i, i + FETCH_CONCURRENCY).map(async (t, j) => {
-      const r = await api.tasks.getTasksId({ id: t.id, query: { include: 'grade' } });
+      const r = await api.tasks.getTasksId({ id: t.id, query: { include: 'grade,grade_attempts' } });
       if (r.ok && r.data && r.data.grade) out[i + j] = { task_id: t.id, task_status: t.status, at: t.at, grade: r.data.grade };
     }));
   }

package/scripts/gds/provision-core-upgrade.js

@@ -35,6 +35,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 const { CONFIG, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, REPO_ROOT } = require('./provision-config.js');
 const { appUser, dbName, instanceUser, parseTargetRef, resolveOwnerGithubToken, selfInstanceRoot, standaloneRoot } = require('./provision-repo.js');
+const { ensurePinWriteKey, hasOwnAccount, pinKeyPath, pinSshCommand } = require('./provision-pin-key.js');
 const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 const { RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES, parseChangeRecords, notesBetween } = require('./release-notes.js');
 
@@ -329,16 +330,20 @@ async function coreUpgradeInstance(inst, deps, intent) {
 // on top of them would change what the live box runs with no restart and no health check.
 // That is reported for an operator to reconcile, never resolved here.
 //
-// THE LIMIT, stated so nobody mistakes this for durable: the owner's token is kept for an
-// hour after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js
-// — one wizard sitting). An upgrade days later usually finds none; the box's own remote
-// is then tried, and it can only read a private repo. The note says so in words.
+// WHAT MAKES IT DURABLE (task 1004291, ADR 0350). The owner's token is kept for an hour
+// after they sign in with repository access (GITHUB_TOKEN_TTL_MS in src/bongos/db.js — one
+// wizard sitting), so on its own it cannot carry an upgrade days later. The hub therefore
+// holds a per-project WRITE deploy key (provision-pin-key.js) and tries it FIRST: write key
+// → owner token (when fresh) → the box's own remote, which can only read a private repo.
+// A fresh token also mints the key when the project has none, so reconnecting GitHub once
+// is enough for every later upgrade. The note says which of these is missing, in words.
 
 const REPO_NOTE_PREFIX = 'repo_not_updated';
 const REPO_NOTES = Object.freeze({
   no_repo: 'This project has no GitHub repository on record, so the new version was saved on the server only.',
   no_branch: 'The server\'s copy of the project is not on a branch, so there was nothing to save to GitHub.',
-  no_access: 'The hub had no permission to write to the project\'s GitHub repository: the owner\'s GitHub access is only kept for an hour after they connect GitHub, and the server\'s own key can only read the repository.',
+  no_access: 'The hub had no permission to write to the project\'s GitHub repository: it holds no write key for it yet, the owner\'s GitHub access is only kept for an hour after they connect GitHub, and the server\'s own key can only read the repository. Reconnecting GitHub with repository access sets up lasting access.',
+  needs_account: 'The hub could not set up lasting write access to the project\'s GitHub repository: this project needs its own account on the server first. Once it has one, reconnecting GitHub with repository access sets up lasting access.',
   refused: 'GitHub turned down the owner\'s GitHub access — it may have expired, or lack permission to write to the repository.',
   behind: 'GitHub has changes the server does not have, so the new version could not be added on top of them. An operator needs to bring the two back in line; the site itself is running normally.',
   failed: 'The hub could not save the new version to GitHub.',
@@ -399,6 +404,9 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   };
   const repo = parseTargetRef(inst.target_ref);
   if (!repo) return miss('no_repo');
+  // Exported and callable on its own, and the slug reaches shell strings below (the write
+  // key's path), so it is checked here rather than trusting coreUpgradeInstance's own guard.
+  if (!isValidSlug(inst.slug)) return miss('failed', '(the project name is not a valid slug)');
   const head = exec(`git -C ${instanceDir} symbolic-ref --short HEAD`, { allowFail: true });
   const branch = failedRun(head) ? '' : String(head.stdout || '').trim();
   if (!BRANCH_RE.test(branch)) return miss('no_branch');
@@ -407,6 +415,26 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const env = { GIT_TERMINAL_PROMPT: '0' };   // a refused credential fails; it never waits at a prompt
 
   const token = await resolveOwnerGithubToken(inst, deps, { tag: '[core-upgrade]' });
+
+  // 1. The hub's own WRITE key (ADR 0350). A fresh token mints it when the project has
+  // none yet — the reconnect the deploy page asks for — and the mint is best effort: a
+  // miss falls through to the token, then to the box's remote, exactly as before.
+  const fsImpl = deps.fsImpl || fs;
+  const keyPath = pinKeyPath(inst, deps);
+  if (token && !fsImpl.existsSync(keyPath)) await ensurePinWriteKey(inst, deps, { token });
+  if (fsImpl.existsSync(keyPath)) {
+    const r = exec(`${hardened} -c ${pinSshCommand(keyPath)} push git@github.com:${repo.owner}/${repo.name}.git HEAD:${branch}`,
+      { allowFail: true, env });
+    if (!failedRun(r)) {
+      log(`  ✓ pushed the pin to ${at} from the hub, over its write deploy key`);
+      return { pushed: true, via: 'write-key', branch };
+    }
+    const fault = pushFault(r);
+    // The key WORKED and the history stopped it: no other credential changes that.
+    if (fault === 'behind') return miss('behind', gitLine(r));
+    log(`  • ${inst.slug}: the write key did not push (${fault}) — trying the next credential`);
+  }
+
   if (token) {
     const credFile = path.join(os.tmpdir(), `bongos-gitcred-upgrade-${inst.slug}-${process.pid}-${crypto.randomBytes(6).toString('hex')}`);
     let r = null;
@@ -436,7 +464,10 @@ async function pushUpgradePin(inst, deps, { instanceDir }) {
   const fault = pushFault(r);
   // A refusal here is not the owner's access being turned down — there was none to turn
   // down. It is the read-only key, which is the no-access case.
-  return miss(fault === 'refused' ? 'no_access' : fault, gitLine(r));
+  // ...unless the project has no account of its own, in which case no key CAN be minted
+  // for it (ADR 0350) and reconnecting GitHub alone will not help: say that instead.
+  if (fault === 'refused') return miss(hasOwnAccount(inst, exec) ? 'no_access' : 'needs_account', gitLine(r));
+  return miss(fault, gitLine(r));
 }
 
 // The pre-flight lines a dry run emits, and the refusal when it has one. upgrade.js writes
@@ -990,4 +1021,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { pushUpgradePin, UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/provision-pin-key.js

@@ -0,0 +1,176 @@
+'use strict';
+// provision-pin-key.js — the hub's per-project WRITE deploy key (task 1004291, ADR 0350,
+// amending ADR 0176).
+//
+// WHY. A hosted project's upgrade commits a new core pin in the project's checkout, and
+// the hub pushes it to the owner's GitHub repo (task 1004065, pushUpgradePin). The owner's
+// token that would do that is stored for one hour only, and the checkout's own `origin`
+// is a READ-ONLY deploy key (ADR 0176) — so most pushes ended "GitHub was not updated" and
+// the box and the repo drifted. A second deploy key, registered WRITABLE and held by the
+// runner alone, is the lasting credential.
+//
+// WHERE IT LIVES AND WHO CAN READ IT. Outside every project checkout, in a directory of
+// the RUNNER's own account (mode 0700, key 0600). The project's own unix account
+// (bongos-<slug>, ADR 0281) can read neither. A project still running as the shared app
+// user has the SAME uid as the runner and could read it, so it is REFUSED a key
+// ("needs its own account first") rather than handed one.
+//
+// NEVER THROWS. A failure to mint is a missed convenience, not a broken standup: every
+// path returns `{ skipped }` and logs. The read-only pull key (deployKeyPath in
+// provision-repo.js) is untouched by anything here.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
+const { instanceUser, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo.js');
+
+const NEEDS_OWN_ACCOUNT = 'needs its own account first';
+
+// Both names below reach a shell (ssh-keygen -C/-f, rm -f), so the slug is checked HERE, at
+// the point of use, rather than trusting that some caller validated it first.
+function safeSlug(inst) {
+  const slug = inst && inst.slug;
+  if (!isValidSlug(slug)) throw new Error(`refusing to build a write-key path from an invalid slug ${JSON.stringify(slug)}`);
+  return slug;
+}
+function pinKeyTitle(inst) { return `cloudbongos-pin-${safeSlug(inst)}`; }
+
+// The runner-only directory. PROVISION_PIN_KEY_DIR pins it; otherwise it sits under the
+// runner account's own home. Never under standaloneBase, so it can never ride along with
+// (or be reached through) a project checkout.
+function pinKeyDir(deps = {}) {
+  const pinned = deps.pinKeyDir || process.env.PROVISION_PIN_KEY_DIR;
+  if (pinned) return String(pinned).replace(/\\/g, '/');
+  return path.posix.join(os.homedir().replace(/\\/g, '/'), '.config', 'cloudbongos', 'pin-keys');
+}
+function pinKeyPath(inst, deps = {}) { return path.posix.join(pinKeyDir(deps), `${safeSlug(inst)}.key`); }
+
+const failed = (r) => !r || r.softFailed === true || r.ok === false;
+
+// Does this project have a unix account of its own? Fail CLOSED: only a positive answer
+// counts, because the wrong guess hands a tenant process the key that pushes to the
+// owner's repo.
+function hasOwnAccount(inst, exec) {
+  let account;
+  try { account = instanceUser(inst); } catch { return false; }
+  const r = exec(`id -u ${account}`, { allowFail: true });
+  return !failed(r) && /^\d+$/.test(String((r && r.stdout) || '').trim());
+}
+
+// Create the directory (0700) and mint the key (0600), then PROVE the modes: a key that
+// GitHub trusts to write must never be group- or world-readable.
+function mintLocal(inst, exec, deps) {
+  const dir = pinKeyDir(deps), keyPath = pinKeyPath(inst, deps), title = pinKeyTitle(inst);
+  exec(`(umask 077 && mkdir -p ${dir}) && chmod 700 ${dir}`);
+  exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+  exec(`(umask 077 && ssh-keygen -q -t ed25519 -N '' -C ${title} -f ${keyPath})`);
+  exec(`chmod 600 ${keyPath}`);
+  const modes = exec(`stat -c '%a' ${dir} ${keyPath}`, { allowFail: true });
+  const got = String((modes && modes.stdout) || '').trim().split(/\s+/);
+  if (failed(modes) || got[0] !== '700' || got[1] !== '600') {
+    exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+    throw new Error(`the write key's permissions could not be confirmed as 700/600 (saw ${got.join('/') || 'nothing'})`);
+  }
+  return keyPath;
+}
+
+const keyBody = (k) => String(k || '').trim().split(/\s+/).slice(0, 2).join(' ');
+
+/**
+ * Make sure a per-project WRITE deploy key exists locally and is registered on the repo
+ * with `read_only: false`. `opts.token` is an owner token already in hand. Idempotent
+ * (by title; a stale or read-only same-title registration is replaced). NEVER THROWS.
+ * Returns `{ minted, keyPath }` or `{ skipped: <why>, note }`.
+ */
+async function ensurePinWriteKey(inst, deps, opts = {}) {
+  const log = deps.log || (() => {});
+  const exec = deps.controlExec || deps.exec;
+  if (!inst || inst.hosting_shape !== 'cloud-host') return { skipped: 'shape' };
+  if (!isValidSlug(inst.slug)) return { skipped: 'invalid_slug' };
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) return { skipped: 'no_repo' };
+  if (deps.apply === false) {
+    log(`  [pin-key] would mint a writable deploy key "${pinKeyTitle(inst)}" for ${repo.owner}/${repo.name}, held by the runner outside the checkout (ADR 0350)`);
+    return { planned: true };
+  }
+  try {
+    if (!hasOwnAccount(inst, exec)) {
+      log(`  [pin-key] ${inst.slug} ${NEEDS_OWN_ACCOUNT} — no write key minted (it runs as the runner's own user and could read it; ADR 0350)`);
+      return { skipped: 'needs_own_account', note: `This project ${NEEDS_OWN_ACCOUNT}.` };
+    }
+    const token = opts.token || await resolveOwnerGithubToken(inst, deps, { tag: '[pin-key]' });
+    if (!token) return { skipped: 'no_token' };
+    const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
+    const info = await gh.getUserRepo(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+    if (info && info.admin === false) {
+      log(`  [pin-key] the owner's credential is not admin on ${repo.owner}/${repo.name}; a deploy key needs admin — no write key minted`);
+      return { skipped: 'not_admin' };
+    }
+    const fsImpl = deps.fsImpl || fs;
+    const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
+    const target = { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl };
+    if (!fsImpl.existsSync(keyPath) || !fsImpl.existsSync(`${keyPath}.pub`)) mintLocal(inst, exec, deps);
+    let pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+    const ours = (await gh.listDeployKeys(token, target)).find((k) => k.title === title);
+    if (ours && keyBody(ours.key) === keyBody(pub) && ours.read_only === false) {
+      return { minted: false, keyPath };
+    }
+    if (ours) await gh.deleteDeployKey(token, { ...target, keyId: ours.id });
+    const add = () => gh.addDeployKey(token, { ...target, title, key: pub, readOnly: false });
+    let added;
+    try { added = await add(); } catch (e) {
+      if (!e || e.code !== 'key_in_use') throw e;
+      mintLocal(inst, exec, deps);
+      pub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+      added = await add();
+    }
+    if (added && added.read_only === true) {
+      // GitHub registered it read-only anyway: it would never write, and a key that looks
+      // like a write key but is not is worse than none.
+      await gh.deleteDeployKey(token, { ...target, keyId: added.id }).catch(() => {});
+      return { skipped: 'registered_read_only' };
+    }
+    log(`  [pin-key] registered writable deploy key "${title}" on ${repo.owner}/${repo.name}`);
+    return { minted: true, keyPath };
+  } catch (e) {
+    log(`  [pin-key] write key not set up for ${inst.slug}: ${(e && e.message) || e}`);
+    return { skipped: 'failed', note: String((e && e.message) || e).slice(0, 160) };
+  }
+}
+
+// The `-c` that points ONE git push at the write key. IdentitiesOnly + -F /dev/null so no
+// agent or ~/.ssh/config identity can answer instead. PURE.
+function pinSshCommand(keyPath) {
+  return `core.sshCommand="ssh -F /dev/null -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`;
+}
+
+/**
+ * Remove the write key: the registration (when a token is at hand) and the local files.
+ * Best effort, never throws. `keys` is an already-fetched deploy-key list, to save a call.
+ */
+async function revokePinWriteKey(inst, deps, { token = null, repo = null, keys = null } = {}) {
+  const log = deps.log || (() => {});
+  const exec = deps.controlExec || deps.exec;
+  const title = pinKeyTitle(inst), keyPath = pinKeyPath(inst, deps);
+  if (token && repo) {
+    try {
+      const gh = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos')); // eslint-disable-line global-require
+      const list = keys || await gh.listDeployKeys(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+      const ours = list.find((k) => k.title === title);
+      if (ours) {
+        if (deps.apply === false) log(`  would revoke the "${title}" deploy key on ${repo.owner}/${repo.name} if present`);
+        else {
+          await gh.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
+          log(`  revoked the "${title}" write deploy key on ${repo.owner}/${repo.name}`);
+        }
+      }
+    } catch (e) { log(`  (write-key revoke skipped: ${(e && e.message) || e})`); }
+  } else if (repo) {
+    log(`  (write-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${title}" deploy key, remove it in the repo's settings)`);
+  }
+  if (deps.apply !== false) exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+}
+
+module.exports = { NEEDS_OWN_ACCOUNT, hasOwnAccount, pinKeyTitle, pinKeyDir, pinKeyPath, ensurePinWriteKey, revokePinWriteKey, pinSshCommand };

package/scripts/gds/provision-render.js

@@ -1,14 +1,16 @@
 'use strict';
 // provision-render.js — the Render standup leg: the runner half of the `render-standup`
-// intent (task 1004183; ADR 0327, ADR 0345). Its own file because provision.js sits at
+// intent (task 1004183; ADR 0327, ADR 0345). What it stands up is the project's APP, from
+// the project's own repository — never the Bongos hall, which we host (task 1004350). Its own file because provision.js sits at
 // the size ratchet; the dispatch there requires it inline.
 //
 // WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
 // lent for this one run:
-//   - ADOPT links a Render service the owner already runs. It reads that service through
-//     the workspace guard and records it. It makes NO write call to their account.
-//   - GREENFIELD creates the Postgres and the web service (render-payload.js decides what
-//     they are), sets the env vars that need the service's URL, and asks for a deploy.
+//   - ADOPT links a Render service the owner already runs for this repository. It reads
+//     that service through the workspace guard, checks it builds this project's
+//     repository, and records it. It makes NO write call to their account.
+//   - GREENFIELD creates the Postgres when the owner asked for one, then the web service
+//     (render-payload.js decides what they are). Render deploys a new service on its own.
 // Ids are written to the row as each resource is created, so an owner who re-enters their
 // key after a failure resumes onto what already exists instead of creating a second one.
 //
@@ -32,7 +34,6 @@
 const { RenderApi } = require('./render-api.js');
 const payload = require('./render-payload.js');
 const { parseTargetRef } = require('./provision-repo-auth.js');
-const { provisionedEnvPrefix } = require('./provision-units.js');
 
 // A key waiting longer than this was lent for a run that never came. It is refused and
 // cleared rather than spent late.
@@ -56,15 +57,20 @@ async function clearBorrowedKey(db, intentId) {
   await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
 }
 
-async function ownerLoginOf(db, inst) {
-  if (!inst.owner_builder_id) return null;
-  const { rows } = await db.query(`SELECT github_login FROM builders WHERE id = $1`, [inst.owner_builder_id]);
-  return (rows[0] && rows[0].github_login) || null;
+// Whether a Render service's repository is this project's. Render reports it as a URL;
+// compared as owner/name, case-insensitively, the way GitHub resolves them.
+function sameRepo(renderRepo, targetRef) {
+  const a = parseTargetRef(renderRepo), b = parseTargetRef(targetRef);
+  return !!(a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase());
 }
 
 async function adopt(api, inst, host, { db, log }) {
   if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
   const svc = await api.getService(host.serviceId);
+  // Linking someone's other service to this project would show its URL as this app's.
+  if (!sameRepo(svc.repo, inst.target_ref)) {
+    throw new Error(`Render service ${svc.id} builds ${svc.repo || 'no repository'}, not ${inst.target_ref}`);
+  }
   const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
   await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
   log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
@@ -74,39 +80,38 @@ async function adopt(api, inst, host, { db, log }) {
 async function greenfield(api, inst, host, deps) {
   const { db, log } = deps;
   const plans = payload.plansFor(host);
+  const build = payload.buildFor(host);
   const repo = parseTargetRef(inst.target_ref);
   if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
-  const envPrefix = deps.envPrefix || provisionedEnvPrefix();
-
-  // 1. The database — reused if a previous run got this far.
-  let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
-  if (!pg) {
-    pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
-    await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
-    log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+
+  // 1. The database, only when the owner asked for one — reused if a previous run got
+  //    this far.
+  let dbUrl = null;
+  if (host.database === true) {
+    let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
+    if (!pg) {
+      pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
+      await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
+      log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+    }
+    await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
+    const conn = await api.postgresConnectionInfo(pg.id);
+    dbUrl = conn && conn.internalConnectionString;
+    if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
   }
-  await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
-  const conn = await api.postgresConnectionInfo(pg.id);
-  const dbUrl = conn && conn.internalConnectionString;
-  if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
 
-  // 2. The web service — reused likewise.
+  // 2. The app's web service — reused likewise. Render starts its first deploy itself.
   let svc = host.serviceId ? await api.getService(host.serviceId) : null;
   if (!svc) {
-    const firstAdmin = (await ownerLoginOf(db, inst)) || repo.owner;
     const created = await api.createService(payload.renderServicePayload(inst, {
       ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
-      webPlan: plans.webPlan, region: plans.region, dbUrl, secretKey: payload.freshSecretKey(), envPrefix, firstAdmin,
+      webPlan: plans.webPlan, region: plans.region, build, dbUrl,
     }));
     svc = created.service;
     await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
-    log(`  [render] created web service ${svc.id} (${plans.webPlan})`);
+    log(`  [render] created web service ${svc.id} (${plans.webPlan}, ${build.runtime})`);
   }
   const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
-
-  // 3. What needs the URL, then one deploy that picks it all up.
-  for (const { key, value } of payload.renderAfterCreateEnv(url, { envPrefix })) await api.putEnvVar(svc.id, key, value);
-  await api.triggerDeploy(svc.id);
   await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
   log(`  [render] ${inst.slug} is deploying at ${url}`);
   return { ok: true };
@@ -144,6 +149,32 @@ async function renderStandupInstance(inst, deps, intent) {
   }
 }
 
+// The wizard's path (task 1004352): Create queues the project's `provision` run, and the
+// key the owner lent arrives on THAT run a moment later (render-standup.js
+// attachToProvision). So after the project is set up, this runs the Render leg in the same
+// drain. The key is re-read from the row, because it may have been attached after this
+// run was claimed. Whatever happens the key is gone when this returns:
+//   - project up → the Render leg spends and clears it. Its failure is the APP's, recorded
+//     on app_host; the project itself is still up, so the provision run stays a success;
+//   - project not up → the key is cleared now and the app marked failed, so a provision
+//     retry never carries a key into a later run. The owner connects Render again once the
+//     project is up.
+async function afterProvision(inst, deps, intent, result) {
+  const { db } = deps;
+  const { rows } = await db.query(`SELECT borrowed_key_enc FROM provisioning_intents WHERE id = $1`, [intent.id]);
+  const keyEnc = rows[0] && rows[0].borrowed_key_enc;
+  if (!keyEnc) return result;
+  if (!result || result.ok === false) {
+    await clearBorrowedKey(db, intent.id);
+    await recordAppHost(db, inst.id, { state: 'failed', error: 'the project could not be set up, so its app was not set up on Render — connect Render again once the project is live' }).catch(() => {});
+    return result;
+  }
+  const fresh = (await deps.provisioning.getInstanceById(db, inst.id)) || inst;
+  const app = await renderStandupInstance(fresh, deps, { ...intent, borrowed_key_enc: keyEnc });
+  if (app.ok) return result;
+  return { ...result, doneNote: `project is up, but its app was not set up on Render: ${app.error}` };
+}
+
 // Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
 // the row so an operator can still say which services were the project's; the owner
 // deletes them in their own Render dashboard if they want to stop paying.
@@ -155,4 +186,4 @@ async function forgetRenderApp(inst, { db, log, apply }) {
   if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
 }
 
-module.exports = { renderStandupInstance, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };
+module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };

package/scripts/gds/provision-teardown.js

@@ -12,6 +12,7 @@
 const path = require('node:path');
 const { CONFIG, REPO_ROOT } = require('./provision-config.js');
 const { dbName, deployKeyPath, deployKeyTitle, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo.js');
+const { pinKeyPath, pinKeyTitle, revokePinWriteKey } = require('./provision-pin-key.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { caddySnippetPath, dnsReleaseEnv } = require('./provision-net.js');
 const apexMod = require('./instance-apex.js');
@@ -63,12 +64,16 @@ async function teardownInstance(inst, deps) {
               await ghRepos.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
               log(`  revoked the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name}`);
             }
-          } else log(`  would revoke the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name} if present`);
+            // The hub's WRITE key (ADR 0350) — the more dangerous of the two to leave behind.
+            await revokePinWriteKey(inst, { ...deps, controlExec: boxExec, apply: true, githubRepos: ghRepos }, { token, repo, keys });
+          } else log(`  would revoke the "${deployKeyTitle(inst)}" and write deploy keys on ${repo.owner}/${repo.name} if present`);
         } else {
-          log(`  (deploy-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${deployKeyTitle(inst)}" deploy key, remove it in the repo's settings)`);
+          log(`  (deploy-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${deployKeyTitle(inst)}" or "${pinKeyTitle(inst)}" deploy key, remove it in the repo's settings)`);
         }
       } catch (e) { log(`  (deploy-key revoke skipped: ${e && e.message})`); }
       boxExec(`rm -f ${deployKeyPath(inst)} ${deployKeyPath(inst)}.pub`, { allowFail: true });
+      // The write key's local half goes whatever happened above (lookup failed, no token).
+      boxExec(`rm -f ${pinKeyPath(inst, deps)} ${pinKeyPath(inst, deps)}.pub`, { allowFail: true });
     }
   }
   if (apply) {

package/scripts/gds/provision-units.js

@@ -390,6 +390,36 @@ function upsertEnvVars(body, vars) {
   return text;
 }
 
+// Env names a rename retired, carried forward ON THE BOX by the settings push (task
+// 1004395). The prelaunch-gate rename (task 1003152, ADR 0182) made PRELAUNCH_PASSWORD
+// primary and kept STEALTH_PASSWORD as an alias; the alias can only be dropped (task
+// 1003830) once every live web.env carries the new name, and before this the only way
+// to add it was the owner's SSH (blocker 1000147). [from, to] pairs.
+const ENV_RENAMES = Object.freeze([['STEALTH_PASSWORD', 'PRELAUNCH_PASSWORD']]);
+
+// Which renamed names does this web.env still hold ONLY under the old name? Returns
+// { vars, carried }: `vars` is the new name → the old line's right-hand side, copied
+// verbatim (quotes and all, so systemd reads the same value), for upsertEnvVars;
+// `carried` names the pairs and is the ONLY part that may reach a log or an event —
+// the value is a secret read on the box and it never leaves it. A new name that is
+// already set wins, even when it differs. The last line of a key counts, as systemd
+// reads it. PURE.
+function renamedEnvCarry(body) {
+  const lines = String(body == null ? '' : body).split(/\r?\n/);
+  const rhs = (key) => {
+    let v = null;
+    for (const l of lines) if (l.startsWith(`${key}=`)) v = l.slice(key.length + 1);
+    return v;
+  };
+  const isSet = (v) => v !== null && !['', '""', "''"].includes(v.trim());
+  const vars = {}, carried = [];
+  for (const [from, to] of ENV_RENAMES) {
+    const oldV = rhs(from);
+    if (isSet(oldV) && !isSet(rhs(to))) { vars[to] = oldV; carried.push(`${from} -> ${to}`); }
+  }
+  return { vars, carried };
+}
+
 // ── Cross-site identity: federate a hosted instance's sign-in through the hub ───
 // (ADR 0141 §4, task #1002109). The control plane IS the hub (cloudbongos.com), so
 // registration is a direct in-process call against the hub pool — no HTTP hop.
@@ -415,6 +445,7 @@ module.exports = {
   serviceUnitPath,
   settingsConsumed,
   settingsEnvVarsFor,
+  renamedEnvCarry,
   upsertEnvVars,
   webEnvBody,
   webEnvPath,