@bongos/core 1.19.217 → 1.19.219

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.217",
-  "core_contract": "1.19.217",
-  "source_commit": "2a474dc7f283910befbca2879f13d342c4d5f0b4",
+  "core_version": "1.19.219",
+  "core_contract": "1.19.219",
+  "source_commit": "c74ac31eedb3ec3676f8517b51302df625298931",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T00:33:32.467Z",
+  "built_at": "2026-08-18T03:06:20.562Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 310,
+    "docs_redacted": 311,
     "agent_docs_stubbed": 21,
     "functional_verbatim": 1302,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1633,
-  "tree_sha256": "a3212b990024b1a28961deb9e9d93d52eeca950d4be79f84b3bddd2fe928583f",
+  "file_count": 1634,
+  "tree_sha256": "4da1158ccf79b2a7a5253dad319cc74192493be9bda2e6a8874df8c60f581cc5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1359,10 +1359,15 @@
       "mode": "0000644",
       "sha256": "aaff11b955bcbacaebf2475d01034dce1c47c70c22534195aebbf90767b025f6"
     },
+    {
+      "path": "docs/adr/0176-private-repo-deploy-keys.md",
+      "mode": "0000644",
+      "sha256": "eb560b832629f708ad458f64c6a282bf55ae86c24626431d48d258e9ca0ac6d6"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6748701da2559d6019116eb00e9aeeaad947e08d17f9c9cf77e8f45c19e2c69f"
+      "sha256": "23c4e663f175ea1d6ee4ccbe041905c29814c50612af921c8b836f187e8d8355"
     },
     {
       "path": "docs/api-reference.md",
@@ -1487,7 +1492,7 @@
     {
       "path": "docs/design/projects-surfaces-redesign-direction.md",
       "mode": "0000644",
-      "sha256": "750f39818862c66964788bb0dbc7dba6725ed6ad861f09536195fb3509342abf"
+      "sha256": "c2b0a31e12f4ba4402f2fb0eb774ced49998ad5f751aac9289d49ec1d8ce473a"
     },
     {
       "path": "docs/design/vanilla-hall-ui-redesign-scope.md",
@@ -2692,7 +2697,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "9357b423836c4e8d2cd3c9144d294c3cd3b498ac30755a9e6f62b5bbaa2add5e"
+      "sha256": "870976966de7c48be4172390dc8e4f7d2eb6ac53e20dfb3fd5d40b08cfcd7850"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -3962,7 +3967,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "4aae27c3c56de480e9cc4f19405572a96c6bf0246fdd859adceae629c7a71842"
+      "sha256": "9124712dbaa724d03177f1b5779ca3aad639151c7b1ef9721dd65f5374de4afe"
     },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
@@ -4282,12 +4287,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "09501ec03bde658dfcbc651c0603d0c45f5d38914aafb73ff685ccec7c76d69e"
+      "sha256": "ac23681c5493a57f1faca551e4896e4a7a4e2dabb6246bf2a84c39ae6e571257"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c6882c7a5bf88c3cdd811dd9b957aeffe46b5ffbdc9c42e45a49c5e5caff1edf"
+      "sha256": "7122e5cca352a5abc317d25267eba6c0bab955febf2179bf362a896be424d0bc"
     },
     {
       "path": "public-docs/index.html",
@@ -4547,7 +4552,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "603ec55ce4de6477cf5d0602e5963a096799a404b2324f12c62104023e9e0e4b"
+      "sha256": "88f416526efee1a722fdc082a1f92f26de1d4f8850db4054be79f46d50a1582a"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5202,7 +5207,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "242f51c3e2ae991dc8a02d7285c829d3cd7b2a4022c516b218d259cac14b855f"
+      "sha256": "0a1cdb35e9357e07307d58de8099b2fc3c46377cedafb4d0f5784e2a9a51a639"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -5682,7 +5687,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "f34518361f15a20c4dc60a936878e72b4c81d99e41e00180270919dcbbd83008"
+      "sha256": "e69373026518a4e67ceca38e596354fa471fe11b7b00a718af62a1d3aabc0c4a"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -5902,7 +5907,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6123bf63d65e4e5327c05a413117015e2198293f2a1a2191f10cb1ecbb397fbf"
+      "sha256": "d509a7e4f16027ccef999e8aadf1a2cef5368bce5cd0c3bda3b7eb61cbceaa5f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6197,7 +6202,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "694153e377a78d4325aa4ff9b947f691d71362f843da25815b9740821903802c"
+      "sha256": "1e4db680c5925e473fff9ad6247e797bd9089fdf3696c3ffb161903bda41dcda"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -6747,7 +6752,7 @@
     {
       "path": "tests/github_repos_helpers.mjs",
       "mode": "0000644",
-      "sha256": "a450e5248b3b97ddaa11b1b9c79d768779df24b11cd1177174390ae80f5fe624"
+      "sha256": "0bde5e75593b43a307c3bab748f02b1f77afc2e3a98decf88f2bff419c843b7d"
     },
     {
       "path": "tests/github_token_store.mjs",
@@ -7397,7 +7402,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "71eeb42b47ad2ba11b8379cce263ceac2da42b00b9fe55aab64546027b193364"
+      "sha256": "92dd484634703c5204bc88eeccfdfdf310a2b0984488fb8d065d52a246b9f998"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7532,12 +7537,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "0471ced4ef3d16b5df6a373c04b13c1e83f2c9b2a9590734e4f02f95e195c45a"
+      "sha256": "a5ddb284f4b5cb46e19b90d07dbb06ee42de9e4911d76b882db23a6dab63f8b5"
     },
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "30b55efaa97e695603875ec057901d5333977d41705fc862fc831a424c4e2674"
+      "sha256": "a0e47992e3e5b3158a8949b695fd6306aa01f39a51776fbfc2c5a0d47b881951"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -7582,7 +7587,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "c0e2e85c84f75503438c1951b72a94cf1c74a7cd0c27b774c2dc4d46d99d6cf8"
+      "sha256": "eaadefd338bd50a8310c699cf0acc4bceb34ef601e8ed901cb301bfcdf6bd4c3"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -0,0 +1,58 @@
+# 0176. Private-repo standup: a per-repo read-only deploy key, minted with the owner's token
+
+Date: 2026-08-17 · Status: accepted · Task: 1002735 (walk finding N4, idea 1000708)
+
+## Context
+
+A standalone instance's repo is cloned/pushed **once** with the owner's `repo`-scoped OAuth
+token (ADR 0155), but its durable `origin` is the shared SSH deploy alias
+(`instanceRepoRemote`, ADR 0125) because the recurring deploy — `git pull --ff-only origin
+main` at every provision, and the pull-deploy reset between them — needs auth that never
+expires. The shared key is not registered on repos the platform didn't create, so a PRIVATE
+repo fails every recurring pull with GitHub's no-leak `Repository not found` (reproduced 3×
+in the goal-1000032 walk, **including with a valid token stored** — finding N4). The create
+wizard nevertheless advertised "create the repo yourself and adopt it" as the private-code
+path: a promise the runner could not keep. Seen live on prod (`mercury`, 2026-08-17).
+
+## Decision
+
+When a standalone instance's `target_ref` repo answers **private** to the owner's stored
+token, provisioning mints the instance its own GitHub **deploy key** and wires the repo
+checkout to use it:
+
+- an ed25519 keypair generated beside the checkout (`<root>/.git/cloudbongos-deploy-key` —
+  untracked by definition, survives `git reset --hard`, dies with the checkout);
+- registered on the repo via the owner's token as **`read_only: true`**, titled
+  `cloudbongos-deploy-<slug>` (idempotent: a stale same-title key is replaced);
+- `origin` re-pointed at plain `git@github.com:<owner>/<repo>.git` and
+  `core.sshCommand` set to `ssh -F /dev/null -i <key> -o IdentitiesOnly=yes` **in the repo's
+  own config**, so every future git op in that checkout authenticates with this key no matter
+  which script runs it, and the shared alias's `~/.ssh/config` identity can never leak in.
+
+Public repos take the unchanged shared-alias path — zero behavior change. Teardown
+best-effort revokes the key by title. Pushes keep preferring the owner-token HTTPS URL
+(task 1002317), which is why read-only suffices.
+
+## Alternatives rejected
+
+- **GitHub App installation token** (ADR 0133 gives instances an App): tokens expire hourly,
+  so every unattended pull would need a minting sidecar or a platform round-trip — the wrong
+  amount of machinery for a cron `git pull`, and self-host venues would depend on the hub.
+- **Registering the shared platform key on the repo**: grants the whole platform durable
+  access to the owner's private code with one shared secret; per-repo keys keep the blast
+  radius to one repo, are revocable one at a time, and are visible to the owner in their own
+  repo settings.
+
+## Consequences
+
+- Private repos work end-to-end for adopt, manual, and fresh standups whenever the owner's
+  `repo`-scoped token is stored; without one, private standups still fail at git (the
+  request-time refusal is task 1002909's preflight).
+- The flip-to-private refusal on the manage page (task 1003045) stays until existing
+  already-provisioned instances get the same wiring on flip — a follow-up task, since their
+  origin still rides the shared alias.
+- Builder **dev boxes** of a private-repo project are out of scope here: their
+  `box-source-fetch.sh` clone uses box-side auth and needs the same treatment (follow-up).
+- `bongos upgrade --commit-pin` on a private instance pushes its pin via `origin` — now the
+  read-only key, so GitHub refuses it and the pull-deploy reset can revert the bump.
+  `upgrade.js` needs the owner-token push path (follow-up).

package/docs/adr/README.md

@@ -249,5 +249,6 @@ This keeps the decision history honest and traceable.
 | 0170 | [**The featured projection tells time honestly: `created_at` in, `updated_at` out, owner from the project's own archon** ([task 1002778](https://cloudbongos.com/builders#/task/1002778), goal 1000061). The hub card's metadata pass added `created_at` to the public `/projects/featured` projection, labelled **Listed** — it is the moment the hub catalogued the row, never when the project began, and the C6 card test bans the word "Created". Two recorded deviations: (1) the task brief said `updated_at` was ready to add, but the column is bumped by every client re-registration AND the Archon's feature toggle, so as a public "last updated" it would report curation noise as project activity — it may sort, never project, and the test pins the SELECT list itself (`SELECT *` banned: the route is CORS-open rank:public and a star would leak `owner_github_id`/`status`). (2) The owner fact reads the project's OWN leaderboard archon row (login + avatar, type-checked and capped) from the payload project-stats already fetches — zero extra requests, the 2-fetch pin intact, the advisory `owner_github_id` column still unread per the design contract. Multi-archon: top-credits archon is named; a fallen-off-the-page archon renders as no owner shown, never a wrong one. Rejected: projecting `updated_at` as asked (it lies), reading `owner_github_id` (advisory, contract-banned), a third per-origin fetch for activity recency (moves the test pin for a fact nobody asked for yet).](<redacted>.md) | platform identity / public surface |
 | 0174 | [**Governance is renamed government, its positions are ranks, and "role" is reserved for the three crafts** ([task 1003002](https://cloudbongos.com/builders#/task/1003002), R01 of goal 1000068). Owner directive, 2026-08-16. The word **role** named two unrelated things: the permission system's ladder tiers (`governance_roles`, the "rank-roles") and the three crafts (`tasks.discipline` = engineer/artist/ideator) — and goal 1000066 was actively claiming it for the crafts (`three-roles-only`, `users-hold-roles`), putting the two on a collision course. Resolved at full depth rather than as a label pass, because a labels-only fix leaves the UI and the code disagreeing, which is the condition that produced the collision. `modules/governance/` → `modules/government/`; the kernel module key, the config files, `/api/bongos/governance/*` → `/government/*`, and the permission keys `governance.manage` → `government.manage` (~50 sites) + `page.view.governance` → `page.view.government`. **The entity IS the rank — no second noun**: `governance_roles` → `government_ranks`, `role_key` → `rank_key`, `rank-roles.js` → `ranks.js`; "position" stays prose-only, since introducing it as a code term would recreate the qualifier problem "rank-role" already demonstrates. The cross-module kernel port `governance.roleSync` → `government.rankSync` must land atomically across its provider and both consumers (`modules/lifecycle/db.js`, `src/bongos/db.js`) because it is a transaction participant on the rank-write path. Hand-composed bundles stay in the one table as **custom ranks** — the owner's call over splitting them into a separate "appointments" concept, with the objection recorded (a custom bundle is not a ladder position, and ADR 0172 §4 already treats the two kinds as different). Enforced by a `fitness.js` rule, allowlist shipped with reasons. **Discord's server roles keep the word** — that noun belongs to Discord's API. Amends ADR 0151 + ADR 0172 (the editable-rank-roles one) in **vocabulary only**; ladder slugs, `builders.rank`, `requireRank`, and every floor/grant/assignment semantic are untouched. Rejected: renaming the ladder slugs (turns a bounded rename into a trust-boundary migration), a permanent compat shim (both vocabularies stay correct forever).](<redacted>.md) | government / permissions |
 | 0175 | [**The Board Room: Full Idea ratification is the first upward-pointing gate** ([task 1003014](https://cloudbongos.com/builders#/task/1003014), R01 of goal 1000069). Every existing gate points DOWN the rank ladder; the owner asked for one that could slow THEM down — *"otherwise I can just ship and build as I want, finding loopholes."* The board's subjects are exactly **two**, both rare by construction: a **Full Idea** and a **change to the constitution itself** (`subject_type` from day one). Because the vote gates no build path, the **ADR 0162 tension dissolves rather than being compromised** — nothing self-executes because there is nothing downstream to execute; ratification confers legitimacy and does NOT auto-create the goal. A vote is a **timed sitting, not a quorum**: absent members are *nulled* (dropped from the denominator, never counted as a no), so the clock is the deadlock exit and no shotgun/fork-with-treasury clause is needed at this scale — default 90 minutes, closing early on full turnout, and yes, a short window means whoever is awake governs (the owner's explicit intent). **Consent, not majority**: silence is consent, one reasoned objection returns the idea, and a zero-vote close PASSES. A rejection must carry free text **plus one of the five Full Idea sections** — which is what **forces the hall to be the voting surface**, since a Discord reaction could only ever be feedback-free; Discord is therefore an outbound notification mirror that casts nothing, and its own mobile app is the mobile push (no mobile surface is built). The completeness grade is the **floor** (a window opens automatically on pass), the vote is the **merit**; concurrent windows are normal. Who governs is **configuration** — day one is monarchy expressed as config on the real machinery, never a separate code path — and **amendments are decided under whatever rule is currently in force**, so flipping out of monarchy is a legal monarchy act and no bootstrap exception is needed. Open ballot; an author may never vote on their own item. Franchise derives from **rank, not role**, and that is forced: `PATCH /me/disciplines` is deliberately ungated, so a craft-scoped chamber would be one-request privilege escalation. Unblocks goal 1000067 / IC5, which consumes the pass event and *"invents no parallel vote"*. Rejected: quadratic vote weighting and the attribution-economy knobs (γ, τ, the 30% stack cap — v1's franchise is not credit-weighted at all), eternity clauses, and any legal-entity integration.](<redacted>.md) | government / ideas / governance |
+| 0176 | [**Private-repo standup: a per-repo read-only deploy key, minted with the owner's token** ([task 1002735](https://cloudbongos.com/builders#/task/1002735), goal 1000032; walk finding N4, seen live on `mercury` 2026-08-17). A standalone instance's repo is cloned/pushed once with the owner's `repo`-scoped token (ADR 0155), but the durable `origin` rides the shared SSH deploy alias — which GitHub answers "Repository not found" for a private repo it isn't registered on, so every private standup failed at the recurring `git pull --ff-only origin main`, **token or not**. Fix: when the target repo answers *private* to the owner's stored token, provisioning mints the instance its OWN ed25519 deploy key beside the checkout (`.git/cloudbongos-deploy-key` — untracked, survives `git reset --hard`, dies with the checkout), registers it on the repo **read-only** as `cloudbongos-deploy-<slug>` (idempotent by title; a stale same-title key is replaced, never duplicated), then wires the CHECKOUT: `origin` re-pointed at plain `git@github.com` and `core.sshCommand` pinned to the key with `-F /dev/null` so no `~/.ssh/config` identity can shadow it. Public repos take the unchanged shared-alias path; pushes keep preferring the owner-token HTTPS URL (task 1002317), which is why read-only suffices; teardown best-effort revokes by title. Rejected: **GitHub App installation tokens** (hourly expiry means every unattended pull needs a minting sidecar or a hub round-trip) and **registering the shared platform key on the repo** (one shared secret granting the whole platform durable access to private code; per-repo keys keep the blast radius to one repo and are visible to the owner in their own repo settings). Follow-ups: the manage page's flip-to-private stays refused until already-provisioned instances get the same wiring, and builder dev boxes of a private-repo project need their own leg.](<redacted>.md) | provisioning / security |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/design/projects-surfaces-redesign-direction.md

@@ -78,7 +78,7 @@ Verification is an **overlay on lifecycle, not a new lifecycle state**. The runn
 2. **No wall-clock promises.** Kill "usually under a minute" and friends. Describe what's happening and what happens next; never how long.
 3. **Retry honesty (F19).** Intents retire after 3 attempts and nothing auto-retries. The snagged card says so — "Stopped after 3 tries" — and gains an owner-facing **Try again** action that re-enqueues (the enqueue API already accepts re-provisioning; wire it). "The platform keeps retrying" copy dies.
 4. **Teardown truth (F17) — decided: the database is not dropped.** (Owner, 2026-08-12: no database drop unless we find otherwise — retention is policy, not an accident.) The confirm and the torn-down card say so plainly: the server goes away, the repository stays the owner's, the database is kept and recoverable by the operator. Copy always states exactly what the runner does.
-5. **Repo visibility is stated, always (task 1002721).** Every path that creates or adopts a repo says whether it will be public or private, before the owner commits — GitHub's own UI must never be the first place visibility appears.
+5. **Repo visibility is stated, always (task 1002721).** Every path that creates or adopts a repo says whether it will be public or private, before the owner commits — GitHub's own UI must never be the first place visibility appears. Private repos deploy via a per-project read-only deploy key the platform runner wires at standup (ADR 0176, task 1002735) — a **control-plane feature**: on the self-host venue there is no platform runner, so the `repo-auth` plan step is absent by design and repository access is the owner's own doing (they clone with their own credentials on their own box). A self-host surface must say that plainly rather than imply the platform will wire it.
 6. **Newborn welcome (idea 1000701).** A freshly-provisioned instance greets its founding owner with a welcome moment, and account nags (billing, art-key coverage) are suppressed until first-run completes.
 
 ## 6. Surface · Create wizard

package/modules/dev-box/box-access.js

@@ -171,24 +171,63 @@ const BASE_SPARSE_PATHS = [
 // globs come in two shapes: directory globs (trailing '/', e.g. 'modules/dev-box/')
 // and file-list globs (exact paths, e.g. the kernel key's 'src/bongos/db.js'). We
 // KEEP the directory globs (normalized to no trailing slash, matching the BASE
-// style) and DROP the file globs — every file glob in the map sits under a BASE
-// directory (src/bongos, scripts) or is a top-level/ancestor file cone mode pulls
-// automatically, so base already materializes it. (A future non-cone sparse move
-// could pull individual files; out of scope — cone mode stays.) Deterministic:
-// BASE in declared order, then the module dirs sorted + deduped.
+// style). A FILE glob cannot be emitted as-is, so it contributes its PARENT
+// DIRECTORY instead — unless BASE or another emitted dir already covers it.
+//
+// It used to be dropped outright, on the reasoning that "every file glob in the
+// map sits under a BASE directory (src/bongos, scripts) or is a top-level file
+// cone mode pulls automatically". That was true when written and **silently
+// stopped being true**: ADR 0174 gave the `government` key the file globs
+// `config/government.json` + `config/government.neutral.json`, and `config` is
+// not in BASE. The result was a goal walled to `government` whose box could never
+// see two files inside its own scope wall — which released task 1003018 (R05 of
+// goal 1000069), whose entire deliverable was one of them. Rather than restore an
+// invariant that expires again the next time a module claims a config file, the
+// parent is emitted and the class is covered by construction.
+//
+// TRADE-OFF, stated rather than implied: the parent directory is a SUPERSET of
+// the glob — asking for `config/government.json` materializes all of `config/`.
+// The box's view is already a superset of the wall (BASE hands out `scripts`,
+// `docs` and `tests` wholesale regardless of scope), so this is consistent with
+// the existing posture, not a new concession. The WALL is unchanged: what a
+// builder may author is still decided by goal-scope-check against the globs, not
+// by what happens to be on disk.
+//
+// Top-level file globs (no '/') contribute nothing — cone mode includes root
+// files automatically. Deterministic: BASE in declared order, then the module
+// dirs sorted + deduped.
 function sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) {
   const base = [...BASE_SPARSE_PATHS];
   const seen = new Set(base);
   const extra = [];
+  // Cone mode materializes a directory and everything under it, so a path is
+  // already covered when IT or any ancestor has been emitted. This is what keeps
+  // `scripts/gds/box.js` from adding `scripts/gds` — BASE's `scripts` covers it.
+  const covered = (dir) => {
+    let p = dir;
+    for (;;) {
+      if (seen.has(p)) return true;
+      const cut = p.lastIndexOf('/');
+      if (cut < 0) return false;
+      p = p.slice(0, cut);
+    }
+  };
+  const add = (dir) => {
+    if (!dir || covered(dir)) return;
+    seen.add(dir);
+    extra.push(dir);
+  };
   for (const key of Array.isArray(scopeKeys) ? scopeKeys : []) {
     const entry = moduleScopeMap && typeof moduleScopeMap.scopeForModule === 'function'
       ? moduleScopeMap.scopeForModule(key)
       : null;
     if (!entry || !Array.isArray(entry.globs)) continue;
     for (const glob of entry.globs) {
-      if (typeof glob !== 'string' || !glob.endsWith('/')) continue; // dirs only (cone mode)
-      const dir = glob.replace(/\/+$/, '');
-      if (!seen.has(dir)) { seen.add(dir); extra.push(dir); }
+      if (typeof glob !== 'string' || !glob) continue;
+      if (glob.endsWith('/')) { add(glob.replace(/\/+$/, '')); continue; }
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode already includes it
+      add(glob.slice(0, cut));
     }
   }
   extra.sort();

package/modules/provisioning/onboard-plan.js

@@ -40,6 +40,7 @@ function onboardPlan(mode = 'greenfield', opts = {}) {
     { key: 'dns-preflight', kind: 'auto', shapes: CONTROL_PLANE_SHAPES, label: 'DNS token preflight — before the address step (task 1980)' },
     { key: 'init', kind: 'auto', label: adopt ? 'bongos init --adopt — LAYER onto the existing repo (pre-flight + accept)' : 'bongos init — scaffold the instance config' },
     { key: 'scaffold', kind: 'auto', label: adopt ? 'Layer config + pinned @bongos/core onto the existing repo (no clobber)' : 'Scaffold the standalone repo (own repo + pinned @bongos/core)' },
+    { key: 'repo-auth', kind: 'auto', shapes: CONTROL_PLANE_SHAPES, label: 'Wire repository access — a private repo gets its own read-only deploy key automatically (ADR 0176); you act only if setup asks you to re-grant access or raise it to repository admin' },
     { key: 'provision', kind: 'auto', shapes: CONTROL_PLANE_SHAPES, label: 'Provision core + DB + address + service (standalone, task 1978)' },
     { key: 'seed-version', kind: 'auto', label: 'Seed the first version (V1) so the instance can take tasks immediately (task 2119)' },
     { key: 'oauth-app', kind: 'human', label: 'Wire GitHub sign-in — one-click GitHub App (task 2080), or a manual OAuth app' },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.217",
+  "version": "1.19.219",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.217",
+      "version": "1.19.219",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.217",
+  "version": "1.19.219",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -632,7 +632,7 @@ h1[tabindex="-1"]:focus{outline:none;}
              explanation, not another platform's task tracker. -->
         <details class="finePrint" id="mRepoVisWhy">
           <summary>Why can’t it be private yet?</summary>
-          <p>The platform deploys a project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. A private repository’s next deploy would simply fail, so the switch stays off until each project gets its own deploy credential. <!--apex-only:start-->That work is tracked as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall.<!--apex-only:end--></p>
+          <p>The platform used to deploy every project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. New standups fix this: a private repository now gets the project’s own read-only deploy key, wired automatically<!--apex-only:start--> — shipped as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall<!--apex-only:end-->. A project set up before that still reads with the shared credential, so flipping it private would break its next deploy — the switch stays off until existing projects are re-wired.</p>
         </details>
       </div>
 
@@ -781,7 +781,7 @@ h1[tabindex="-1"]:focus{outline:none;}
                 <!-- visibility is stated on EVERY repo path (task 1002721) — this baked
                      line is the floor; updateFreshPreview() replaces it with the same
                      claim plus the resolved repo URL once a name is typed -->
-                <div class="hint" id="ghFreshHint">We’ll create an empty <strong>public</strong> repo — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.</div>
+                <div class="hint" id="ghFreshHint">We’ll create an empty <strong>public</strong> repo — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead — a private repository gets its own read-only deploy key automatically.</div>
               </div>
 
               <div class="row2" id="manualHome">
@@ -2517,7 +2517,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
            public by design (github-repos.js — open-source, capture-resistant); the
            private path is adopting a private repo the owner makes themselves. */
-        hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.';
+        hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead — a private repository gets its own read-only deploy key automatically.';
       }
     }
     $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
@@ -3623,7 +3623,9 @@ h1[tabindex="-1"]:focus{outline:none;}
 
   function errCategory(note) {
     var n = String(note || '');
-    if (/repository not found/i.test(n)) return 'We couldn’t push the starter code to the repository — it wasn’t found on GitHub.';
+    if (/^repository not found:/i.test(n)) return 'We couldn’t find the project’s repository on GitHub even with the access you granted — it may have been renamed or deleted, or the access was lost.';
+    if (/^repository access is not admin:/i.test(n)) return 'Your GitHub access can read the repository but can’t manage its deploy keys — a repository admin needs to raise your access (or make the repository public).';
+    if (/repository not found/i.test(n)) return 'We couldn’t push the starter code to the repository — it wasn’t found on GitHub. A private repository looks “not found” too — if yours is private, sign in again to re-grant repository access, then retry.';
     if (/mkdir|no such file or directory|read-only file system/i.test(n)) return 'The server couldn’t prepare a workspace for the project.';
     if (/(push|clone|github).*permission|permission.*(push|clone|repo)/i.test(n)) return 'We couldn’t reach the repository — the account that set it up doesn’t have permission.';
     if (/permission denied/i.test(n)) return 'The server hit a permission wall while setting up.';
@@ -3996,14 +3998,14 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (repo.private) {
       repoVisMsg(
         '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
-        '<div class="projMsg err">The platform can’t deploy private repositories yet, so deploys for this project will fail while it stays private.</div>' +
+        '<div class="projMsg err">A private repository deploys through the project’s own read-only deploy key, wired at standup. A project set up before that fix can’t read it yet — retry the standup from your projects page, or make the repository public.</div>' +
         (repo.admin
           ? '<div class="actions"><button type="button" class="btn small" data-repo-public>Make it public</button></div>'
           : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
     } else {
       repoVisMsg(
         '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
-        '<p class="finePrint">Making it private isn’t possible from here yet: the platform can’t deploy private repositories. The switch lands with that fix.</p>');
+        '<p class="finePrint">Making it private isn’t possible from here yet: this project’s deploys still read the repository with the shared credential, so flipping now would break the next deploy. The switch lands with the re-wiring fix.</p>');
     }
   }
 

package/scripts/gds/provision.js

@@ -575,17 +575,8 @@ async function scaffoldStandaloneRepo(inst, deps) {
   // token on both paths. It rides a chmod-600 git credential-store file, never the logged
   // command or makeExec's env (makeExec surfaces both), and is removed in a `finally` so a
   // failed git op can't leave it on disk. No token (org-owned repo, or secret-box off) →
-  // fall back to the SSH `origin` remote. `deps.getGithubToken` is injectable for tests;
-  // production resolves it lazily against the core db slice with the runner's pool.
-  let ownerToken = null;
-  if (inst.owner_builder_id) {
-    try {
-      const fetchTok = deps.getGithubToken
-        || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db }));
-      const r = await fetchTok(inst.owner_builder_id);
-      ownerToken = r && r.token ? r.token : null;
-    } catch (e) { log(`  [scaffold] owner OAuth token lookup failed (${e && e.message}) — using the SSH remote`); }
-  }
+  // fall back to the SSH `origin` remote.
+  const ownerToken = await resolveOwnerGithubToken(inst, deps, { tag: '[scaffold]' });
   // The credential-store file + the credential-LESS URL git resolves against it. The URL
   // carries only the `x-access-token` username (no secret), so it is safe in a logged argv.
   const credFile = ownerToken ? path.join(os.tmpdir(), `bongos-gitcred-${inst.slug}-${process.pid}`) : null;
@@ -742,6 +733,158 @@ async function scaffoldStandaloneRepo(inst, deps) {
   }
 }
 
+// ── private-repo deploy key (ADR 0176, task 1002735; walk finding N4) ────────────
+
+// The instance owner's stored `repo`-scoped OAuth token (ADR 0155), or null (none
+// stored, org-owned repo, secret-box off). Shared by the scaffold push, the
+// private-repo deploy-key wiring, and the teardown revoke. `deps.getGithubToken` is
+// injectable for tests; production resolves it lazily against the core db slice
+// with the runner's pool.
+async function resolveOwnerGithubToken(inst, deps, { tag = '[repo-auth]' } = {}) {
+  if (!inst.owner_builder_id) return null;
+  try {
+    const fetchTok = deps.getGithubToken
+      || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db }));
+    const r = await fetchTok(inst.owner_builder_id);
+    return r && r.token ? r.token : null;
+  } catch (e) {
+    (deps.log || (() => {}))(`  ${tag} owner OAuth token lookup failed (${e && e.message})`);
+    return null;
+  }
+}
+
+function deployKeyTitle(inst) { return `cloudbongos-deploy-${inst.slug}`; }
+// Beside the checkout's own metadata: untracked by definition, survives the deploy's
+// `git reset --hard`, and dies with the checkout rather than accreting in ~/.ssh.
+function deployKeyPath(inst) { return path.posix.join(standaloneRoot(inst), '.git', 'cloudbongos-deploy-key'); }
+
+// Make a PRIVATE target_ref durably readable by the recurring deploy pull. The
+// owner's token covers only the ONE-SHOT clone/push (its credential file is deleted
+// after the scaffold), while `origin` rides the shared SSH alias — which GitHub
+// answers "Repository not found" for a private repo it isn't registered on. That
+// mismatch is walk finding N4: every private standup failed at `git pull --ff-only
+// origin main`, token or not (seen live: mercury, 2026-08-17).
+//
+// The fix (ADR 0176): mint the instance its OWN ed25519 deploy key, register it
+// READ-ONLY on the repo with the owner's token (idempotent by title; a stale
+// same-title key is replaced), then wire the CHECKOUT — origin re-pointed at plain
+// github.com and core.sshCommand pinned to the key with -F /dev/null so no
+// ~/.ssh/config identity can shadow it. Public repos return untouched; no token →
+// skip (the request-time refusal is task 1002909's preflight). Dry-run plans only.
+async function ensurePrivateRepoAccess(inst, deps) {
+  const { log, apply } = deps;
+  const exec = deps.controlExec || deps.exec;
+  if (inst.hosting_shape !== 'standalone') return { skipped: 'shape' };
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) return { skipped: 'no_repo' };
+  // Dry-run stays OFFLINE like every other plan path here (the checkDnsTokenScope
+  // preflight is apply-gated for the same reason): no token read, no GitHub call —
+  // a plan run must stay a safe inspection tool for a snagged instance.
+  if (!apply) {
+    log(`  [repo-auth] would check ${repo.owner}/${repo.name} visibility with the owner's credential and, if PRIVATE, mint + register a read-only deploy key and wire origin + core.sshCommand to it (ADR 0176)`);
+    return { planned: true };
+  }
+  const ownerToken = await resolveOwnerGithubToken(inst, deps);
+  if (!ownerToken) {
+    log('  [repo-auth] no usable owner GitHub credential (none stored, or it could not be read) — a PRIVATE repo would fail at the deploy pull (public repos are unaffected)');
+    return { skipped: 'no_token' };
+  }
+  const ghRepos = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos'));
+  let info;
+  try {
+    info = await ghRepos.getUserRepo(ownerToken, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+  } catch (e) {
+    if (e && e.code === 'repo_not_found') {
+      // Plain sentence: this rides error_note onto the owner's project card.
+      throw new Error(`repository not found: GitHub answered 404 for ${repo.owner}/${repo.name} even with your granted credential — the repository may have been renamed or deleted, or the credential lost access. Check it on GitHub, then try again.`);
+    }
+    log(`  [repo-auth] could not read ${repo.owner}/${repo.name} (${e && e.message}) — continuing; a PRIVATE repo would fail at the deploy pull`);
+    return { skipped: 'github_unreachable' };
+  }
+
+  const root = standaloneRoot(inst);
+  const keyPath = deployKeyPath(inst);
+  const title = deployKeyTitle(inst);
+  const fsImpl = deps.fsImpl || fs;
+
+  if (!info.private) {
+    // Flipped private → public since we wired it: un-wire, or the checkout stays
+    // pinned (IdentitiesOnly + -F /dev/null admit no other identity) to a key the
+    // owner is now free to delete from their repo settings. Keyed on our key file
+    // so the common public path stays zero-mutation.
+    if (fsImpl.existsSync(keyPath)) {
+      log(`  [repo-auth] ${repo.owner}/${repo.name} is public again — un-wiring its deploy key`);
+      try {
+        const keys = await ghRepos.listDeployKeys(ownerToken, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+        const ours = keys.find((k) => k.title === title);
+        if (ours) await ghRepos.deleteDeployKey(ownerToken, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
+      } catch (e) { log(`  [repo-auth] (remote key revoke skipped: ${e && e.message})`); }
+      exec(`git -C ${root} remote set-url origin ${instanceRepoRemote(repo)}`);
+      exec(`git -C ${root} config --unset core.sshCommand`, { allowFail: true });
+      exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+      return { private: false, unwired: true };
+    }
+    return { private: false };   // the shared-alias path reads public repos as-is
+  }
+
+  // Registering a deploy key needs repository ADMIN; getUserRepo already told us.
+  // Refuse up front with the fix, instead of a raw 403 mid-standup.
+  if (info.admin === false) {
+    throw new Error(`repository access is not admin: your granted credential can read ${repo.owner}/${repo.name}, but registering its deploy key needs repository ADMIN. Ask a repository admin to raise your access (or make the repository public), then try again.`);
+  }
+
+  log(`  [repo-auth] ${repo.owner}/${repo.name} is PRIVATE — wiring its own read-only deploy key (ADR 0176)`);
+  if (!fsImpl.existsSync(keyPath) || !fsImpl.existsSync(`${keyPath}.pub`)) {
+    exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+    exec(`ssh-keygen -q -t ed25519 -N '' -C ${title} -f ${keyPath}`);
+    exec(`chmod 600 ${keyPath}`);   // ssh-keygen's 0600 default, made an explicit invariant
+  }
+  const pubKey = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+  // Compare algorithm+key only — GitHub stores the key without the local comment.
+  const keyBody = (k) => String(k || '').trim().split(/\s+/).slice(0, 2).join(' ');
+  let minted = false;
+  try {
+    const keys = await ghRepos.listDeployKeys(ownerToken, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+    const ours = keys.find((k) => k.title === title);
+    const current = !!(ours && keyBody(ours.key) === keyBody(pubKey));
+    if (ours && !current) {
+      // GitHub 422s a duplicate title/key, and a stale registration is a dead credential —
+      // replace, never accumulate.
+      await ghRepos.deleteDeployKey(ownerToken, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
+      log(`  [repo-auth] removed the stale "${title}" key on ${repo.owner}/${repo.name} (local key changed)`);
+    }
+    if (!current) {
+      try {
+        await ghRepos.addDeployKey(ownerToken, { owner: repo.owner, name: repo.name, title, key: pubKey, readOnly: true, fetchImpl: deps.fetchImpl });
+      } catch (e) {
+        if (!e || e.code !== 'key_in_use') throw e;
+        // The keypair is slug-keyed but the repo can change underneath it (renamed
+        // then recreated, target_ref re-pointed): the key is registered SOMEWHERE
+        // else, so retrying with this pair can never succeed. Mint fresh, try once.
+        log('  [repo-auth] GitHub holds this key elsewhere (422) — minting a fresh keypair and retrying once');
+        exec(`rm -f ${keyPath} ${keyPath}.pub`, { allowFail: true });
+        exec(`ssh-keygen -q -t ed25519 -N '' -C ${title} -f ${keyPath}`);
+        exec(`chmod 600 ${keyPath}`);
+        const freshPub = String(fsImpl.readFileSync(`${keyPath}.pub`, 'utf8')).trim();
+        await ghRepos.addDeployKey(ownerToken, { owner: repo.owner, name: repo.name, title, key: freshPub, readOnly: true, fetchImpl: deps.fetchImpl });
+      }
+      minted = true;
+      log(`  [repo-auth] registered read-only deploy key "${title}" on ${repo.owner}/${repo.name}`);
+    } else {
+      log(`  [repo-auth] deploy key "${title}" already registered — nothing to mint`);
+    }
+  } catch (e) {
+    if (e && e.code === 'not_repo_admin') {
+      throw new Error(`repository access is not admin: your granted credential can read ${repo.owner}/${repo.name}, but registering its deploy key needs repository ADMIN. Ask a repository admin to raise your access (or make the repository public), then try again.`);
+    }
+    // Plain sentence for the owner card — a transient GitHub hiccup must not read as jargon.
+    throw new Error(`deploy-key setup failed for ${repo.owner}/${repo.name}: ${e && e.message}. Nothing is wrong on your side — try again, and if it keeps failing make the repository public and retry.`);
+  }
+  exec(`git -C ${root} remote set-url origin git@github.com:${repo.owner}/${repo.name}.git`);
+  exec(`git -C ${root} config core.sshCommand "ssh -F /dev/null -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`);
+  return { private: true, minted };
+}
+
 // ── re-provision core-pin refresh (gap-list W3, task 1003050) ────────────────────
 //
 // The hazard: a standalone instance's RUNNING core can move ahead of its repo's
@@ -848,15 +991,7 @@ async function refreshStandaloneCorePin(inst, deps) {
     // Commit + push the refresh to the instance repo — the shared deploy key cannot
     // write a consumer's repo (task 1002317), so prefer the owner's OAuth token,
     // exactly like the scaffold's push.
-    let ownerToken = null;
-    if (inst.owner_builder_id) {
-      try {
-        const fetchTok = deps.getGithubToken
-          || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db }));
-        const r = await fetchTok(inst.owner_builder_id);
-        ownerToken = r && r.token ? r.token : null;
-      } catch (e) { log(`  [core-pin] owner OAuth token lookup failed (${e && e.message}) — pushing via the SSH origin`); }
-    }
+    const ownerToken = await resolveOwnerGithubToken(inst, deps, { tag: '[core-pin]' });
     const repo = parseTargetRef(inst.target_ref);
     const credFile = ownerToken && repo ? path.join(os.tmpdir(), `bongos-gitcred-pin-${inst.slug}-${process.pid}`) : null;
     const cmd = buildCorePinRefreshCommit({ root, fromVersion: plan.pinned, toVersion: targetVersion, repo, ownerToken, credFile });
@@ -1571,6 +1706,10 @@ async function provisionInstance(inst, deps) {
     // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
     if (inst.hosting_shape === 'standalone') {
       await scaffoldStandaloneRepo(inst, deps);
+      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's
+      // `git pull --ff-only origin main` — the pull that failed unauthenticated
+      // on every private standup (walk finding N4; ADR 0176).
+      await ensurePrivateRepoAccess(inst, deps);
     }
   }
   if (!inst.db_name) { patch.db_name = inst.slug; inst = { ...inst, db_name: inst.slug }; }
@@ -1917,6 +2056,33 @@ async function teardownInstance(inst, deps) {
   } else if (apply && deps.doApi && inst.droplet_id) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
+  // Revoke the instance's deploy key (ADR 0176) and remove its local halves. The
+  // checkout itself is deliberately left in place (data is precious), so the key
+  // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project
+  // silently keeping durable read access to the owner's private repo is the exact
+  // shape a teardown exists to end. A missing token / API hiccup never blocks it.
+  if (inst.hosting_shape === 'standalone' && inst.target_ref) {
+    const repo = parseTargetRef(inst.target_ref);
+    if (repo) {
+      try {
+        const token = await resolveOwnerGithubToken(inst, deps, { tag: '[teardown]' });
+        if (token) {
+          const ghRepos = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos'));
+          if (apply) {
+            const keys = await ghRepos.listDeployKeys(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+            const ours = keys.find((k) => k.title === deployKeyTitle(inst));
+            if (ours) {
+              await ghRepos.deleteDeployKey(token, { owner: repo.owner, name: repo.name, keyId: ours.id, fetchImpl: deps.fetchImpl });
+              log(`  revoked the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name}`);
+            }
+          } else log(`  would revoke the "${deployKeyTitle(inst)}" deploy key on ${repo.owner}/${repo.name} if present`);
+        } else {
+          log(`  (deploy-key revoke skipped: no usable owner credential — if ${repo.owner}/${repo.name} carries a "${deployKeyTitle(inst)}" deploy key, remove it in the repo's settings)`);
+        }
+      } catch (e) { log(`  (deploy-key revoke skipped: ${e && e.message})`); }
+      boxExec(`rm -f ${deployKeyPath(inst)} ${deployKeyPath(inst)}.pub`, { allowFail: true });
+    }
+  }
   if (apply) {
     await provisioning.setInstanceStatus(db, inst.id, 'torn_down', { torn_down_at: new Date().toISOString() });
     await provisioning.recordEvent(db, { instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'torn_down', detail: 'torn down by runner', actor: 'runner' });
@@ -2318,6 +2484,8 @@ module.exports = {
   resolveVendorableCoreTarball, planCorePinRefresh, safeVersionLabel, buildCorePinRefreshCommit, refreshStandaloneCorePin,
   // adopt vs greenfield onboarding (ADR 0121, task 1002562)
   onboardMode, alreadyScaffolded,
+  // private-repo deploy key (ADR 0176, task 1002735)
+  resolveOwnerGithubToken, deployKeyTitle, deployKeyPath, ensurePrivateRepoAccess,
   zoneForDomain, dnsUpsertEnv, classifyZoneScope, checkDnsTokenScope,
   caddyBlock, caddySnippetPath, healthzCmd, dedicatedUserData, nextFreePort,
   // executors + orchestration (injectable deps for tests)

package/src/bongos/github-repos.js

@@ -162,4 +162,82 @@ async function makeRepoPublic(token, { owner, name, fetchImpl = fetch } = {}) {
   };
 }
 
-module.exports = { listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, GithubApiError, MAX_PAGES };
+// ---- deploy keys (task 1002735 / ADR 0176) ----
+// The per-repo credential a PRIVATE repo's recurring deploy pull authenticates
+// with: provisioning mints an ed25519 keypair, registers its public half here with
+// the owner's token, and teardown revokes it by title. read_only defaults TRUE and
+// widening it must stay an explicit caller choice — the deploy only ever pulls, and
+// a default-writable key would hand a leaked instance box write access to the
+// owner's repo history.
+
+async function listDeployKeys(token, { owner, name, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/keys?per_page=${PER_PAGE}`, {
+    headers: ghHeaders(token),
+  });
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused — deploy keys need repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!res.ok) {
+    throw new GithubApiError(`GitHub deploy-key list failed (${res.status})`, { status: res.status, code: 'github_error' });
+  }
+  const rows = await res.json();
+  return (Array.isArray(rows) ? rows : []).map((k) => ({
+    id: k.id, title: k.title, key: k.key, read_only: !!k.read_only,
+  }));
+}
+
+async function addDeployKey(token, { owner, name, title, key, readOnly = true, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/keys`, {
+    method: 'POST',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ title, key, read_only: readOnly }),
+  });
+  if (res.status === 201) {
+    const k = await res.json();
+    return { id: k.id, title: k.title, read_only: !!k.read_only };
+  }
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused — deploy keys need repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (res.status === 422) {
+    // GitHub refuses a public key already registered ANYWHERE (deploy key or user key).
+    throw new GithubApiError('GitHub refused the key — it is already registered somewhere', { status: 422, code: 'key_in_use' });
+  }
+  throw new GithubApiError(`GitHub deploy-key add failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
+async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/keys/${encodeURIComponent(keyId)}`, {
+    method: 'DELETE',
+    headers: ghHeaders(token),
+  });
+  if (res.status === 204) return true;
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused — deploy keys need repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that deploy key', { status: 404, code: 'key_not_found' });
+  }
+  throw new GithubApiError(`GitHub deploy-key delete failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
+module.exports = {
+  listUserRepos, createUserRepo, getUserRepo, makeRepoPublic,
+  listDeployKeys, addDeployKey, deleteDeployKey,
+  GithubApiError, MAX_PAGES,
+};

package/src/module-api.js

@@ -861,8 +861,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.215 with no explicit bump. run 32084584347. (task 1002620)
 //   1.19.217 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.216 with no explicit bump. run 32084927511. (task 1002620)
+//   1.19.218 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.217 with no explicit bump. run 32086598601. (task 1002620)
+//   1.19.219 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.217'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.219'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_access.mjs

@@ -221,14 +221,69 @@ t('cone-filter: dev-box keeps its DIRS, DROPS its file globs (scripts/gds/box.js
   assert.ok(out.includes('devbox-app'), 'the app dir is kept');
   assert.ok(!out.some((p) => p.endsWith('.js') || p.endsWith('.sh')), 'no file globs survive the cone filter');
   assert.ok(!out.includes('scripts/gds/box.js'), 'the box CLI file is dropped (BASE scripts covers it)');
+  // …and its PARENT is not added either: BASE's `scripts` already covers it, so
+  // the ancestor check must stop `scripts/gds` from appearing. This is the half
+  // that keeps the file-glob rescue below from over-sharing.
+  assert.ok(!out.includes('scripts/gds'), 'a covered parent is not re-emitted');
+});
+
+// A file glob whose parent is NOT already covered must contribute that parent.
+// Regression for the live failure that released task 1003018 (R05 of goal
+// 1000069): the `government` key's config/government*.json globs were dropped on
+// the reasoning that every file glob sits under a BASE directory — true when
+// written, false once ADR 0174 added them, since `config` is not in BASE. The box
+// could not see two files inside its own scope wall.
+t('file-glob rescue: government contributes `config` for its config/*.json globs', () => {
+  const out = access.sparsePathsForScopeKeys(['government'], scopeMap);
+  assert.ok(out.includes('modules/government'), 'the module dir is kept');
+  assert.ok(out.includes('config'), 'config/government.neutral.json must reach the box via its parent');
+  assert.ok(!out.some((p) => p.endsWith('.json')), 'still no file paths — cone mode would reject one');
+});
+
+t('file-glob rescue holds for EVERY key in the map — no module can silently lose one', () => {
+  // Enumerated, never sampled: a module that gains a file glob under a new parent
+  // is covered the day it lands, which is exactly how this bug escaped before.
+  for (const key of scopeMap.moduleKeys()) {
+    const out = access.sparsePathsForScopeKeys([key], scopeMap);
+    for (const glob of scopeMap.scopeForModule(key).globs) {
+      if (glob.endsWith('/')) continue;
+      const cut = glob.lastIndexOf('/');
+      if (cut < 0) continue; // a root file — cone mode includes it automatically
+      const parent = glob.slice(0, cut);
+      const reachable = out.some((p) => parent === p || parent.startsWith(`${p}/`));
+      assert.ok(reachable, `${key}: no cone path materializes ${glob} (parent ${parent})`);
+    }
+  }
+});
+
+t('the emitted set stays directories only, for every key', () => {
+  // A leading dot is a DIRECTORY here ('.devcontainer', '.claude'), so the
+  // extension test must require a non-dot character before the dot — otherwise
+  // every BASE dotfile-dir reads as a file and this assertion fires on healthy
+  // input. (It did, on first write.)
+  const looksLikeFile = (seg) => /[^.]\.[a-z0-9]+$/i.test(seg);
+  for (const key of scopeMap.moduleKeys()) {
+    for (const p of access.sparsePathsForScopeKeys([key], scopeMap)) {
+      assert.ok(!looksLikeFile(p.split('/').pop()),
+        `${key}: ${p} looks like a file — git sparse-checkout set would abort on it`);
+    }
+  }
 });
 
-t('cone-filter: the kernel key contributes only its real DIR globs (config, src/module-loader)', () => {
+t('cone-filter: the kernel key materializes its real DIR globs (config, src/module-loader)', () => {
   const out = access.sparsePathsForScopeKeys(['kernel'], scopeMap);
   // kernel is mostly individual src/bongos/*.js FILES (dropped — BASE src/bongos
   // covers them via cone ancestor-inclusion) + a few genuine DIR globs.
   assert.ok(out.includes('config'), 'config/ is a real dir the task needs, not in BASE');
-  assert.ok(out.includes('src/module-loader'), 'src/module-loader/ is a real dir not in BASE');
+  // src/module-loader/ is a real dir not in BASE, but it is NOT emitted verbatim:
+  // kernel also carries the file globs src/instance-config.js, src/branding.js,
+  // src/modules.js and src/module-api.js, whose rescued parent is `src` — and once
+  // `src` is emitted the ancestor check absorbs every path beneath it, this one
+  // included. Asserting literal membership would be asserting emission ORDER, not
+  // reachability. What the box must actually get is the DIRECTORY's contents, so
+  // assert that, using the same idiom as the enumerated rescue test above.
+  const reaches = (dir) => out.some((p) => dir === p || dir.startsWith(`${p}/`));
+  assert.ok(reaches('src/module-loader'), 'src/module-loader must be materialized (here via the rescued `src`)');
   assert.ok(!out.includes('src/bongos/db.js'), 'the kernel FILE globs are dropped');
   assert.ok(!out.includes('server.js'), 'top-level files never enter the sparse set (cone auto-includes them)');
 });

package/tests/github_repos_helpers.mjs

@@ -163,3 +163,77 @@ test('makeRepoPublic: 403 → typed not_repo_admin', async () => {
     (e) => e.code === 'not_repo_admin' && e.status === 403,
   );
 });
+
+// ---- deploy-key helpers (task 1002735 / ADR 0176) ----
+
+test('listDeployKeys: GETs /repos/{owner}/{name}/keys, maps id/title/key/read_only', async () => {
+  let calledUrl = '';
+  const fetchImpl = async (url) => {
+    calledUrl = url;
+    return res(200, [
+      { id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAA1', read_only: true, extra: 'dropped' },
+      { id: 12, title: 'laptop', key: 'ssh-ed25519 AAAA2', read_only: false },
+    ]);
+  };
+  const keys = await gh.listDeployKeys('tok', { owner: 'me', name: 'demo', fetchImpl });
+  assert.match(calledUrl, /\/repos\/me\/demo\/keys\?/);
+  assert.deepEqual(keys, [
+    { id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAA1', read_only: true },
+    { id: 12, title: 'laptop', key: 'ssh-ed25519 AAAA2', read_only: false },
+  ]);
+});
+
+test('listDeployKeys: 404 → typed repo_not_found', async () => {
+  const fetchImpl = async () => res(404, { message: 'Not Found' });
+  await assert.rejects(
+    () => gh.listDeployKeys('tok', { owner: 'me', name: 'gone', fetchImpl }),
+    (e) => e.code === 'repo_not_found' && e.status === 404,
+  );
+});
+
+test('addDeployKey: POSTs title+key with read_only:true BY DEFAULT — a write key must be an explicit choice', async () => {
+  // The deploy pull only ever reads; a default-writable key would silently widen the
+  // blast radius of a leaked instance box to the owner's repo history.
+  let sentBody = null;
+  const fetchImpl = async (url, init) => {
+    sentBody = JSON.parse(init.body);
+    return res(201, { id: 99, title: 'cloudbongos-deploy-demo', read_only: true });
+  };
+  const out = await gh.addDeployKey('tok', { owner: 'me', name: 'demo', title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAA1 c', fetchImpl });
+  assert.deepEqual(sentBody, { title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAA1 c', read_only: true });
+  assert.deepEqual(out, { id: 99, title: 'cloudbongos-deploy-demo', read_only: true });
+});
+
+test('addDeployKey: 422 → typed key_in_use (GitHub refuses a key already registered anywhere)', async () => {
+  const fetchImpl = async () => res(422, { message: 'key is already in use' });
+  await assert.rejects(
+    () => gh.addDeployKey('tok', { owner: 'me', name: 'demo', title: 't', key: 'k', fetchImpl }),
+    (e) => e.code === 'key_in_use' && e.status === 422,
+  );
+});
+
+test('deploy-key helpers: 403 → typed not_repo_admin on all three (deploy keys need repo ADMIN, and the runner maps this to a plain refusal)', async () => {
+  const fetchImpl = async () => res(403, { message: 'Must have admin rights' });
+  for (const call of [
+    () => gh.listDeployKeys('tok', { owner: 'me', name: 'demo', fetchImpl }),
+    () => gh.addDeployKey('tok', { owner: 'me', name: 'demo', title: 't', key: 'k', fetchImpl }),
+    () => gh.deleteDeployKey('tok', { owner: 'me', name: 'demo', keyId: 1, fetchImpl }),
+  ]) {
+    await assert.rejects(call, (e) => e.code === 'not_repo_admin' && e.status === 403);
+  }
+});
+
+test('deleteDeployKey: DELETEs /keys/{id}, true on 204; 404 → typed key_not_found', async () => {
+  let called = null;
+  const ok = await gh.deleteDeployKey('tok', {
+    owner: 'me', name: 'demo', keyId: 11,
+    fetchImpl: async (url, init) => { called = { url, method: init.method }; return res(204, null); },
+  });
+  assert.equal(ok, true);
+  assert.equal(called.method, 'DELETE');
+  assert.match(called.url, /\/repos\/me\/demo\/keys\/11$/);
+  await assert.rejects(
+    () => gh.deleteDeployKey('tok', { owner: 'me', name: 'demo', keyId: 12, fetchImpl: async () => res(404, {}) }),
+    (e) => e.code === 'key_not_found' && e.status === 404,
+  );
+});

package/tests/onboard.mjs

@@ -46,6 +46,24 @@ test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labe
   assert.doesNotMatch(label(green, 'init'), /--adopt/);
 });
 
+test('onboardPlan lists repo-auth as an AUTO, control-plane step between scaffold and provision (ADR 0176, task 1002735)', () => {
+  // The private-repo deploy-key wiring runs inside provisionInstance right after the
+  // scaffold; naming it in the ONE canonical sequence is what surfaces the only
+  // owner-side condition (re-grant access / raise to admin) in every done panel.
+  const plan = ob.onboardPlan();
+  const keys = plan.map((s) => s.key);
+  const step = plan.find((s) => s.key === 'repo-auth');
+  assert.ok(step, 'the plan carries a repo-auth step');
+  assert.equal(step.kind, 'auto', 'the runner mints + registers the key — no routine owner action');
+  assert.deepEqual(step.shapes, ['standalone', 'co-tenant', 'dedicated'],
+    'self-host has no platform runner, so its plan must not promise this leg');
+  assert.ok(keys.indexOf('scaffold') < keys.indexOf('repo-auth'), 'the checkout exists before it can be wired');
+  assert.ok(keys.indexOf('repo-auth') < keys.indexOf('provision'), 'wired before the provision leg whose pull needs it');
+  assert.match(step.label, /read-only deploy key/, 'the label says what the key can and cannot do');
+  // present in BOTH modes — adopt and greenfield private repos take the same wiring
+  assert.ok(ob.onboardPlan('adopt').find((s) => s.key === 'repo-auth'));
+});
+
 test('onboardPlan lists seed-first-version as an explicit AUTO step right after provision (task 2119 anti-drift)', () => {
   // The first-version seed used to be an unlisted afterthought bolted to the local
   // `bongos init` leg (run --no-seed in every hosted flow, so it never fired). Making

package/tests/projects_hub.mjs

@@ -995,9 +995,10 @@ test('flip-to-private cannot travel from this page — only the public direction
   assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
   assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
     'no code path may send the private direction');
-  // the refusal is SAID, with its reason, not silently missing
-  assert.match(SCRIPT, /can’t deploy private repositories/,
-    'the private-repo limitation is stated in plain words');
+  // the refusal is SAID, with its reason, not silently missing — post-ADR-0176 the
+  // reason is THIS project's shared-credential wiring, not a platform-wide inability
+  assert.match(SCRIPT, /would break the next deploy/,
+    'the flip-to-private limitation is stated in plain words');
 });
 
 test('the visibility shown is GitHub\'s answer, never an assumption', () => {

package/tests/provision.mjs

@@ -1990,5 +1990,186 @@ await ta('UNUSABLE creds from a successful conversion still report codeSpent —
   assert.equal(r.codeSpent, true, 'the conversion RESOLVED — GitHub burned the code even though the creds are junk');
 });
 
+console.log('\nprivate-repo deploy key (ADR 0176, task 1002735):');
+
+// A recorder wired for ensurePrivateRepoAccess: fake GitHub API + fake fs so no
+// network, no real keys. `keys` = what listDeployKeys answers; `existing` = whether
+// the local keypair files are already on disk.
+function repoAuthDeps({ apply = true, priv = true, token = 'gho_TOK', keys = [], pub = 'ssh-ed25519 AAAAlocal cloudbongos-deploy-demo', existing = true } = {}) {
+  const { deps, cmds } = recorder({ apply });
+  const apiCalls = [];
+  if (token) deps.getGithubToken = async () => ({ token, scope: 'read:user,repo' });
+  deps.githubRepos = {
+    getUserRepo: async (_t, a) => { apiCalls.push(['get', `${a.owner}/${a.name}`]); return { full_name: `${a.owner}/${a.name}`, private: priv, admin: true }; },
+    listDeployKeys: async (_t, a) => { apiCalls.push(['list', `${a.owner}/${a.name}`]); return keys; },
+    addDeployKey: async (_t, a) => { apiCalls.push(['add', a.title, a.key, a.readOnly]); return { id: 99, title: a.title, read_only: true }; },
+    deleteDeployKey: async (_t, a) => { apiCalls.push(['del', a.keyId]); return true; },
+  };
+  deps.fsImpl = { existsSync: () => existing, readFileSync: () => `${pub}\n` };
+  return { deps, cmds, apiCalls };
+}
+const privInst = { id: 9, slug: 'demo', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 7, target_ref: 'lars589/demo' };
+
+await ta('ensurePrivateRepoAccess(private): registers a READ-ONLY key and wires origin + core.sshCommand into the checkout', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ existing: false });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.private, true);
+  const joined = cmds.join('\n');
+  // a fresh ed25519 keypair, passphrase-less, generated where the checkout lives,
+  // its 0600 mode made explicit rather than inherited from ssh-keygen's default
+  assert.match(joined, /ssh-keygen -q -t ed25519 -N '' -C cloudbongos-deploy-demo -f \S+\/demo\/\.git\/cloudbongos-deploy-key/);
+  assert.match(joined, /chmod 600 \S+\/\.git\/cloudbongos-deploy-key/);
+  // registered read_only:true — the deploy only ever pulls
+  const add = apiCalls.find((c) => c[0] === 'add');
+  assert.ok(add, 'registered the key via the GitHub API');
+  assert.equal(add[1], 'cloudbongos-deploy-demo', 'titled per-instance so teardown can revoke by title');
+  assert.equal(add[3], true, 'read_only: a leaked box key must never be able to write the owner\'s repo');
+  // origin re-pointed at PLAIN github.com (the shared alias would resolve the wrong key)…
+  assert.match(joined, /git -C \S+\/demo remote set-url origin git@github\.com:lars589\/demo\.git/);
+  // …and core.sshCommand pinned to the key IN THE REPO CONFIG: survives `git reset --hard`,
+  // applies to every future git op here, and -F \/dev\/null keeps ~/.ssh/config identities out.
+  assert.match(joined, /git -C \S+\/demo config core\.sshCommand "ssh -F \/dev\/null -i \S+\/\.git\/cloudbongos-deploy-key -o IdentitiesOnly=yes/);
+});
+
+await ta('ensurePrivateRepoAccess(public): ZERO mutation — the shared-alias path is byte-identical to today', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ priv: false, existing: false });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.private, false);
+  assert.equal(cmds.length, 0, 'no exec at all for a public repo');
+  assert.deepEqual(apiCalls.map((c) => c[0]), ['get'], 'one visibility read, nothing else');
+});
+
+await ta('ensurePrivateRepoAccess(flipped public): UN-wires — origin back to the shared alias, sshCommand unset, key halves removed + revoked', async () => {
+  // A repo made public after being wired stays pinned (IdentitiesOnly + -F /dev/null
+  // admit no other identity) to a key the owner may now delete — a stuck state the
+  // old public path could never reach.
+  const { deps, cmds, apiCalls } = repoAuthDeps({
+    priv: false, existing: true,
+    keys: [{ id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAAlocal', read_only: true }],
+  });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.unwired, true);
+  assert.deepEqual(apiCalls.find((c) => c[0] === 'del'), ['del', 11], 'revokes the now-orphaned key');
+  const joined = cmds.join('\n');
+  assert.match(joined, /remote set-url origin git@github-deploy:lars589\/demo\.git/, 'origin returns to the shared alias');
+  assert.match(joined, /config --unset core\.sshCommand/);
+  assert.match(joined, /rm -f \S+\/\.git\/cloudbongos-deploy-key \S+\/\.git\/cloudbongos-deploy-key\.pub/);
+});
+
+await ta('ensurePrivateRepoAccess(private, non-admin token): refuses UP FRONT with the fix, not a raw 403 mid-standup', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ existing: false });
+  deps.githubRepos.getUserRepo = async () => ({ full_name: 'lars589/demo', private: true, admin: false });
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /repository access is not admin: .*ADMIN/);
+  assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no key minted for a credential that cannot register it');
+  assert.ok(!apiCalls.some((c) => c[0] === 'add'));
+});
+
+await ta('ensurePrivateRepoAccess: 422 key_in_use (repo changed under a slug-keyed pair) self-heals — fresh keypair, one retry', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ existing: true });
+  let addCalls = 0;
+  deps.githubRepos.addDeployKey = async (_t, a) => {
+    apiCalls.push(['add', a.title, a.key, a.readOnly]);
+    addCalls++;
+    if (addCalls === 1) { const e = new Error('key already in use'); e.code = 'key_in_use'; throw e; }
+    return { id: 99 };
+  };
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.minted, true);
+  assert.equal(addCalls, 2, 'exactly one retry');
+  assert.ok(cmds.some((c) => /ssh-keygen/.test(c)), 'the retry rides a FRESH keypair — the old one can never succeed');
+});
+
+await ta('ensurePrivateRepoAccess: a transient GitHub failure surfaces as a plain sentence, never raw jargon on the owner card', async () => {
+  const { deps } = repoAuthDeps({ existing: true });
+  deps.githubRepos.listDeployKeys = async () => { const e = new Error('GitHub deploy-key list failed (502)'); e.code = 'github_error'; throw e; };
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /deploy-key setup failed for lars589\/demo: .*try again/);
+});
+
+await ta('ensurePrivateRepoAccess(no token): skips without touching git or GitHub (task 1002909 owns the request-time refusal)', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ token: null });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.skipped, 'no_token');
+  assert.equal(cmds.length, 0);
+  assert.equal(apiCalls.length, 0);
+});
+
+await ta('ensurePrivateRepoAccess: an already-registered CURRENT key re-asserts the git wiring but mints nothing', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({
+    keys: [{ id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAAlocal', read_only: true }],
+  });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.minted, false);
+  assert.ok(!apiCalls.some((c) => c[0] === 'add'), 'no re-registration');
+  assert.ok(!apiCalls.some((c) => c[0] === 'del'), 'no deletion');
+  assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no new keypair');
+  // the wiring is still re-asserted (a re-provision heals a hand-edited remote)
+  assert.ok(cmds.some((c) => /remote set-url origin git@github\.com:lars589\/demo\.git/.test(c)));
+  assert.ok(cmds.some((c) => /config core\.sshCommand/.test(c)));
+});
+
+await ta('ensurePrivateRepoAccess: a STALE same-title key (local key lost/rotated) is replaced, not duplicated', async () => {
+  const { deps, apiCalls } = repoAuthDeps({
+    keys: [{ id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAAother', read_only: true }],
+  });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.minted, true);
+  const order = apiCalls.map((c) => c[0]);
+  assert.ok(order.indexOf('del') >= 0 && order.indexOf('del') < order.indexOf('add'), 'deletes the stale key BEFORE adding (GitHub 422s a duplicate)');
+  assert.equal(apiCalls.find((c) => c[0] === 'del')[1], 11);
+});
+
+await ta('ensurePrivateRepoAccess: repo_not_found with a token → a PLAIN error naming the repo (feeds the owner card, not raw git stderr)', async () => {
+  const { deps } = repoAuthDeps();
+  deps.githubRepos.getUserRepo = async () => { const e = new Error('GitHub answered 404 for that repository'); e.code = 'repo_not_found'; throw e; };
+  await assert.rejects(
+    () => P.ensurePrivateRepoAccess(privInst, deps),
+    /repository not found: .*lars589\/demo.*credential/i,
+  );
+});
+
+await ta('ensurePrivateRepoAccess(dry-run): fully OFFLINE — no token read, no GitHub call, plan line only', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ apply: false, existing: false });
+  let tokenReads = 0;
+  deps.getGithubToken = async () => { tokenReads++; return { token: 'gho_TOK' }; };
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.planned, true);
+  assert.equal(cmds.length, 0, 'no mutation in dry-run');
+  assert.deepEqual(apiCalls, [], 'a plan run must stay a safe inspection tool — zero cloud calls');
+  assert.equal(tokenReads, 0, 'not even the credential read');
+});
+
+await ta('provisionInstance(standalone): the private-repo wiring lands BETWEEN the scaffold and the step-2 pull', async () => {
+  const { deps, cmds } = repoAuthDeps({ existing: false });
+  const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
+  assert.equal(r.ok, true);
+  const idx = (re) => cmds.findIndex((c) => re.test(c));
+  assert.ok(idx(/remote set-url origin git@github\.com:lars589\/mercury\.git/) >= 0, 'wired the private origin');
+  assert.ok(idx(/remote set-url origin git@github\.com:/) < idx(/git pull --ff-only origin main/),
+    'the pull that failed on prod (mercury, 2026-08-17) now runs AFTER the key wiring');
+});
+
+await ta('teardownInstance(standalone): best-effort revokes the instance\'s deploy key by title', async () => {
+  const { deps, apiCalls } = repoAuthDeps({
+    keys: [{ id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAAlocal', read_only: true }],
+  });
+  deps.apply = true;
+  await P.teardownInstance({ ...privInst, status: 'active' }, deps);
+  assert.deepEqual(apiCalls.find((c) => c[0] === 'del'), ['del', 11], 'the torn-down project keeps no live credential on the owner\'s repo');
+});
+
+await ta('teardownInstance(standalone): no registered key / no token → teardown proceeds untouched', async () => {
+  const a = repoAuthDeps({ keys: [] });
+  a.deps.apply = true;
+  await P.teardownInstance({ ...privInst, status: 'active' }, a.deps);
+  assert.ok(!a.apiCalls.some((c) => c[0] === 'del'), 'nothing to revoke');
+  const b = repoAuthDeps({ token: null });
+  b.deps.apply = true;
+  const r = await P.teardownInstance({ ...privInst, status: 'active' }, b.deps);
+  assert.equal(r.ok, true, 'a missing credential never blocks a teardown');
+  // The checkout is deliberately left behind, so the key halves must NOT ride along —
+  // revoked or not, the local private key never outlives the teardown.
+  assert.ok(b.cmds.some((c) => /rm -f \S+\/\.git\/cloudbongos-deploy-key \S+\.pub/.test(c)), 'local key halves removed even with no credential');
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/public_landing_projects.mjs

@@ -124,8 +124,8 @@ test('the manage view is served: identity block + honest not-yet sections (task
 test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /id="mRepoVis"/, 'the live section body is served');
-  assert.match(body, /can’t deploy private repositories/,
-    'the private-repo limitation is stated in plain words');
+  assert.match(body, /would break the next deploy/,
+    'the flip-to-private limitation is stated in plain words');
   assert.doesNotMatch(body, /visibility:\s*'private'/,
     'no served code path may send the private direction');
   assert.match(body, /repos=1/, 'the reconnect door asks for repository access');