@bongos/core 1.19.733 → 1.19.735

package/tests/agents_write_routes.mjs

@@ -42,7 +42,7 @@ const ARMED = Object.freeze({
   created_at: 'T0', updated_at: 'T0',
 });
 
-function fakePool({ definition = ARMED, runId = 42 } = {}) {
+function fakePool({ definition = ARMED, runId = 42, spentUsd = '0' } = {}) {
   const calls = [];
   return {
     calls,
@@ -60,6 +60,12 @@ function fakePool({ definition = ARMED, runId = 42 } = {}) {
       if (/^\s*INSERT INTO agents_definitions/.test(sql)) return { rows: [{ ...ARMED, name: params[0], enabled: false }] };
       if (/^\s*UPDATE agents_definitions/.test(sql)) return { rows: [{ ...definition, enabled: /enabled = true/.test(sql) }], rowCount: 1 };
       if (/^\s*DELETE FROM agents_definitions/.test(sql)) return { rows: [], rowCount: 1 };
+      // THE SPEND CEILING'S READ (task 1003884), and it must be tested BEFORE the
+      // generic agents_runs branch below — the same anchoring lesson that branch's
+      // own comment records about SELECT vs DELETE. Matched last, the ceiling's
+      // SUM would be answered with a ledger ROW, which has no `spent` column, and
+      // the ceiling would correctly refuse every fire in this file as unreadable.
+      if (/SUM\(cost_usd\)/.test(sql)) return { rows: [{ spent: spentUsd }] };
       if (/FROM agents_runs/.test(sql)) {
         // The ownership filter is params[1]; the fake honours it so the IDOR test
         // exercises the real WHERE clause rather than a stub that ignores it.
@@ -184,6 +190,50 @@ await t('the persona and the caller\'s input BOTH reach the model', async () =>
   assert.match(lastPrompt, /why is it so\?/);
 });
 
+await t('the fire records WHO PAYS beside who asked (task 1003884)', async () => {
+  const pool = fakePool();
+  api.pool = pool;
+  const res = fakeRes();
+  await handler(routes(), 'post', '/agents/:name/invoke')(req({ params: { name: 'historian' } }), res);
+  const row = pool.insertedRun();
+  assert.equal(row.requested_by_builder_id, 5, 'who asked');
+  // The neutral pack ships spend_payer 'none', which attributes to the PROJECT —
+  // that is who the money actually comes from, and it is what keeps a closed-door
+  // instance working exactly as it did (ADR 0282).
+  assert.equal(row.payer_kind, 'project', 'who is on the hook');
+  assert.equal(row.payer_builder_id, null);
+});
+
+await t('A PAYER AT THE CAP IS REFUSED 402, and nothing is spawned or ledgered', async () => {
+  // The ceiling is wired ahead of the definition read, so an exhausted payer costs
+  // not even a SELECT. 402 rather than fire-budget's 429 on purpose: "the money is
+  // gone" and "too fast, try later" are different operator problems.
+  const pool = fakePool({ spentUsd: '9999' });
+  api.pool = pool;
+  lastPrompt = null;
+  const res = fakeRes();
+  await handler(routes(), 'post', '/agents/:name/invoke')(req({ params: { name: 'historian' } }), res);
+
+  assert.equal(res.out.status, 402);
+  assert.equal(res.out.failed.code, 'spend_cap_reached');
+  assert.equal(res.out.failed.details.reason, 'spend_cap_reached');
+  assert.equal(res.out.failed.details.payer_kind, 'project');
+  assert.equal(pool.insertedRun(), null, 'a refused fire writes no run');
+  assert.equal(lastPrompt, null, 'and calls no model');
+});
+
+await t('AN UNREADABLE LEDGER REFUSES THE FIRE — the ceiling fails closed at the route too', async () => {
+  // The lib-level case is in tests/agents_spend_guard.mjs; this one proves the
+  // route honours it rather than falling through, which is the half that task
+  // 1001393's failed-open brake actually got wrong.
+  api.pool = { async query() { throw new Error('ECONNREFUSED'); } };
+  const res = fakeRes();
+  await handler(routes(), 'post', '/agents/:name/invoke')(req({ params: { name: 'historian' } }), res);
+  assert.equal(res.out.status, 402);
+  assert.equal(res.out.failed.details.reason, 'ledger_unreadable');
+  assert.equal(res.out.failed.details.spent_usd, null, 'it claims no sum it does not have');
+});
+
 await t('a body key the schema does not name is refused rather than ignored', async () => {
   api.pool = fakePool();
   const res = fakeRes();

package/tests/bump_version.mjs

@@ -171,7 +171,84 @@ test('publish.yml wires the terminator: guard step present, every armed step gat
   assert.ok(PUBLISH_YML.includes('id: relhead'), 'the Already released? guard step exists');
   assert.match(PUBLISH_YML, /isReleaseCommit/, 'the guard delegates to bump-version.js — single source');
   const gates = (PUBLISH_YML.match(/steps\.relhead\.outputs\.release_head == 'false'/g) || []).length;
-  assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, tag) — found ${gates}`);
+  assert.ok(gates >= 7, `every post-guard armed step must carry the gate (setup-node, install, resolve, bump, pack, publish, record, tag) — found ${gates}`);
+});
+
+// ---- the release ORDER: publish before push (task 1003914) ----
+//
+// The bug this pins: publish.yml used to push the bump commit to main BEFORE
+// packaging and publishing. A failure in either left main permanently declaring
+// a version that never reached npm, and the cascade terminator above then made
+// it unretryable — HEAD was this lane's own release commit, so every following
+// run no-opped and only a fresh work merge moved past the hole. 1.19.716-723
+// were minted and lost that way on 2026-09-13.
+//
+// These are source-order assertions because a workflow's step order IS its
+// source; there is nothing to execute here. They key on the actual COMMANDS,
+// never on prose, so a comment rewrite can't make them pass falsely.
+
+const BRANCH_PUSH = ['git', 'push', 'origin', 'HEAD:main'].join(' ');
+
+test('the bump commit is pushed only AFTER npm publish — the irreversible step goes last', () => {
+  const publishAt = PUBLISH_YML.indexOf('npm publish "$TGZ"');
+  const pushAt = PUBLISH_YML.indexOf(BRANCH_PUSH);
+  assert.ok(publishAt !== -1, 'publish.yml must publish the packaged tarball');
+  assert.ok(pushAt !== -1, 'publish.yml must push the bump commit to main somewhere');
+  assert.ok(
+    publishAt < pushAt,
+    'the push to main must come AFTER npm publish. Pushing first makes a failed publish burn the version number permanently and unretryably (task 1003914).',
+  );
+});
+
+test('the push to main happens exactly once, and not inside the bump step', () => {
+  const pushes = PUBLISH_YML.split(BRANCH_PUSH).length - 1;
+  assert.equal(pushes, 1, `exactly one push of the bump to main — found ${pushes}`);
+  // The bump step runs from `id: bump` up to the next step's `- name:`.
+  const bumpAt = PUBLISH_YML.indexOf('id: bump');
+  assert.ok(bumpAt !== -1, 'the bump step must carry id: bump');
+  const nextStepAt = PUBLISH_YML.indexOf('\n      - name:', bumpAt);
+  const bumpStep = PUBLISH_YML.slice(bumpAt, nextStepAt === -1 ? undefined : nextStepAt);
+  assert.ok(
+    !bumpStep.includes(BRANCH_PUSH),
+    'the bump step must COMMIT only — its push moved to the record step so a pack/publish failure discards a purely local commit',
+  );
+  assert.ok(bumpStep.includes('git commit -m'), 'the bump step still commits locally — package-core stamps the version found AT the ref');
+});
+
+test('an already-published version is success, not a wedge', () => {
+  // Publish-then-failed-push leaves a version on npm with no release commit.
+  // The next run reads it as free (laneReleasedVersions is git-based), bumps to
+  // it, and npm refuses the duplicate. Without this branch that run fails, and
+  // so does every run after it — the lane wedges with no way out but a human.
+  const pubAt = PUBLISH_YML.indexOf('id: pub');
+  assert.ok(pubAt !== -1, 'the publish step must carry id: pub');
+  const pubStep = PUBLISH_YML.slice(pubAt, PUBLISH_YML.indexOf('\n      # PUBLISH VERDICT'));
+  assert.match(
+    pubStep,
+    /cannot publish over\|previously published\|EPUBLISHCONFLICT/,
+    'the publish step must recognise npm refusing a duplicate version',
+  );
+  assert.match(pubStep, /already=true/, 'and must record that it took the already-present branch');
+  assert.match(
+    pubStep,
+    /exit "\$RC"/,
+    'every OTHER publish failure must still fail the step — the tolerance is narrow on purpose',
+  );
+});
+
+test('the record step gates on a bump actually having been made', () => {
+  const recAt = PUBLISH_YML.indexOf('- name: Record the release on main');
+  assert.ok(recAt !== -1, 'the record step exists');
+  const recStep = PUBLISH_YML.slice(recAt, PUBLISH_YML.indexOf('\n      # PUBLISH VERDICT'));
+  assert.match(
+    recStep,
+    /steps\.bump\.outputs\.to != ''/,
+    'nothing to push when no bump was made (taken == false) — the step must skip rather than push an empty HEAD',
+  );
+  assert.ok(
+    !recStep.includes('git rebase'),
+    'no rebase-retry: the tarball was built from the pre-rebase tree, so rebasing would leave source_commit naming a SHA that is not on main',
+  );
 });
 
 // ---------------------------------------------------------------------------

package/tests/currency_label.mjs

@@ -54,11 +54,16 @@ test('clientBranding exposes project policy — the settings read-back (task 100
   // `artistGate` joined in task 1003575 (ADR 0241) and is the ONE key here whose
   // fallback is not today's behaviour: 'strict' is the owner's ruling, safe as a
   // default because it can only ever delay a pin move, never a builder's ship.
+  // `spendPayer` joined in task 1003884 (ADR 0282) — who pays when a module spends
+  // money for whoever called it. Its fallback IS today's behaviour ('none'), and it
+  // is published for a reason of its own: it is the one key that can REFUSE a
+  // module, so an owner looking at a module that will not turn on needs the
+  // instance's own answer rather than the platform's record of what they saved.
   assert.deepEqual(clientBranding({}).project,
-    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict' });
+    { platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' });
   assert.deepEqual(
-    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off' } }).project,
-    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off' },
+    clientBranding({ project: { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' } }).project,
+    { platformVisibility: 'gated', joinability: 'invite_only', visibility: 'stealth', joinGrant: 'view', artistGate: 'off', spendPayer: 'builder' },
     'what the instance actually resolved (env override included) is what it publishes');
 });
 
@@ -81,7 +86,7 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
   // public for the same read-back reason as its neighbours. Its companion stamp
   // (artistGateSince) deliberately does NOT: that is platform bookkeeping the server
   // reads, and no browser surface has a question it answers.
-  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'platformVisibility', 'visibility']);
+  assert.deepEqual(Object.keys(projected.project).sort(), ['artistGate', 'joinGrant', 'joinability', 'platformVisibility', 'spendPayer', 'visibility']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }

package/tests/leak_scan_fail_closed.mjs

@@ -0,0 +1,108 @@
+// tests/leak_scan_fail_closed.mjs
+//
+// Task 1003870 — the post-build leak scan must FAIL CLOSED. The detector (task 1002220) and
+// the neutral floor (task 1002217) both landed, but strictness was opt-in and the publish lane
+// never opted in, so a leaky artifact could have gone to npm while the workflow's own header
+// comment claimed a fail-closed gate. This locks both halves:
+//   1. the POLICY — planting a prior-instance literal makes the build refuse, with no flag,
+//   2. the WIRING — the publish lane still arms the gate and never disarms it.
+// (2) is the half that was actually broken, and a policy test alone would not have caught it.
+//
+// Run:  node tests/leak_scan_fail_closed.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { scanArtifactForLeaks, leakScanVerdict, PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// This file is itself published, so it DERIVES the literal it plants instead of spelling it
+// out — the self-leak invariant the allowlist and mirror-redact both hold about themselves.
+// It also means a future rename of the prior instance cannot quietly gut this test: the plant
+// follows the floor, rather than pinning a string that would stop matching.
+const TOKEN = PRIOR_INSTANCE_FLOOR.tokens[0];
+const OWNER = PRIOR_INSTANCE_FLOOR.owners[0];
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('\nthe planted literal makes the build refuse (no flag required):');
+
+t('a planted prior-instance token in a functional file is FATAL by default', () => {
+  const files = [{ path: 'src/some-module.js', content: `const host = "${TOKEN}";\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted token');
+  const v = leakScanVerdict(scan.literalHits, ['node', 'package-core.js']);
+  assert.equal(v.run, true, 'the scan runs when no escape flag is passed');
+  assert.equal(v.fatal, true, 'THE LOAD-BEARING ASSERTION: a leak aborts the build with no flag');
+  assert.equal(v.reason, 'prior-instance-literals');
+});
+
+t('a planted prior-instance OWNER is fatal too, not just the token', () => {
+  const files = [{ path: 'scripts/thing.js', content: `// maintained by ${OWNER}\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted owner');
+  assert.equal(leakScanVerdict(scan.literalHits, ['node', 'x']).fatal, true);
+});
+
+t('a clean artifact is NOT fatal (the gate does not fire on everything)', () => {
+  const files = [{ path: 'src/clean.js', content: 'const x = 1;\n' }];
+  const scan = scanArtifactForLeaks(files);
+  assert.equal(scan.literalHits.length, 0);
+  const v = leakScanVerdict(scan.literalHits, ['node', 'x']);
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'clean');
+});
+
+t('--leak-scan-strict is a no-op: it cannot be the thing that makes it fatal', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const withFlag = leakScanVerdict(hits, ['node', 'x', '--leak-scan-strict']);
+  const without = leakScanVerdict(hits, ['node', 'x']);
+  assert.deepEqual(withFlag, without, 'strict must add nothing — fatal is the default now');
+});
+
+t('--no-leak-scan is the only escape, and it skips rather than downgrades', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const v = leakScanVerdict(hits, ['node', 'x', '--no-leak-scan']);
+  assert.equal(v.run, false, 'the scan does not run at all');
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'skipped');
+});
+
+console.log('\nthe publish lane arms the gate (the half that was actually broken):');
+
+const publishYml = readFileSync(join(ROOT, '.github/workflows/publish.yml'), 'utf8');
+const packLine = publishYml.split('\n').find((l) => l.includes('package-core.js') && l.includes('--ref HEAD'));
+
+t('publish.yml still invokes package-core to build the release artifact', () => {
+  assert.ok(packLine, 'no package-core invocation found — the lane was rewired, re-check this test');
+});
+
+t('the publish invocation arms the leak gate explicitly', () => {
+  assert.ok(packLine.includes('--leak-scan-strict'),
+    'the publish lane must state the gate it depends on, even though fatal is the default');
+});
+
+t('nothing the publish lane RUNS disarms the leak scan', () => {
+  // Executable lines only: a YAML/shell comment may legitimately name the escape flag while
+  // explaining why the lane never uses it, and matching prose would fail on its own docs.
+  const executable = publishYml
+    .split('\n')
+    .filter((l) => !/^\s*#/.test(l))
+    .join('\n');
+  assert.ok(!executable.includes('--no-leak-scan'),
+    'the one lane that makes an artifact permanent and public must never skip the scan');
+});
+
+console.log(`\n${passed} passed, ${failed} failed\n`);
+if (failed) process.exit(1);

package/tests/provision_settings_apply.mjs

@@ -62,6 +62,7 @@ ${NEUTRAL_PREFIX}_JOINABILITY=apply
 ${NEUTRAL_PREFIX}_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOIN_GRANT=full
 ${NEUTRAL_PREFIX}_ARTIST_GATE=strict
+${NEUTRAL_PREFIX}_SPEND_PAYER=none
 ${NEUTRAL_PREFIX}_ARTIST_GATE_SINCE=
 `;
 
@@ -120,7 +121,12 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public', [`${NEUTRAL_PREFIX}_JOIN_GRANT`]: 'full',
     // the artist gate + its non-retroactivity stamp (task 1003575, ADR 0241) ride
     // the same transport; the stamp is empty until the gate is actually RAISED
-    [`${NEUTRAL_PREFIX}_ARTIST_GATE`]: 'strict', [`${NEUTRAL_PREFIX}_ARTIST_GATE_SINCE`]: '',
+    [`${NEUTRAL_PREFIX}_ARTIST_GATE`]: 'strict',
+    // who pays for metered module spend (task 1003884, ADR 0282) rides it too —
+    // it has to, because src/modules.js reads it at CONFIG LOAD, so the instance
+    // must already hold it in web.env before its first require
+    [`${NEUTRAL_PREFIX}_SPEND_PAYER`]: 'none',
+    [`${NEUTRAL_PREFIX}_ARTIST_GATE_SINCE`]: '',
   });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
@@ -132,10 +138,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -153,7 +159,7 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict', spendPayer: 'none' })
     : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
@@ -222,7 +228,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_ARTIST_GATE_SINCE in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_ARTIST_GATE_SINCE in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });

package/tests/provisioning_settings.mjs

@@ -164,7 +164,7 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
@@ -179,6 +179,10 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
     // offered to the form like the rest; what makes it different is only its
     // default, which is the owner's ruling rather than today's behaviour.
     artist_gate: ['off', 'advisory', 'strict'],
+    // who pays for metered module spend (task 1003884, ADR 0282) — the sixth
+    // policy axis, offered to the form like the rest. What makes it different is
+    // its CONSEQUENCE: it is the only setting that can refuse a module outright.
+    spend_payer: ['none', 'project', 'builder'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -191,14 +195,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -226,7 +230,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -239,7 +243,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -278,7 +282,7 @@ await ta('the owner sets the door to stealth — stored, echoed effective, audit
   reset();
   const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
   assert.equal(events[0].actor, 'api:self');
   assert.match(events[0].detail, /visibility=stealth/);
@@ -338,7 +342,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -225,7 +225,7 @@ await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -274,7 +274,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -287,7 +287,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');
@@ -404,7 +404,7 @@ await ta('save A queues → save B 409s while A RUNS → A settles → the UNCHA
   assert.equal(enqueueCalls.length, enqueuedBefore + 1, 'exactly one new intent');
   assert.equal(updateCalls.length, writesBefore, 'nothing re-written — the value was already stored in step 2');
   assert.deepEqual(owedCalls[owedCalls.length - 1], { id: 18, owed: false }, 'and the debt is settled');
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
     'the value that finally ships is the one the owner saved');
 });
 

package/tests/provisioning_settings_env.mjs

@@ -117,13 +117,17 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
   assert.deepEqual(vars, {
     CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth',
     CLOUDBONGOS_JOIN_GRANT: 'view', CLOUDBONGOS_ARTIST_GATE: 'advisory', CLOUDBONGOS_ARTIST_GATE_SINCE: '',
+    // Who pays for metered module spend (task 1003884) — it rides the same
+    // transport because src/modules.js reads it at CONFIG LOAD, which means the
+    // instance must already have it in web.env before the first require.
+    CLOUDBONGOS_SPEND_PAYER: 'none',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
   assert.deepEqual(varsOf(provisioning.settingsEnvLines(row, 'CLOUDBONGOS')), vars, 'the standup lines ARE the vars');
   assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), {
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
-    X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '',
+    X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
   }, 'defaults, explicitly');
 });