@bongos/core 1.19.885 → 1.19.887

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.885",
-  "core_contract": "1.19.885",
-  "source_commit": "3fc3d4952a5f3df767b788d749535c4b5d9574d2",
+  "core_version": "1.19.887",
+  "core_contract": "1.19.887",
+  "source_commit": "b874dffd8907b22a633526eddcb279c009c89b40",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T19:35:51.138Z",
+  "built_at": "2026-09-19T20:48:51.300Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 497,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2787,
-  "tree_sha256": "1f06d46b4f715ae25938179a4a59b60eb2064c18c3b651c5248ddf87a414e634",
+  "tree_sha256": "920b5751e940860113c8a2a84ede022e547e1901077f62330213144c8612091b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2052,7 +2052,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "19cb42bb52d123f89bf24d9e4b8667955f0fc682b2481790f0c48d8d1ed09e79"
+      "sha256": "37732622e53cde0e4ee6bb0133ef6bade2a862f7d6337c40723b94fbf6ae6c22"
     },
     {
       "path": "docs/architecture.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "817802ecd05e04ab03536c918130316c3597dd85c5dce0f06b8e3abb05fde449"
+      "sha256": "31fdd25f81e095205720c92ce31100187f7d1c1c89eecc8b9c84f00936350352"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6312,7 +6312,7 @@
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "a72f2961ba04739648b8622d86a85a75aef613d5d7c50fbb2f43ae8cf2c4adae"
+      "sha256": "7c08e627e228bec400e9e2dc204418a6995a4668eb6c1817ae59f20f77cbe71e"
     },
     {
       "path": "modules/provisioning/pollers/catalog-backfill.js",
@@ -6367,7 +6367,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "e9eb66469fc14adc526f97815ef61f4145cf17bbf36bdb638a2ed4db897149b7"
+      "sha256": "63919aad35ff1f47c4981e5e5c1f1c08d79eb0de9588e0c3ba2c5ed488167211"
     },
     {
       "path": "modules/provisioning/seams.js",
@@ -7692,12 +7692,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b6272da5f8ef22a0c6470d574d3c692e42cda17ad914468b01787618a4145b47"
+      "sha256": "356149fe3c3c69d00f16886662e5fee0ab51c4be066af64156a2b3bb7e14c69c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f1739df1c386bb39ccd39cfb98af671095b64011354060e46289042bd29a4dd1"
+      "sha256": "9e2d057866feafc0e9606c36335013a47ad55190c03e7beed63d1e592f2fd23a"
     },
     {
       "path": "public-docs/index.html",
@@ -8372,7 +8372,7 @@
     {
       "path": "scripts/gds/gen-session-index.js",
       "mode": "0000644",
-      "sha256": "9b936143ae25442fefb52b98949bc33d245d4b3894d778c51926e9da75c92357"
+      "sha256": "8b379f5392999fdf9977e1f4d9a43d4f2d77c093075d9933773a66eb15228252"
     },
     {
       "path": "scripts/gds/gen-sounds.js",
@@ -9702,7 +9702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4d103e39fb2682b9472313a7714a0bff8f3d211e407240c0211fd74841485242"
+      "sha256": "309fd0ddeb0185da023052aaab8967162dbdb833ade7226f49e1636440146e83"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12727,17 +12727,17 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "dffa4b500d3afe770764e562236ee97b6d581ed3db301ee3f984c5caa6f6f35e"
+      "sha256": "540e9b5b158a5623525924403bcef444f87fe0364591cd9c6b9e0a55f4f6295c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "f8a714c4b4a77e6eaa00f832b47beef19b5de916d544af2b839455c301be2bc8"
+      "sha256": "f7a01aa6ed190c1ad544d91312909b081446a7fc2b6ef339f3ba8fa4d59f0306"
     },
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "1cf30338eb8dafc77f2fea1e2b5ec417fe64a6576ececcca18936fe4e871c763"
+      "sha256": "19961880545fe8f6c9eaf79095aa0d08f7862409109d581cac828f0f20b1be69"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",

package/docs/api/openapi.json

@@ -12672,7 +12672,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances",
-        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource) for the free `co-tenant` shape. Every other shape also needs provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs the caller's own repo on the platform's box — and `control-plane` is refused outright, since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4). A full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "requestBody": {

package/docs/module-api-changelog.md

@@ -2244,5 +2244,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.883 with no explicit bump. run 35464075741. (task 1002620)
   1.19.885 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.884 with no explicit bump. run 35464802278. (task 1002620)
+  1.19.886 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.885 with no explicit bump. run 35467975408. (task 1002620)
+  1.19.887 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.886 with no explicit bump. run 35468511941. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/paid-shape-gate.js

@@ -1,21 +1,54 @@
-// modules/provisioning/paid-shape-gate.js — who may ask for METERED infrastructure
-// (task 1003682).
+// modules/provisioning/paid-shape-gate.js — who may ask for which hosting SHAPE
+// (task 1003682, widened by task 1003370 / audit B4).
+//
+// THE FILENAME IS NARROWER THAN THE FILE, DELIBERATELY. This started as the gate over
+// METERED shapes alone. Task 1003370 widened it to every shape that is not the free
+// front door, and the name was kept because ADR 0285 links to it by path and four
+// sibling files cite it by name as the precedent for living in their own file. A rename
+// would have broken those links to buy a better noun; this paragraph buys the same
+// clarity for free.
 //
 // The create route is open to any authenticated builder, and it must stay that way:
-// standing up a project is the platform's front door, not a privilege. But one of the
-// hosting shapes it accepts is not free. `dedicated` is the only shape whose runner leg
-// allocates a real droplet (`scripts/gds/provision.js` — billed monthly, defaulting to
-// s-2vcpu-4gb when no tier is named); every other shape co-tenants on infrastructure the
-// platform already pays for, which is why `costEstimateUsd` returns 0 for all of them.
+// standing up a project is the platform's front door, not a privilege. But only ONE of
+// the shapes it accepts is actually that front door. The others each hand the caller
+// something the platform pays for or trusts:
+//
+//   co-tenant     — the front door. Co-tenants on infrastructure the platform already
+//                   runs; `costEstimateUsd` is 0. No authority required, ever.
+//   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
+//                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
+//   standalone    — runs the caller's OWN repo on the platform's box. The unit's
+//                   WorkingDirectory is that checkout (`scripts/gds/provision-units.js`)
+//                   and the module loader discovers modules from `resolveInstanceRoot()`,
+//                   which is process.cwd() (`src/module-loader/loader.js`). So the
+//                   caller names a repo and the platform require()s its `modules/` —
+//                   arbitrary code execution on the control plane's own machine. Task
+//                   1003369 gave each instance its own uid, which bounds the blast
+//                   radius to that account; it does not make "any Xenos may run code
+//                   here" an acceptable default.
+//   control-plane — the platform's OWN row (ADR 0293 D2, task 1003159), enrolled by
+//                   `scripts/gds/enroll-control-plane.js` so the owner's deploy door has
+//                   something to point at. Never a thing a builder asks for. See below.
 //
 // So the authority question belongs to the SHAPE, not the route. Gating the whole route
 // would make ordinary project creation require a rank — the wrong trade entirely, and the
 // reason this is a middleware over one field rather than a floor on the endpoint.
 //
+// AN ALLOW-LIST, NOT A DENY-LIST — the control-plane-guard.js rule, for the same reason.
+// The set named below is the set that needs NO authority. Every other shape, including
+// one added after this file was last read, requires the permission by omission. The
+// previous shape of this gate listed the one shape that was gated and admitted the rest,
+// and that is exactly how `standalone` and `control-plane` stayed open: `standalone`
+// because it was reasoned about as "$0, therefore harmless" (true of the invoice, false
+// of the trust), and `control-plane` because it did not exist yet when the gate was
+// written. Permitted-by-omission is the failure mode this inversion removes.
+//
 // The atom is `provisioning.fleet.manage` (floor: metic), deliberately the same one that
 // already guards the fleet cost-ledger and force-teardown. Spending on the fleet and
-// managing the fleet are one authority, and before this the route that SPENDS money was
-// less gated than the route that stops it.
+// managing the fleet are one authority, and before task 1003682 the route that SPENDS
+// money was less gated than the route that stops it. Task 1003370 adds no new atom: the
+// question "may this caller commit the platform's own resources" is the same question
+// whether the resource is a droplet or the control plane's CPU.
 //
 // Split into its own file rather than inlined beside the route for two reasons, both
 // mechanical: `routes/provisioning.js` sits at its 1500-line fitness ratchet (the same
@@ -25,33 +58,75 @@
 // write route" failure on an unrelated endpoint.
 'use strict';
 
-// The shapes that cost money. Kept as a set of one rather than a bare `=== 'dedicated'`
-// so a second metered shape is a one-line change here instead of a hunt through gates;
-// `tests/provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES so adding one without
-// revisiting this file fails loudly.
-const METERED_SHAPES = Object.freeze(new Set(['dedicated']));
+const provisioning = require('./provisioning.js');
+
+// The shapes any authenticated builder may request with no permission at all. This is
+// the whole allow-list, and it is deliberately one entry long: co-tenant is the front
+// door, and the front door is the only thing that should be free. `tests/
+// provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
+// cannot be added without someone deciding, in writing, which side of the line it is on.
+const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
 
-// isMeteredShape — does this hosting shape allocate infrastructure someone is billed for?
-// Matches the exact wire value: the route's own validator refuses anything not in
-// HOSTING_SHAPES, so a case or whitespace variant is rejected as a bad shape rather than
-// admitted here as a cheap one.
-function isMeteredShape(shape) {
-  return METERED_SHAPES.has(shape);
+// Shapes that are not requestable through this route AT ALL — no permission admits them,
+// because there is no rank at which "ask the API for a second control plane" is a
+// coherent request. The control-plane row is the platform describing ITSELF; a builder
+// -created duplicate is not a privilege escalation in the permission sense but something
+// worse: `core-upgrade.js` selects the self row with
+// `WHERE hosting_shape = 'control-plane' LIMIT 1`, so a second row makes "which machine
+// is the control plane" a question with a caller-influenced answer. Refused by name, at
+// the door, for the same reason control-plane-guard.js refuses by name.
+const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
+
+// shapeAuthority — what does this wire value demand? PURE. Returns one of:
+//   'open'          → admit with no permission
+//   'unrequestable' → refuse outright, whatever the caller holds
+//   'permission'    → require provisioning.fleet.manage
+//   'defer'         → not a shape this gate recognises; let the route's own validator
+//                     answer it (a 400 `bad_hosting_shape` naming the valid set is a far
+//                     more useful reply to a typo than a 403 about a permission the
+//                     caller would not have needed anyway).
+//
+// 'defer' is safe despite looking like a hole: the validator runs immediately after this
+// middleware and refuses anything outside HOSTING_SHAPES, and `createInstance` coerces an
+// unrecognised shape to 'co-tenant' rather than storing it. There is no path by which a
+// deferred value becomes a privileged row.
+//
+// Matches the exact wire value — a case or whitespace variant of a privileged shape is
+// not in HOSTING_SHAPES, so it defers here and is then refused as a bad shape, never
+// admitted as a cheap one.
+function shapeAuthority(rawShape) {
+  const shape = rawShape === undefined || rawShape === null || rawShape === ''
+    ? 'co-tenant' // an absent shape is the documented default, and it is the open one
+    : rawShape;
+  if (typeof shape !== 'string') return 'defer';
+  if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
+  if (UNREQUESTABLE_SHAPES.has(shape)) return 'unrequestable';
+  if (OPEN_SHAPES.has(shape)) return 'open';
+  return 'permission';
 }
 
-// requireAuthorityForMeteredShape — the create route's paid-shape gate. Mount it AFTER
-// requireBuilder and BEFORE the handler, so a refusal leaves no row behind for the runner
-// to drain later. `requirePermission` is injected (rather than required here) so the gate
-// is exercisable without standing up the auth stack.
-function requireAuthorityForMeteredShape(requirePermission) {
+// requireAuthorityForShape — the create route's shape gate. Mount it AFTER requireBuilder
+// and BEFORE the handler, so a refusal leaves no row behind for the runner to drain later.
+// `requirePermission` is injected (rather than required here) so the gate is exercisable
+// without standing up the auth stack.
+function requireAuthorityForShape(requirePermission) {
   const gate = requirePermission('provisioning.fleet.manage');
-  return function meteredShapeGate(req, res, next) {
-    if (!isMeteredShape(req.body && req.body.hosting_shape)) return next();
+  return function shapeGate(req, res, next) {
+    const verdict = shapeAuthority(req.body && req.body.hosting_shape);
+    if (verdict === 'open' || verdict === 'defer') return next();
+    if (verdict === 'unrequestable') {
+      return res.fail('shape_not_requestable', {
+        status: 403,
+        message: 'The control plane enrolls its own row; it cannot be requested through this route.',
+        details: { hosting_shape: req.body.hosting_shape, requestable: [...provisioning.HOSTING_SHAPES].filter((s) => !UNREQUESTABLE_SHAPES.has(s)) },
+      });
+    }
     return gate(req, res, next);
   };
 }
 
-// Only the gate is exported. METERED_SHAPES and isMeteredShape are deliberately private:
-// nothing outside this file needs to ask "is this shape metered" separately from being
-// gated on it, and an export nobody consumes is one more thing to keep true.
-module.exports = { requireAuthorityForMeteredShape };
+// Only the gate is exported. OPEN_SHAPES, UNREQUESTABLE_SHAPES and shapeAuthority are
+// deliberately private: nothing outside this file needs to ask "what does this shape
+// demand" separately from being gated on it, and an export nobody consumes is one more
+// thing to keep true.
+module.exports = { requireAuthorityForShape };

package/modules/provisioning/routes/provisioning.js

@@ -12,9 +12,10 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
-//                                                     (a `dedicated` shape ALSO needs
-//                                                      provisioning.fleet.manage — it is the
-//                                                      only shape that bills; ../paid-shape-gate.js.
+//                                                     (only `co-tenant` is free; every other
+//                                                      shape ALSO needs provisioning.fleet.manage,
+//                                                      and `control-plane` is not requestable at
+//                                                      all; ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
@@ -50,7 +51,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
-const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
+const { requireAuthorityForShape } = require('../paid-shape-gate');
 const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
@@ -280,11 +281,14 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage
-  // (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js).
+  // builder (own resource) for the free `co-tenant` shape. Every other shape also needs
+  // provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs
+  // the caller's own repo on the platform's box — and `control-plane` is refused outright,
+  // since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4).
+  // A full shared box answers 409 box_full up front (../capacity-gate.js).
   // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
-  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
+  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
   //
   // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
@@ -292,7 +296,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.885",
+  "version": "1.19.887",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.885",
+      "version": "1.19.887",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.885",
+  "version": "1.19.887",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-session-index.js

@@ -49,7 +49,14 @@ const CLAUDE_PATH = path.join(REPO_ROOT, 'CLAUDE.md');
 
 // How many of the most-recent sessions the always-loaded CLAUDE.md snippet carries. The rest live
 // in the generated full index. Bounded on purpose (ADR 0062 §8) — the context file must stay lean.
-const SNIPPET_COUNT = 10;
+//
+// 10 -> 3 (task 1003688). At 10 this block was 1,795 chars, 8.4% of a CLAUDE.md that loads IN FULL
+// in every session, of every craft, whether or not the reader cares what shipped last week. Its job
+// is to answer "what just happened here" — and the 3 newest answer that; entries 4-10 were history,
+// which is what docs/session-log-index.md and docs/session-logs/ are for. This is the one number to
+// change if that balance ever needs revisiting: the header text, the fitness gate and
+// tests/session_index.mjs all read it rather than restating it.
+const SNIPPET_COUNT = 3;
 
 // Only dated session-log files are entries — a date-prefixed slug is the naming contract (§12).
 // This excludes any stray README / the index itself / non-session markdown in the directory.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.885'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.887'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_module_selection.mjs

@@ -235,7 +235,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
   // Act — the body the wizard files
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: ['agents', 'discord'],
+    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: ['agents', 'discord'],
   });
 
   // Assert
@@ -245,7 +245,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
 await ta('POST /instances: an omitted modules key is still a valid create — skipping is supported, not an error', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game' });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs.modules, undefined, 'nothing is invented on the owner\'s behalf');
   // …and the receipt already carries the set they will actually get.
@@ -255,7 +255,7 @@ await ta('POST /instances: an omitted modules key is still a valid create — sk
 
 await ta('POST /instances: an explicit empty selection is accepted as an answer', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: [] });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: [] });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.deepEqual(lastCreateArgs.modules, []);
 });
@@ -266,7 +266,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
   // prevent, and the reason badProjectDetail was written beside this.
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['discrod'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discrod'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -277,7 +277,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
 await ta('POST /instances: naming an always-on module is refused with the reason, not the generic miss', async () => {
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['memory'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['memory'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -286,11 +286,11 @@ await ta('POST /instances: naming an always-on module is refused with the reason
 
 await ta('POST /instances: modules must be an array of strings', async () => {
   existingRow = null;
-  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: 'discord' });
+  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: 'discord' });
   assert.equal(notArray.status, 400, notArray.raw);
   assert.equal(notArray.body.error.code, 'validation_failed');
 
-  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: [7] });
+  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: [7] });
   assert.equal(notStrings.status, 400, notStrings.raw);
   assert.equal(notStrings.body.error.code, 'validation_failed');
 });
@@ -301,7 +301,7 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   // to hunt for one.
   existingRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents'], detail: {} };
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['discord'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discord'],
   });
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.modules_ignored, 'the dropped answer is reported, not swallowed');
@@ -589,7 +589,7 @@ await ta('POST /instances: a null answer at CREATION is accepted and stores noth
   lastCreateArgs = null; existingRow = null;
 
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', type: 'game', detail: { team_shape: null },
+    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', detail: { team_shape: null },
   });
 
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);

package/tests/provisioning_onboard_mode.mjs

@@ -150,7 +150,7 @@ function post(path, body) {
 await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
+    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
   });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');
@@ -158,7 +158,7 @@ await ta('POST /instances: onboard_mode=adopt is threaded through to createInsta
 
 await ta('POST /instances: onboard_mode absent → greenfield (unchanged behavior for every existing caller)', async () => {
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone' });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'greenfield');
 });
@@ -167,7 +167,7 @@ await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently co
   // Coercing here would be worse than refusing: the caller believes it asked for one thing
   // and the runner does another. The route names the valid set so the client can fix itself.
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'standalone', target_ref: 'a/b', onboard_mode: 'brownfield',
+    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'a/b', onboard_mode: 'brownfield',
   });
   assert.equal(res.status, 400);
   assert.equal(res.body.error.code, 'bad_onboard_mode');
@@ -204,8 +204,8 @@ await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no r
   // Without target_ref the runner would fall back to greenfield behavior on a row labelled
   // adopt. Refuse at the door rather than store a lie.
   for (const body of [
-    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt' },
-    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt', target_ref: '   ' },
+    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt' },
+    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt', target_ref: '   ' },
   ]) {
     const res = await post('/provisioning/instances', body);
     assert.equal(res.status, 400, `expected 400 for ${JSON.stringify(body)}`);

package/tests/provisioning_paid_shape_gate.mjs

@@ -10,11 +10,26 @@
 // SPENDS was less gated than force-teardown, which stops spending and sits behind
 // provisioning.fleet.manage.
 //
-// The fix gates the SHAPE, not the route: every $0 shape (standalone, co-tenant) stays open
-// to any authenticated builder, because ordinary project creation must not require a rank.
-// Only `dedicated` demands provisioning.fleet.manage — deliberately the same atom that
-// already guards the fleet cost-ledger and force-teardown, since spending on the fleet and
-// managing the fleet are one authority.
+// The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
+// so `co-tenant` — the front door — stays open to any authenticated builder. Everything else
+// demands provisioning.fleet.manage, deliberately the same atom that already guards the fleet
+// cost-ledger and force-teardown, since spending on the fleet and managing the fleet are one
+// authority.
+//
+// WIDENED BY TASK 1003370 (audit B4), which is why this file's name is narrower than its
+// subject. The original gate named the one shape it refused and admitted the rest, and two
+// shapes stayed open underneath that reasoning:
+//
+//   standalone    — judged harmless because it costs $0. True of the invoice; false of the
+//                   trust. The unit's WorkingDirectory is the caller's own checkout and the
+//                   loader discovers modules from process.cwd(), so the platform require()s
+//                   a repo the caller named.
+//   control-plane — did not exist when the gate was written, and was permitted by omission
+//                   the moment task 1003159 added it. A probe returned 201 and a second
+//                   control-plane row, while this file's own comment asserted it could not.
+//
+// So the set below is now the set that needs NO authority, and a shape added later is gated
+// by omission instead of admitted by it.
 //
 // DB-free: the pool is never reached (createInstance is stubbed), auth is faked. No network
 // beyond a loopback listener.
@@ -93,15 +108,7 @@ function post(path, body) {
   });
 }
 
-// ── the $0 shapes stay open — this is the half a careless fix would break ─────────
-
-await ta('standalone: a builder with NO fleet permission still creates (the live wizard path)', async () => {
-  held = [];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
-  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
-});
+// ── the front door stays open — this is the half a careless fix would break ───────
 
 await ta('co-tenant (and an absent shape, which defaults to it) stays open with no permission', async () => {
   for (const body of [
@@ -114,6 +121,61 @@ await ta('co-tenant (and an absent shape, which defaults to it) stays open with
   }
 });
 
+// ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
+
+await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
+  // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
+  // nothing. That is true of the invoice and false of the trust: the systemd unit's
+  // WorkingDirectory is the caller's own checkout and the module loader discovers
+  // `modules/` from process.cwd(), so a standalone request is "please require() this
+  // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
+  // it does not make the default acceptable.
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
+  assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
+});
+
+await ta('standalone: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+  held = ['provisioning.fleet.manage'];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
+});
+
+// ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
+
+await ta('control-plane: refused for an unprivileged builder, and the refusal is not a permission', async () => {
+  // Until task 1003370 this returned 201 and created a SECOND control-plane row. The
+  // previous version of this file asserted, in a comment, that the shape "is not
+  // creatable through the create route at all" — a claim nothing tested, and which a
+  // probe falsified. The comment was true of intent and false of the code.
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'control-plane', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'no row is created');
+});
+
+await ta('control-plane: still refused for a builder holding EVERY permission', async () => {
+  // The distinguishing property. A permission gate would admit an Archon here, and
+  // `core-upgrade.js` picks the self row with `WHERE hosting_shape = 'control-plane'
+  // LIMIT 1` — so a second row makes "which machine is the control plane" a question
+  // with a caller-influenced answer. No rank makes that a coherent request; the self
+  // row is enrolled by scripts/gds/enroll-control-plane.js.
+  held = ['provisioning.fleet.manage'];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'control-plane', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'no row is created');
+});
+
 // ── dedicated is the metered one ──────────────────────────────────────────────────
 
 await ta('dedicated: REFUSED for a builder without provisioning.fleet.manage', async () => {
@@ -161,20 +223,35 @@ await ta('a case-variant shape does not slip past the gate INTO a dedicated row'
   }
 });
 
-await ta('HOSTING_SHAPES carries the shapes the gate reasons about, and control-plane is NOT metered', () => {
+await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision about its authority', () => {
   // This tripwire fired for the first time at task 1003159, which added a fourth
   // shape — 'control-plane', the platform's own box, enrolled so the owner's deploy
-  // door has a row to point at (ADR 0293 D2). Its question was "is the new shape
-  // also metered?", and the answer is NO, stated here rather than implied by
-  // absence: the control plane is infrastructure the project already runs and pays
-  // for, not a droplet allocated per request, so nothing about standing it up is
-  // billed through this gate. It is also not creatable through the create route at
-  // all — the self row is enrolled by the platform, not asked for by a builder.
+  // door has a row to point at (ADR 0293 D2). Its question then was "is the new
+  // shape also metered?" and the answer recorded was no — correct, and the wrong
+  // question. Nobody asked whether it was REQUESTABLE, and it was: a Xenos could
+  // POST for a second control plane until task 1003370.
+  //
+  // So the question this list now forces is the one that generalises. The gate is an
+  // allow-list: `co-tenant` needs nothing, `control-plane` is refused outright, and
+  // EVERY other shape — including one added after this file was last read — demands
+  // provisioning.fleet.manage by omission. A fifth shape therefore arrives already
+  // gated, and this assertion is the prompt to confirm that is what was wanted
+  // rather than the thing that has to catch the hole.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
     ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
-  // The assumption the tripwire actually guards is that exactly ONE shape is
-  // metered. A fifth shape that IS billed must widen the gate itself, in
-  // paid-shape-gate.js, and not merely this list.
+});
+
+await ta('an unknown shape is answered by the validator, not by the gate', () => {
+  // The gate DEFERS anything outside HOSTING_SHAPES so a typo gets `bad_hosting_shape`
+  // naming the valid set, rather than a 403 about a permission the caller would not
+  // have needed. Deferring is safe: the validator refuses it microseconds later, and
+  // createInstance coerces an unrecognised shape to co-tenant rather than storing it,
+  // so no deferred value can become a privileged row.
+  return post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenamt', no_address: true })
+    .then((res) => {
+      assert.equal(res.status, 400, `expected 400, got ${res.status} ${res.raw}`);
+      assert.equal(res.body.error.code, 'bad_hosting_shape');
+    });
 });
 
 server.close();