@bongos/core 1.19.886 → 1.19.888

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.886",
-  "core_contract": "1.19.886",
-  "source_commit": "316898e40a03efcd36d7449d595c288afc1cd8c1",
+  "core_version": "1.19.888",
+  "core_contract": "1.19.888",
+  "source_commit": "7ccf0b2f4cc7f7bafb93762cbd5cfb9ed37cf546",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T20:38:23.641Z",
+  "built_at": "2026-09-19T20:57:53.725Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 497,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2264,
+    "functional_verbatim": 2266,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2787,
-  "tree_sha256": "b969fc24c4a56c1e7b132aadc9f0855fddb1542325d65e5fb6f39063957ed493",
+  "file_count": 2789,
+  "tree_sha256": "42c331016e53b14ca5416a325790e2846ea0ee2c6a24177222b823a1d2977b9c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2052,7 +2052,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "19cb42bb52d123f89bf24d9e4b8667955f0fc682b2481790f0c48d8d1ed09e79"
+      "sha256": "37732622e53cde0e4ee6bb0133ef6bade2a862f7d6337c40723b94fbf6ae6c22"
     },
     {
       "path": "docs/architecture.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "064deae02dc6a35a8bf1fe1d0788d1de4f93361970a8631d72f90e8e8dfbb8d7"
+      "sha256": "7f60dfa2c479fecbd5a81de040689b9ff6f9d2aa5a907f9a7fcf86b77b476fea"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3732,7 +3732,7 @@
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
-      "sha256": "3ff56e388e9ae4cccb09fb072793b5544f771aeae51e8477f8a221f0c78b9515"
+      "sha256": "e9b3c905539a323d74a55f98455204bd46daca2daf49c476324e85684ba7971f"
     },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
@@ -3754,6 +3754,11 @@
       "mode": "0000644",
       "sha256": "31a5ac35536cecd264bc989907f4cf094e050db0b8de85e7e3e7831cf7c25a9d"
     },
+    {
+      "path": "modules/agents/migrations/agents_005_cron_trigger.sql",
+      "mode": "0000644",
+      "sha256": "5d422998b1d53ee015f4a494ccede1adcb1eb90bd501bd28c1d88f9840b87367"
+    },
     {
       "path": "modules/agents/module.json",
       "mode": "0000644",
@@ -6312,7 +6317,7 @@
     {
       "path": "modules/provisioning/paid-shape-gate.js",
       "mode": "0000644",
-      "sha256": "a72f2961ba04739648b8622d86a85a75aef613d5d7c50fbb2f43ae8cf2c4adae"
+      "sha256": "7c08e627e228bec400e9e2dc204418a6995a4668eb6c1817ae59f20f77cbe71e"
     },
     {
       "path": "modules/provisioning/pollers/catalog-backfill.js",
@@ -6367,7 +6372,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "e9eb66469fc14adc526f97815ef61f4145cf17bbf36bdb638a2ed4db897149b7"
+      "sha256": "63919aad35ff1f47c4981e5e5c1f1c08d79eb0de9588e0c3ba2c5ed488167211"
     },
     {
       "path": "modules/provisioning/seams.js",
@@ -7692,12 +7697,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "adef509b54c9513decbeb3c56a0e87925b07dd5d491b459c3f73a7ddd9646f55"
+      "sha256": "d3b1b9f84e1713ff7815c19a9bd02b6c4de4dd3b44a5ede68ff56fbd5ad0cfcd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f72673c4e4af6a3f16ba47c8dcd601ae2f9cb797626cf411fd291b474f5a7500"
+      "sha256": "4cd9682e13a9a2e1e358c7bd500286378e7b5b8ceb1bb284a925b91ab8de2a08"
     },
     {
       "path": "public-docs/index.html",
@@ -9702,7 +9707,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "522d02581614267d50279ebe88ace2bf5d35f1365149d35e5e98dde9f21d8243"
+      "sha256": "ae3867dc81f944026ce67bae25ca927232b84accc4ed03d4ef45798526c72c46"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9844,6 +9849,11 @@
       "mode": "0000644",
       "sha256": "eea8f9e0bdf2c84fabc81e16c30e4026a7a336c1e705d614e68b805957b9b74a"
     },
+    {
+      "path": "tests/agents_cron_trigger.mjs",
+      "mode": "0000644",
+      "sha256": "be78fa37657214c39a4880d2e1b44a1647c8b509d63262ca9a4a334431d7bdde"
+    },
     {
       "path": "tests/agents_event_router.mjs",
       "mode": "0000644",
@@ -9877,7 +9887,7 @@
     {
       "path": "tests/agents_validate.mjs",
       "mode": "0000644",
-      "sha256": "9376185bc6e11571b050dcf61a993faf780cea66aa4c0844d114b1cb738043e2"
+      "sha256": "164059d69fabbd5dd70a29b29c524b5359f0346b71091e73a5e4fafa5dbc0804"
     },
     {
       "path": "tests/agents_write_routes.mjs",
@@ -12727,17 +12737,17 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "dffa4b500d3afe770764e562236ee97b6d581ed3db301ee3f984c5caa6f6f35e"
+      "sha256": "540e9b5b158a5623525924403bcef444f87fe0364591cd9c6b9e0a55f4f6295c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "f8a714c4b4a77e6eaa00f832b47beef19b5de916d544af2b839455c301be2bc8"
+      "sha256": "f7a01aa6ed190c1ad544d91312909b081446a7fc2b6ef339f3ba8fa4d59f0306"
     },
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "1cf30338eb8dafc77f2fea1e2b5ec417fe64a6576ececcca18936fe4e871c763"
+      "sha256": "19961880545fe8f6c9eaf79095aa0d08f7862409109d581cac828f0f20b1be69"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",

package/docs/api/openapi.json

@@ -12672,7 +12672,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances",
-        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances — request a new instance. rank: any authenticated builder (own resource) for the free `co-tenant` shape. Every other shape also needs provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs the caller's own repo on the platform's box — and `control-plane` is refused outright, since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4). A full shared box answers 409 box_full up front (../capacity-gate.js). ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409. Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated), domain?, tier?, onboard_mode? (greenfield|adopt) }. onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner ALREADY has, so the runner must clone + layer onto its history instead of pushing a fresh tree at `main` (which an existing repo rejects as unrelated history). Absent → 'greenfield', the safe default.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "requestBody": {

package/docs/module-api-changelog.md

@@ -2246,5 +2246,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.884 with no explicit bump. run 35464802278. (task 1002620)
   1.19.886 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.885 with no explicit bump. run 35467975408. (task 1002620)
+  1.19.887 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.886 with no explicit bump. run 35468511941. (task 1002620)
+  1.19.888 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.887 with no explicit bump. run 35468948342. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -48,8 +48,31 @@
 const EVENT_CATALOG = Object.freeze(['task.shipped', 'idea.graded.full']);
 
 // Mirrors agents_definitions_trigger_type_chk. 'event' consumes the catalog above;
-// 'on-demand' is the historian shape (a builder asks, the agent answers).
-const TRIGGER_TYPES = Object.freeze(['event', 'on-demand']);
+// 'on-demand' is the historian shape (a builder asks, the agent answers); 'cron'
+// fires on a cadence and consumes CADENCES below (task 1004008, agents_005).
+const TRIGGER_TYPES = Object.freeze(['event', 'on-demand', 'cron']);
+
+// The cadence vocabulary a 'cron' trigger may declare, in trigger_spec.cadence.
+//
+// DUPLICATED FROM scripts/gds/routine-schedule.js ON PURPOSE, for the reason
+// RANK_ORDER below is duplicated: a module may require only src/module-api.js
+// (ADR 0083), so it cannot reach into scripts/. The two copies are kept honest by
+// tests/agents_cron_trigger.mjs, which reads routine-schedule.js's own CADENCES +
+// isUniformDivisor and asserts this file agrees — a drifting copy fails there
+// rather than at some future tick.
+//
+// N MUST DIVIDE 60 for the sub-hourly form. A cron step restarts each hour, so
+// only a divisor yields a uniform period: `*/15` fires :00 :15 :30 :45 always,
+// but `*/7` fires :00…:56 then waits 4 — a "7min" cadence that is not one.
+const CADENCES = Object.freeze(['hourly', 'daily', 'weekly', 'monthly']);
+const SUBHOURLY_RE = /^([1-9]\d*)min$/;
+function isCadence(name) {
+  if (CADENCES.includes(name)) return true;
+  const m = SUBHOURLY_RE.exec(String(name == null ? '' : name));
+  if (!m) return false;
+  const n = Number(m[1]);
+  return Number.isInteger(n) && n > 0 && n < 60 && 60 % n === 0;
+}
 
 // Mirrors agents_definitions_model_tier_chk. No 'main' tier by design — an agent
 // is a subagent, never the main session.
@@ -222,6 +245,29 @@ function validateAgentDefinition(obj, opts = {}) {
     }
   }
 
+  // --- the cadence, fail-closed, the same shape as the event catalog above ----
+  // agents_005's CHECK pins that a cron definition HAS a non-empty cadence; the
+  // vocabulary is pinned here, because the sub-hourly rule is a predicate and a
+  // CHECK spelling it out would be a second copy free to drift.
+  //
+  // The reach is deliberately the EVENT BLOCK'S reach, no more: an UNWIRED
+  // cadence is refused wherever it appears, including on a non-cron definition
+  // where it is dead config. A VALID cadence on a non-cron definition is ACCEPTED,
+  // exactly as a wired `event:` on an on-demand definition is — harmless, unread,
+  // and not this validator's call to police. Saying otherwise in a comment would
+  // describe a guard that is not here.
+  if (spec) {
+    const cadence = safeGet(spec, 'cadence');
+    const hasCadenceKey = cadence !== undefined && cadence !== null;
+    if (triggerType === 'cron' && !isNonEmptyString(cadence)) {
+      E('trigger_cadence_missing', 'trigger_spec.cadence',
+        `trigger_spec.cadence: required for a 'cron' trigger — a definition with no cadence can never fire. Named cadences: ${CADENCES.join(', ')}; or a sub-hourly '<N>min' where N divides 60.`);
+    } else if (hasCadenceKey && !isCadence(cadence)) {
+      E('trigger_cadence_unwired', 'trigger_spec.cadence',
+        `trigger_spec.cadence: ${JSON.stringify(cadence)} is not a cadence. Named cadences: ${CADENCES.join(', ')}; or a sub-hourly '<N>min' where N divides 60 (so the declared period and the realized one are the same claim).`);
+    }
+  }
+
   // --- model tier -----------------------------------------------------------
   const rawTier = safeGet(obj, 'model_tier');
   const modelTier = rawTier === undefined || rawTier === null ? 'default' : rawTier;
@@ -355,6 +401,7 @@ function validateAgentDefinition(obj, opts = {}) {
 module.exports = {
   validateAgentDefinition,
   EVENT_CATALOG,
+  CADENCES, isCadence,
   TRIGGER_TYPES,
   MODEL_TIERS,
   RANK_ORDER,

package/modules/agents/migrations/agents_005_cron_trigger.sql

@@ -0,0 +1,78 @@
+-- agents_005_cron_trigger.sql — make 'cron' a trigger type that can exist (task 1004008).
+--
+-- Tasks 1002498 (the cron-router poller) and 1002501 (the cron roster) both ask
+-- for a timer whose each tick SELECTS DUE CRON AGENTS. There are none and there
+-- can be none: agents_001 pinned trigger_type to ('event','on-demand') on BOTH
+-- agents_definitions and agents_runs, and lib/validate.js mirrors it. Build the
+-- poller against that and you get a timer that is correct, tested, and selects
+-- from an empty set by construction — green tests over an unreachable branch,
+-- which is a false claim of coverage rather than coverage. This migration is the
+-- enabling half; the poller is 1002498's and is deliberately NOT built here.
+--
+-- WIDENING A FAIL-CLOSED ENUM IS THE POINT, NOT A WORKAROUND. agents_001's header
+-- calls these enums fail-closed on purpose: "an unwired trigger name is refused,
+-- never silently stored". That rule is kept — 'cron' stops being unwired in the
+-- same change that makes it storable, because lib/validate.js is widened and
+-- constrained alongside. What is still true after this: a trigger name outside
+-- the three is refused at both the validator and the constraint.
+--
+-- BOTH TABLES, AND WHY THE LEDGER MATTERS AS MUCH AS THE DEFINITION. agents_001
+-- constrains trigger_type on agents_runs too. Widen only the definition and a
+-- cron agent could be stored and enabled, and then fail at the moment it fires,
+-- when the ledger insert violates its own CHECK — the worst shape available: a
+-- definition that looks armed and cannot record a single run.
+--
+-- A CRON DEFINITION MUST SAY WHEN. agents_001 already refuses an event definition
+-- with no event name ("a definition that can never fire"). A cron definition with
+-- no cadence is the same defect wearing a different key, so it gets the same
+-- treatment rather than being left for the poller to interpret at tick time.
+-- The cadence VOCABULARY is validated in lib/validate.js, not here: the named set
+-- ('hourly','daily','weekly','monthly') plus the open-ended sub-hourly form
+-- ('15min') is a predicate, and a CHECK that tried to spell the sub-hourly rule —
+-- N must divide 60 — would be a second, drifting copy of it. The constraint
+-- pins the SHAPE (a non-empty cadence key is present); the validator pins the
+-- VALUE. That is the same division agents_001 draws for `event`.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is agents_-prefixed, there is no down-migration, and the filename is
+-- agents_-prefixed (ADR 0108 §5). Idempotent: safe to re-run. No existing row
+-- changes — widening a CHECK can only make rows MORE legal, so nothing that
+-- validates today stops validating.
+
+BEGIN;
+
+DO $$
+BEGIN
+  -- agents_definitions: the three WIRED trigger types.
+  IF EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_definitions_trigger_type_chk') THEN
+    ALTER TABLE agents_definitions DROP CONSTRAINT agents_definitions_trigger_type_chk;
+  END IF;
+  ALTER TABLE agents_definitions ADD CONSTRAINT agents_definitions_trigger_type_chk
+    CHECK (trigger_type IN ('event', 'on-demand', 'cron'));
+
+  -- agents_runs: the same three, so a cron fire can be RECORDED and not only run.
+  IF EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_runs_trigger_type_chk') THEN
+    ALTER TABLE agents_runs DROP CONSTRAINT agents_runs_trigger_type_chk;
+  END IF;
+  ALTER TABLE agents_runs ADD CONSTRAINT agents_runs_trigger_type_chk
+    CHECK (trigger_type IN ('event', 'on-demand', 'cron'));
+
+  -- The twin of agents_definitions_trigger_spec_event_chk: a cron definition
+  -- carries a non-empty cadence, or it is a definition that can never fire.
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'agents_definitions_trigger_spec_cadence_chk') THEN
+    ALTER TABLE agents_definitions ADD CONSTRAINT agents_definitions_trigger_spec_cadence_chk
+      CHECK (trigger_type <> 'cron'
+             OR (trigger_spec ? 'cadence' AND length(trigger_spec ->> 'cadence') > 0));
+  END IF;
+END $$;
+
+-- agents_001 indexes (trigger_type, trigger_spec->>'event') for the event
+-- router's "who wants this event" read. The cron router's read is a different
+-- question — "which cron agents are due" — and it is answered by scanning the
+-- cron rows, which are few. Adding a cadence index now would be indexing for a
+-- query no committed code makes; 1002498 adds one if its poller needs it.
+
+COMMENT ON CONSTRAINT agents_definitions_trigger_type_chk ON agents_definitions IS
+  'The WIRED trigger vocabulary (task 1004008 added cron). Mirrored by TRIGGER_TYPES in modules/agents/lib/validate.js — widen both together or the two disagree about what can exist.';
+
+COMMIT;

package/modules/provisioning/paid-shape-gate.js

@@ -1,21 +1,54 @@
-// modules/provisioning/paid-shape-gate.js — who may ask for METERED infrastructure
-// (task 1003682).
+// modules/provisioning/paid-shape-gate.js — who may ask for which hosting SHAPE
+// (task 1003682, widened by task 1003370 / audit B4).
+//
+// THE FILENAME IS NARROWER THAN THE FILE, DELIBERATELY. This started as the gate over
+// METERED shapes alone. Task 1003370 widened it to every shape that is not the free
+// front door, and the name was kept because ADR 0285 links to it by path and four
+// sibling files cite it by name as the precedent for living in their own file. A rename
+// would have broken those links to buy a better noun; this paragraph buys the same
+// clarity for free.
 //
 // The create route is open to any authenticated builder, and it must stay that way:
-// standing up a project is the platform's front door, not a privilege. But one of the
-// hosting shapes it accepts is not free. `dedicated` is the only shape whose runner leg
-// allocates a real droplet (`scripts/gds/provision.js` — billed monthly, defaulting to
-// s-2vcpu-4gb when no tier is named); every other shape co-tenants on infrastructure the
-// platform already pays for, which is why `costEstimateUsd` returns 0 for all of them.
+// standing up a project is the platform's front door, not a privilege. But only ONE of
+// the shapes it accepts is actually that front door. The others each hand the caller
+// something the platform pays for or trusts:
+//
+//   co-tenant     — the front door. Co-tenants on infrastructure the platform already
+//                   runs; `costEstimateUsd` is 0. No authority required, ever.
+//   dedicated     — allocates a real droplet (`scripts/gds/provision.js`), billed
+//                   monthly, defaulting to s-2vcpu-4gb when no tier is named.
+//   standalone    — runs the caller's OWN repo on the platform's box. The unit's
+//                   WorkingDirectory is that checkout (`scripts/gds/provision-units.js`)
+//                   and the module loader discovers modules from `resolveInstanceRoot()`,
+//                   which is process.cwd() (`src/module-loader/loader.js`). So the
+//                   caller names a repo and the platform require()s its `modules/` —
+//                   arbitrary code execution on the control plane's own machine. Task
+//                   1003369 gave each instance its own uid, which bounds the blast
+//                   radius to that account; it does not make "any Xenos may run code
+//                   here" an acceptable default.
+//   control-plane — the platform's OWN row (ADR 0293 D2, task 1003159), enrolled by
+//                   `scripts/gds/enroll-control-plane.js` so the owner's deploy door has
+//                   something to point at. Never a thing a builder asks for. See below.
 //
 // So the authority question belongs to the SHAPE, not the route. Gating the whole route
 // would make ordinary project creation require a rank — the wrong trade entirely, and the
 // reason this is a middleware over one field rather than a floor on the endpoint.
 //
+// AN ALLOW-LIST, NOT A DENY-LIST — the control-plane-guard.js rule, for the same reason.
+// The set named below is the set that needs NO authority. Every other shape, including
+// one added after this file was last read, requires the permission by omission. The
+// previous shape of this gate listed the one shape that was gated and admitted the rest,
+// and that is exactly how `standalone` and `control-plane` stayed open: `standalone`
+// because it was reasoned about as "$0, therefore harmless" (true of the invoice, false
+// of the trust), and `control-plane` because it did not exist yet when the gate was
+// written. Permitted-by-omission is the failure mode this inversion removes.
+//
 // The atom is `provisioning.fleet.manage` (floor: metic), deliberately the same one that
 // already guards the fleet cost-ledger and force-teardown. Spending on the fleet and
-// managing the fleet are one authority, and before this the route that SPENDS money was
-// less gated than the route that stops it.
+// managing the fleet are one authority, and before task 1003682 the route that SPENDS
+// money was less gated than the route that stops it. Task 1003370 adds no new atom: the
+// question "may this caller commit the platform's own resources" is the same question
+// whether the resource is a droplet or the control plane's CPU.
 //
 // Split into its own file rather than inlined beside the route for two reasons, both
 // mechanical: `routes/provisioning.js` sits at its 1500-line fitness ratchet (the same
@@ -25,33 +58,75 @@
 // write route" failure on an unrelated endpoint.
 'use strict';
 
-// The shapes that cost money. Kept as a set of one rather than a bare `=== 'dedicated'`
-// so a second metered shape is a one-line change here instead of a hunt through gates;
-// `tests/provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES so adding one without
-// revisiting this file fails loudly.
-const METERED_SHAPES = Object.freeze(new Set(['dedicated']));
+const provisioning = require('./provisioning.js');
+
+// The shapes any authenticated builder may request with no permission at all. This is
+// the whole allow-list, and it is deliberately one entry long: co-tenant is the front
+// door, and the front door is the only thing that should be free. `tests/
+// provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES against this set so a new shape
+// cannot be added without someone deciding, in writing, which side of the line it is on.
+const OPEN_SHAPES = Object.freeze(new Set(['co-tenant']));
 
-// isMeteredShape — does this hosting shape allocate infrastructure someone is billed for?
-// Matches the exact wire value: the route's own validator refuses anything not in
-// HOSTING_SHAPES, so a case or whitespace variant is rejected as a bad shape rather than
-// admitted here as a cheap one.
-function isMeteredShape(shape) {
-  return METERED_SHAPES.has(shape);
+// Shapes that are not requestable through this route AT ALL — no permission admits them,
+// because there is no rank at which "ask the API for a second control plane" is a
+// coherent request. The control-plane row is the platform describing ITSELF; a builder
+// -created duplicate is not a privilege escalation in the permission sense but something
+// worse: `core-upgrade.js` selects the self row with
+// `WHERE hosting_shape = 'control-plane' LIMIT 1`, so a second row makes "which machine
+// is the control plane" a question with a caller-influenced answer. Refused by name, at
+// the door, for the same reason control-plane-guard.js refuses by name.
+const UNREQUESTABLE_SHAPES = Object.freeze(new Set(['control-plane']));
+
+// shapeAuthority — what does this wire value demand? PURE. Returns one of:
+//   'open'          → admit with no permission
+//   'unrequestable' → refuse outright, whatever the caller holds
+//   'permission'    → require provisioning.fleet.manage
+//   'defer'         → not a shape this gate recognises; let the route's own validator
+//                     answer it (a 400 `bad_hosting_shape` naming the valid set is a far
+//                     more useful reply to a typo than a 403 about a permission the
+//                     caller would not have needed anyway).
+//
+// 'defer' is safe despite looking like a hole: the validator runs immediately after this
+// middleware and refuses anything outside HOSTING_SHAPES, and `createInstance` coerces an
+// unrecognised shape to 'co-tenant' rather than storing it. There is no path by which a
+// deferred value becomes a privileged row.
+//
+// Matches the exact wire value — a case or whitespace variant of a privileged shape is
+// not in HOSTING_SHAPES, so it defers here and is then refused as a bad shape, never
+// admitted as a cheap one.
+function shapeAuthority(rawShape) {
+  const shape = rawShape === undefined || rawShape === null || rawShape === ''
+    ? 'co-tenant' // an absent shape is the documented default, and it is the open one
+    : rawShape;
+  if (typeof shape !== 'string') return 'defer';
+  if (!provisioning.HOSTING_SHAPES.includes(shape)) return 'defer';
+  if (UNREQUESTABLE_SHAPES.has(shape)) return 'unrequestable';
+  if (OPEN_SHAPES.has(shape)) return 'open';
+  return 'permission';
 }
 
-// requireAuthorityForMeteredShape — the create route's paid-shape gate. Mount it AFTER
-// requireBuilder and BEFORE the handler, so a refusal leaves no row behind for the runner
-// to drain later. `requirePermission` is injected (rather than required here) so the gate
-// is exercisable without standing up the auth stack.
-function requireAuthorityForMeteredShape(requirePermission) {
+// requireAuthorityForShape — the create route's shape gate. Mount it AFTER requireBuilder
+// and BEFORE the handler, so a refusal leaves no row behind for the runner to drain later.
+// `requirePermission` is injected (rather than required here) so the gate is exercisable
+// without standing up the auth stack.
+function requireAuthorityForShape(requirePermission) {
   const gate = requirePermission('provisioning.fleet.manage');
-  return function meteredShapeGate(req, res, next) {
-    if (!isMeteredShape(req.body && req.body.hosting_shape)) return next();
+  return function shapeGate(req, res, next) {
+    const verdict = shapeAuthority(req.body && req.body.hosting_shape);
+    if (verdict === 'open' || verdict === 'defer') return next();
+    if (verdict === 'unrequestable') {
+      return res.fail('shape_not_requestable', {
+        status: 403,
+        message: 'The control plane enrolls its own row; it cannot be requested through this route.',
+        details: { hosting_shape: req.body.hosting_shape, requestable: [...provisioning.HOSTING_SHAPES].filter((s) => !UNREQUESTABLE_SHAPES.has(s)) },
+      });
+    }
     return gate(req, res, next);
   };
 }
 
-// Only the gate is exported. METERED_SHAPES and isMeteredShape are deliberately private:
-// nothing outside this file needs to ask "is this shape metered" separately from being
-// gated on it, and an export nobody consumes is one more thing to keep true.
-module.exports = { requireAuthorityForMeteredShape };
+// Only the gate is exported. OPEN_SHAPES, UNREQUESTABLE_SHAPES and shapeAuthority are
+// deliberately private: nothing outside this file needs to ask "what does this shape
+// demand" separately from being gated on it, and an export nobody consumes is one more
+// thing to keep true.
+module.exports = { requireAuthorityForShape };

package/modules/provisioning/routes/provisioning.js

@@ -12,9 +12,10 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
-//                                                     (a `dedicated` shape ALSO needs
-//                                                      provisioning.fleet.manage — it is the
-//                                                      only shape that bills; ../paid-shape-gate.js.
+//                                                     (only `co-tenant` is free; every other
+//                                                      shape ALSO needs provisioning.fleet.manage,
+//                                                      and `control-plane` is not requestable at
+//                                                      all; ../paid-shape-gate.js.
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
@@ -50,7 +51,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
-const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
+const { requireAuthorityForShape } = require('../paid-shape-gate');
 const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
@@ -280,11 +281,14 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource); a `dedicated` (metered) shape also needs provisioning.fleet.manage
-  // (../paid-shape-gate.js), and a full shared box answers 409 box_full up front (../capacity-gate.js).
+  // builder (own resource) for the free `co-tenant` shape. Every other shape also needs
+  // provisioning.fleet.manage — `dedicated` because it bills, `standalone` because it runs
+  // the caller's own repo on the platform's box — and `control-plane` is refused outright,
+  // since the platform enrolls its own row (../paid-shape-gate.js, task 1003370 / audit B4).
+  // A full shared box answers 409 box_full up front (../capacity-gate.js).
   // ENQUEUES a 'provision' intent the runner (task P3) stands up. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
-  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
+  // Body: { slug (required), target_ref?, hosting_shape? (co-tenant free; others gated),
   //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
   //
   // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
@@ -292,7 +296,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForShape(auth.requirePermission), requireRoomOnBox(pool, log), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.886",
+  "version": "1.19.888",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.886",
+      "version": "1.19.888",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.886",
+  "version": "1.19.888",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.886'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.888'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_cron_trigger.mjs

@@ -0,0 +1,133 @@
+// tests/agents_cron_trigger.mjs — 'cron' is a trigger type that can EXIST
+// (task 1004008, goal 1000095).
+//
+// Tasks 1002498 (cron-router poller) and 1002501 (cron roster) both select "due
+// cron agents" from a set that was empty by construction: agents_001 pinned
+// trigger_type to ('event','on-demand') on BOTH agents_definitions and
+// agents_runs, and lib/validate.js mirrored it. A poller built against that is
+// correct, tested, and unreachable — green tests over a branch nothing can enter.
+//
+// What this locks:
+//   * the THREE places that must agree (validator, definitions CHECK, runs CHECK)
+//     — the ledger constraint is the one that is easy to forget, and forgetting it
+//     yields the worst shape available: an agent that looks armed, fires, and
+//     then violates a CHECK when it tries to record the run.
+//   * the cadence VOCABULARY, including the sub-hourly divisor rule.
+//   * that validate.js's duplicated CADENCES really match scripts/gds/
+//     routine-schedule.js's, which is the copy this one was made from.
+//   * that widening the enum did not loosen it — an unwired name is still refused.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const v = require('../modules/agents/lib/validate.js');
+const schedule = require('../scripts/gds/routine-schedule.js');
+
+const sql = (f) => fs.readFileSync(path.join(ROOT, 'modules', 'agents', 'migrations', f), 'utf8');
+const mig001 = sql('agents_001_definitions.sql');
+const mig005 = sql('agents_005_cron_trigger.sql');
+
+const def = (over = {}) => ({ name: 'ship-digest', persona: 'x'.repeat(40), ...over });
+const cron = (cadence) => def({ trigger_type: 'cron', trigger_spec: { cadence } });
+
+// ---- 1. the validator ------------------------------------------------------
+
+test("'cron' is a wired trigger type", () => {
+  assert.ok(v.TRIGGER_TYPES.includes('cron'));
+  // Widening is not loosening: the enum is still closed.
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'webhook', trigger_spec: {} })).ok, false);
+  assert.deepEqual([...v.TRIGGER_TYPES].sort(), ['cron', 'event', 'on-demand']);
+});
+
+test('a cron definition must say WHEN, or it can never fire', () => {
+  const r = v.validateAgentDefinition(def({ trigger_type: 'cron', trigger_spec: {} }));
+  assert.equal(r.ok, false);
+  assert.ok(r.errors.some((e) => e.code === 'trigger_cadence_missing'),
+    'the missing cadence is named as its own error, not folded into a generic spec failure');
+});
+
+test('the cadence vocabulary: named, and sub-hourly where N divides 60', () => {
+  for (const good of ['hourly', 'daily', 'weekly', 'monthly', '15min', '5min', '30min', '1min']) {
+    assert.equal(v.validateAgentDefinition(cron(good)).ok, true, `${good} is a cadence`);
+  }
+  // 7 and 45 do not divide 60: `*/7` fires :00…:56 then waits 4, so the declared
+  // period and the realized period would be different claims.
+  for (const bad of ['7min', '45min', '0min', '60min', 'fortnightly', 'often', '']) {
+    assert.equal(v.validateAgentDefinition(cron(bad)).ok, false, `${bad} is not a cadence`);
+  }
+});
+
+test('an accepted cron definition keeps its cadence through normalization', () => {
+  // The bug class task 1004007 documents one axis over: validate accepted a field
+  // and then DROPPED it, so a definition looked configured and was not.
+  const r = v.validateAgentDefinition(cron('daily'));
+  assert.equal(r.ok, true);
+  assert.equal(r.value.trigger_spec.cadence, 'daily', 'the cadence survives into the normalized value');
+  assert.equal(r.value.trigger_type, 'cron');
+});
+
+test('the event path is untouched', () => {
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: { event: 'task.shipped' } })).ok, true);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: {} })).ok, false);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'event', trigger_spec: { event: 'nope' } })).ok, false);
+});
+
+test('a VALID cadence on a non-cron definition is accepted, as a wired event is', () => {
+  // Pinned because the reach is a judgement call and the comment beside the code
+  // claims exactly this. An UNWIRED cadence is still refused wherever it appears.
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'on-demand', trigger_spec: { cadence: 'daily' } })).ok, true);
+  assert.equal(v.validateAgentDefinition(def({ trigger_type: 'on-demand', trigger_spec: { cadence: '7min' } })).ok, false);
+});
+
+// ---- 2. the copy that is free to drift -------------------------------------
+
+test('validate.js CADENCES agrees with routine-schedule.js, the copy it came from', () => {
+  // A module may require only src/module-api.js (ADR 0083), so validate.js cannot
+  // import this list — it holds a duplicate. This test is the thing that keeps the
+  // duplicate honest; without it the two are one edit away from disagreeing about
+  // what a cadence is, and nothing would say so until a tick.
+  assert.deepEqual([...v.CADENCES].sort(), [...schedule.CADENCES].sort());
+  for (const n of [1, 5, 7, 15, 30, 45, 60, 0]) {
+    assert.equal(v.isCadence(`${n}min`), schedule.isCadence(`${n}min`),
+      `the two copies agree on ${n}min`);
+  }
+});
+
+// ---- 3. both CHECK constraints ---------------------------------------------
+
+test('BOTH tables widen — the ledger as well as the definition', () => {
+  // agents_001 constrains trigger_type on agents_runs too. Widen only the
+  // definition and a cron agent stores, enables, fires, and THEN fails when the
+  // run insert violates its own CHECK.
+  for (const c of ['agents_definitions_trigger_type_chk', 'agents_runs_trigger_type_chk']) {
+    assert.ok(mig001.includes(c), `${c} exists in agents_001 — this test is about widening it`);
+    assert.match(mig005, new RegExp(`ADD CONSTRAINT ${c}[\\s\\S]{0,200}?'cron'`),
+      `${c} is re-added including 'cron'`);
+    assert.match(mig005, new RegExp(`DROP CONSTRAINT ${c}`),
+      `${c} is dropped before being re-added — ALTER cannot widen a CHECK in place`);
+  }
+});
+
+test('the migration pins the SHAPE of a cron spec, leaving the vocabulary to the validator', () => {
+  assert.match(mig005, /agents_definitions_trigger_spec_cadence_chk/);
+  assert.match(mig005, /trigger_type <> 'cron'/, 'the guard only binds cron rows');
+  assert.match(mig005, /trigger_spec \? 'cadence'/, 'and requires the key');
+  // The sub-hourly divisor rule must NOT be spelled in SQL — that would be a
+  // second copy of isCadence(), free to drift from the one the validator uses.
+  assert.ok(!/% *60|divid/i.test(mig005.replace(/^--.*$/gm, '')),
+    'no arithmetic cadence rule in the executable SQL — the predicate lives in one place');
+});
+
+test('the migration is additive, namespaced and idempotent (ADR 0083 §5)', () => {
+  assert.match(mig005, /IF (NOT )?EXISTS/, 'guarded so a re-run is safe');
+  assert.ok(!/\bDROP TABLE\b|\bDROP COLUMN\b/i.test(mig005), 'nothing is destroyed');
+  for (const stmt of mig005.match(/(CREATE|ALTER)\s+TABLE\s+(\w+)/gi) || []) {
+    assert.match(stmt, /\s(agents_\w+)$/, `${stmt} touches only agents_-namespaced tables`);
+  }
+});

package/tests/agents_validate.mjs

@@ -164,12 +164,20 @@ await test('an on-demand definition carrying a WIRED event is accepted', () => {
 
 // --- THE TRIGGER TYPE -------------------------------------------------------
 
-await test('TRIGGER_TYPES is the v1 pair the DB CHECK also pins', () => {
-  assert.deepEqual(TRIGGER_TYPES, ['event', 'on-demand']);
+await test('TRIGGER_TYPES is the wired set the DB CHECK also pins', () => {
+  // Was the v1 PAIR; task 1004008 added 'cron' so tasks 1002498/1002501 select
+  // from a set that can be non-empty. Kept as an exact list on purpose: widening
+  // this vocabulary must be a deliberate edit here AND in agents_005's CHECK on
+  // both agents_definitions and agents_runs (tests/agents_cron_trigger.mjs pins
+  // that the three agree).
+  assert.deepEqual(TRIGGER_TYPES, ['event', 'on-demand', 'cron']);
 });
 
 await test('an unknown trigger type is refused', () => {
-  for (const bad of ['cron', 'webhook', 'Event', 'on demand', '', null, undefined, 7, {}]) {
+  // 'cron' was this list's first entry until task 1004008 wired it. 'webhook' and
+  // 'schedule' are the plausible-but-unwired names now — the case exists to prove
+  // an unwired name is refused, so it needs names that are actually unwired.
+  for (const bad of ['webhook', 'schedule', 'Event', 'on demand', '', null, undefined, 7, {}]) {
     const r = validateAgentDefinition({ ...OK_DEF, trigger_type: bad }, OPTS);
     assert.equal(r.ok, false, `${JSON.stringify(bad)} must be refused`);
     assert.ok(hasCode(r, 'trigger_type_unknown'), `${JSON.stringify(bad)} → ${JSON.stringify(codes(r))}`);
@@ -471,7 +479,7 @@ await test('a hostile getter cannot escape the validator', () => {
 
 await test('EVERY error carries a code, a field and a human message', () => {
   const r = validateAgentDefinition(
-    { name: 'BAD NAME', trigger_type: 'cron', trigger_spec: 'nope', scope_modules: ['government'] },
+    { name: 'BAD NAME', trigger_type: 'webhook', trigger_spec: 'nope', scope_modules: ['government'] },
     { authorRank: 'xenos', allowedModules: ['agents'] },
   );
   assert.equal(r.ok, false);
@@ -485,7 +493,7 @@ await test('EVERY error carries a code, a field and a human message', () => {
 
 await test('validation reports ALL faults at once, not just the first', () => {
   // An author fixing a definition file should not have to re-run four times.
-  const r = validateAgentDefinition({ name: 'X', persona: '', trigger_type: 'cron' }, OPTS);
+  const r = validateAgentDefinition({ name: 'X', persona: '', trigger_type: 'webhook' }, OPTS);
   for (const code of ['name_invalid', 'persona_missing', 'trigger_type_unknown']) {
     assert.ok(hasCode(r, code), `${code} missing from ${JSON.stringify(codes(r))}`);
   }

package/tests/provisioning_module_selection.mjs

@@ -235,7 +235,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
   // Act — the body the wizard files
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: ['agents', 'discord'],
+    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: ['agents', 'discord'],
   });
 
   // Assert
@@ -245,7 +245,7 @@ await ta('POST /instances: the picker\'s ids ride the create request through to
 
 await ta('POST /instances: an omitted modules key is still a valid create — skipping is supported, not an error', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game' });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs.modules, undefined, 'nothing is invented on the owner\'s behalf');
   // …and the receipt already carries the set they will actually get.
@@ -255,7 +255,7 @@ await ta('POST /instances: an omitted modules key is still a valid create — sk
 
 await ta('POST /instances: an explicit empty selection is accepted as an answer', async () => {
   lastCreateArgs = null; existingRow = null;
-  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: [] });
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', modules: [] });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.deepEqual(lastCreateArgs.modules, []);
 });
@@ -266,7 +266,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
   // prevent, and the reason badProjectDetail was written beside this.
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['discrod'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discrod'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -277,7 +277,7 @@ await ta('POST /instances: an unknown module is REFUSED and named, never silentl
 await ta('POST /instances: naming an always-on module is refused with the reason, not the generic miss', async () => {
   existingRow = null;
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['memory'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['memory'],
   });
   assert.equal(res.status, 400, res.raw);
   assert.equal(res.body.error.code, 'bad_modules');
@@ -286,11 +286,11 @@ await ta('POST /instances: naming an always-on module is refused with the reason
 
 await ta('POST /instances: modules must be an array of strings', async () => {
   existingRow = null;
-  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: 'discord' });
+  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: 'discord' });
   assert.equal(notArray.status, 400, notArray.raw);
   assert.equal(notArray.body.error.code, 'validation_failed');
 
-  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: [7] });
+  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'co-tenant', modules: [7] });
   assert.equal(notStrings.status, 400, notStrings.raw);
   assert.equal(notStrings.body.error.code, 'validation_failed');
 });
@@ -301,7 +301,7 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   // to hunt for one.
   existingRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents'], detail: {} };
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', modules: ['discord'],
+    slug: 'mercury', hosting_shape: 'co-tenant', modules: ['discord'],
   });
   assert.equal(res.status, 200, res.raw);
   assert.ok(res.body.modules_ignored, 'the dropped answer is reported, not swallowed');
@@ -589,7 +589,7 @@ await ta('POST /instances: a null answer at CREATION is accepted and stores noth
   lastCreateArgs = null; existingRow = null;
 
   const res = await post('/provisioning/instances', {
-    slug: 'mercury', hosting_shape: 'standalone', type: 'game', detail: { team_shape: null },
+    slug: 'mercury', hosting_shape: 'co-tenant', type: 'game', detail: { team_shape: null },
   });
 
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);

package/tests/provisioning_onboard_mode.mjs

@@ -150,7 +150,7 @@ function post(path, body) {
 await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
+    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
   });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');
@@ -158,7 +158,7 @@ await ta('POST /instances: onboard_mode=adopt is threaded through to createInsta
 
 await ta('POST /instances: onboard_mode absent → greenfield (unchanged behavior for every existing caller)', async () => {
   lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone' });
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenant' });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'greenfield');
 });
@@ -167,7 +167,7 @@ await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently co
   // Coercing here would be worse than refusing: the caller believes it asked for one thing
   // and the runner does another. The route names the valid set so the client can fix itself.
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'standalone', target_ref: 'a/b', onboard_mode: 'brownfield',
+    slug: 'demo', hosting_shape: 'co-tenant', target_ref: 'a/b', onboard_mode: 'brownfield',
   });
   assert.equal(res.status, 400);
   assert.equal(res.body.error.code, 'bad_onboard_mode');
@@ -204,8 +204,8 @@ await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no r
   // Without target_ref the runner would fall back to greenfield behavior on a row labelled
   // adopt. Refuse at the door rather than store a lie.
   for (const body of [
-    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt' },
-    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt', target_ref: '   ' },
+    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt' },
+    { slug: 'demo', hosting_shape: 'co-tenant', onboard_mode: 'adopt', target_ref: '   ' },
   ]) {
     const res = await post('/provisioning/instances', body);
     assert.equal(res.status, 400, `expected 400 for ${JSON.stringify(body)}`);

package/tests/provisioning_paid_shape_gate.mjs

@@ -10,11 +10,26 @@
 // SPENDS was less gated than force-teardown, which stops spending and sits behind
 // provisioning.fleet.manage.
 //
-// The fix gates the SHAPE, not the route: every $0 shape (standalone, co-tenant) stays open
-// to any authenticated builder, because ordinary project creation must not require a rank.
-// Only `dedicated` demands provisioning.fleet.manage — deliberately the same atom that
-// already guards the fleet cost-ledger and force-teardown, since spending on the fleet and
-// managing the fleet are one authority.
+// The fix gates the SHAPE, not the route: ordinary project creation must not require a rank,
+// so `co-tenant` — the front door — stays open to any authenticated builder. Everything else
+// demands provisioning.fleet.manage, deliberately the same atom that already guards the fleet
+// cost-ledger and force-teardown, since spending on the fleet and managing the fleet are one
+// authority.
+//
+// WIDENED BY TASK 1003370 (audit B4), which is why this file's name is narrower than its
+// subject. The original gate named the one shape it refused and admitted the rest, and two
+// shapes stayed open underneath that reasoning:
+//
+//   standalone    — judged harmless because it costs $0. True of the invoice; false of the
+//                   trust. The unit's WorkingDirectory is the caller's own checkout and the
+//                   loader discovers modules from process.cwd(), so the platform require()s
+//                   a repo the caller named.
+//   control-plane — did not exist when the gate was written, and was permitted by omission
+//                   the moment task 1003159 added it. A probe returned 201 and a second
+//                   control-plane row, while this file's own comment asserted it could not.
+//
+// So the set below is now the set that needs NO authority, and a shape added later is gated
+// by omission instead of admitted by it.
 //
 // DB-free: the pool is never reached (createInstance is stubbed), auth is faked. No network
 // beyond a loopback listener.
@@ -93,15 +108,7 @@ function post(path, body) {
   });
 }
 
-// ── the $0 shapes stay open — this is the half a careless fix would break ─────────
-
-await ta('standalone: a builder with NO fleet permission still creates (the live wizard path)', async () => {
-  held = [];
-  lastCreateArgs = null;
-  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
-  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
-  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
-});
+// ── the front door stays open — this is the half a careless fix would break ───────
 
 await ta('co-tenant (and an absent shape, which defaults to it) stays open with no permission', async () => {
   for (const body of [
@@ -114,6 +121,61 @@ await ta('co-tenant (and an absent shape, which defaults to it) stays open with
   }
 });
 
+// ── standalone runs the caller's OWN code on the platform's box (task 1003370) ────
+
+await ta('standalone: REFUSED for a builder without provisioning.fleet.manage', async () => {
+  // Task 1003682 left this shape open, reasoning that a $0 shape hands the caller
+  // nothing. That is true of the invoice and false of the trust: the systemd unit's
+  // WorkingDirectory is the caller's own checkout and the module loader discovers
+  // `modules/` from process.cwd(), so a standalone request is "please require() this
+  // repo on your control plane". The uid split (task 1003369) bounds the blast radius;
+  // it does not make the default acceptable.
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'permission_forbidden');
+  assert.deepEqual(res.body.error.details.required, ['provisioning.fleet.manage']);
+  assert.equal(lastCreateArgs, null, 'no row is created when the shape is refused');
+});
+
+await ta('standalone: ADMITTED for a builder holding provisioning.fleet.manage', async () => {
+  held = ['provisioning.fleet.manage'];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone', no_address: true });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.hostingShape, 'standalone');
+});
+
+// ── control-plane is not requestable AT ALL (task 1003370) ────────────────────────
+
+await ta('control-plane: refused for an unprivileged builder, and the refusal is not a permission', async () => {
+  // Until task 1003370 this returned 201 and created a SECOND control-plane row. The
+  // previous version of this file asserted, in a comment, that the shape "is not
+  // creatable through the create route at all" — a claim nothing tested, and which a
+  // probe falsified. The comment was true of intent and false of the code.
+  held = [];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'control-plane', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'no row is created');
+});
+
+await ta('control-plane: still refused for a builder holding EVERY permission', async () => {
+  // The distinguishing property. A permission gate would admit an Archon here, and
+  // `core-upgrade.js` picks the self row with `WHERE hosting_shape = 'control-plane'
+  // LIMIT 1` — so a second row makes "which machine is the control plane" a question
+  // with a caller-influenced answer. No rank makes that a coherent request; the self
+  // row is enrolled by scripts/gds/enroll-control-plane.js.
+  held = ['provisioning.fleet.manage'];
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'control-plane', no_address: true });
+  assert.equal(res.status, 403, `expected 403, got ${res.status} ${res.raw}`);
+  assert.equal(res.body.error.code, 'shape_not_requestable');
+  assert.equal(lastCreateArgs, null, 'no row is created');
+});
+
 // ── dedicated is the metered one ──────────────────────────────────────────────────
 
 await ta('dedicated: REFUSED for a builder without provisioning.fleet.manage', async () => {
@@ -161,20 +223,35 @@ await ta('a case-variant shape does not slip past the gate INTO a dedicated row'
   }
 });
 
-await ta('HOSTING_SHAPES carries the shapes the gate reasons about, and control-plane is NOT metered', () => {
+await ta('HOSTING_SHAPES is pinned, so a new shape forces a written decision about its authority', () => {
   // This tripwire fired for the first time at task 1003159, which added a fourth
   // shape — 'control-plane', the platform's own box, enrolled so the owner's deploy
-  // door has a row to point at (ADR 0293 D2). Its question was "is the new shape
-  // also metered?", and the answer is NO, stated here rather than implied by
-  // absence: the control plane is infrastructure the project already runs and pays
-  // for, not a droplet allocated per request, so nothing about standing it up is
-  // billed through this gate. It is also not creatable through the create route at
-  // all — the self row is enrolled by the platform, not asked for by a builder.
+  // door has a row to point at (ADR 0293 D2). Its question then was "is the new
+  // shape also metered?" and the answer recorded was no — correct, and the wrong
+  // question. Nobody asked whether it was REQUESTABLE, and it was: a Xenos could
+  // POST for a second control plane until task 1003370.
+  //
+  // So the question this list now forces is the one that generalises. The gate is an
+  // allow-list: `co-tenant` needs nothing, `control-plane` is refused outright, and
+  // EVERY other shape — including one added after this file was last read — demands
+  // provisioning.fleet.manage by omission. A fifth shape therefore arrives already
+  // gated, and this assertion is the prompt to confirm that is what was wanted
+  // rather than the thing that has to catch the hole.
   assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
     ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
-  // The assumption the tripwire actually guards is that exactly ONE shape is
-  // metered. A fifth shape that IS billed must widen the gate itself, in
-  // paid-shape-gate.js, and not merely this list.
+});
+
+await ta('an unknown shape is answered by the validator, not by the gate', () => {
+  // The gate DEFERS anything outside HOSTING_SHAPES so a typo gets `bad_hosting_shape`
+  // naming the valid set, rather than a 403 about a permission the caller would not
+  // have needed. Deferring is safe: the validator refuses it microseconds later, and
+  // createInstance coerces an unrecognised shape to co-tenant rather than storing it,
+  // so no deferred value can become a privileged row.
+  return post('/provisioning/instances', { slug: 'demo', hosting_shape: 'co-tenamt', no_address: true })
+    .then((res) => {
+      assert.equal(res.status, 400, `expected 400, got ${res.status} ${res.raw}`);
+      assert.equal(res.body.error.code, 'bad_hosting_shape');
+    });
 });
 
 server.close();