@bongos/core 1.19.975 → 1.19.976

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.975",
-  "core_contract": "1.19.975",
-  "source_commit": "4073475edb22dae11e825a4191c1467101ca8b78",
+  "core_version": "1.19.976",
+  "core_contract": "1.19.976",
+  "source_commit": "842af7dc231eb9ad6803f0de071d554622562402",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T14:01:28.147Z",
+  "built_at": "2026-09-23T15:01:32.683Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 516,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2378,
+    "functional_verbatim": 2382,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2920,
-  "tree_sha256": "2ff13cad510adfd6dc7430579c417a6c8216d515d0fadb546fec92844fee0186",
+  "file_count": 2924,
+  "tree_sha256": "6ad34cb8327cf6329010817bd052759a99e906fb785e2f370bb15ee113343cc1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1362,7 +1362,7 @@
     {
       "path": "docs/adr/0176-private-repo-deploy-keys.md",
       "mode": "0000644",
-      "sha256": "80c1b9d283892454f45504fe3f20f3a215967de7cca66a5b3ef30970bb8eed47"
+      "sha256": "c10a9b3039835676e84c1cedac77b3897fc03f5db689ecc34b8b658c51210d5f"
     },
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
@@ -2702,7 +2702,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7daf42cf3ac4f8acccb5543777095d0cbd57c6cf44769c12eb9ad3c0f45caa29"
+      "sha256": "9b3e01085f3f3648c51df5ecc0e6d6b4e6c687e90aceaa4e3c80689500767c88"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6719,6 +6719,11 @@
       "mode": "0000644",
       "sha256": "1287440b0088a6451dd4df234e578e06fc6f3e892915e64cd6c6e1f09dadd9d5"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_025_repo_private.sql",
+      "mode": "0000644",
+      "sha256": "949130ba321fc382c30fd7bfb76572e8415492b8641f644719cef3658a415cb9"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6757,7 +6762,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "82bb265d63bb882468bbb609faa60a783ccf7dfeec5cd4595550586c37131bda"
+      "sha256": "a6c7b6cdaca50106bd59b86e0272a2e24fe269a43e4a7f6e3a63504e73fa74d5"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6769,6 +6774,11 @@
       "mode": "0000644",
       "sha256": "4c933aad1307378496d47960e24c9d797a1f122f28aefa27b769f336e4cf2e75"
     },
+    {
+      "path": "modules/provisioning/repo-private.js",
+      "mode": "0000644",
+      "sha256": "0adee6537b5f127ea3fa5589bc92acc5b6accf6f100f395fe802640ff74b018f"
+    },
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
@@ -8122,12 +8132,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0f89059003740deb1ccd605358c8f983a2d0e1ea880bf5a584150d8f8549fef6"
+      "sha256": "de02838b05a35599823a045bae0ed5e317ee334951d9dee697785c790bd90e66"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d12f17578bc304bdef802b5e15a9a705437a947795a255a70b5e7d76c8a3f2e7"
+      "sha256": "a93b66e4c048714c36e8c237004cc15061ea8776795535ddd7b179fe1b1b1bfc"
     },
     {
       "path": "public-docs/index.html",
@@ -9104,6 +9114,11 @@
       "mode": "0000644",
       "sha256": "a113cdae4d6dcb3f8d968d41c2f1ce67b34d77229fe0a19d6bc5023f7ed469b5"
     },
+    {
+      "path": "scripts/gds/provision-repo-private.js",
+      "mode": "0000644",
+      "sha256": "f2c31eaf1808ee19aaf7266a82509a05ae39d7f638ffaf3aeffcc33e304262aa"
+    },
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
@@ -9122,7 +9137,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "1d92b6cbbfb544328a8bacd29cb492445508617298c251872d846bb7ab5a180a"
+      "sha256": "7747b46f241bddb4257a56461703f82603dd58e18d22bd2c547fd7137749d0e6"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9892,7 +9907,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "e69373026518a4e67ceca38e596354fa471fe11b7b00a718af62a1d3aabc0c4a"
+      "sha256": "3e0087226edf1d877e56cf647b2af805430ececabf9b51ecf56df280f959b418"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -10147,7 +10162,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0a617d0a28a74ab5e8a1af5b6ddeb79de9ec5b8c94640e6f548dac35416c085"
+      "sha256": "73c1013f0db275ad8c71b17973158d0ac150c99e9006a3d0aafac94758fa6f13"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11532,7 +11547,7 @@
     {
       "path": "tests/github_repos_helpers.mjs",
       "mode": "0000644",
-      "sha256": "0bde5e75593b43a307c3bab748f02b1f77afc2e3a98decf88f2bff419c843b7d"
+      "sha256": "66fd3d349445aa00e55fa77589958d6c98980e99f3cdaf4746ff55494202333a"
     },
     {
       "path": "tests/github_token_store.mjs",
@@ -13274,6 +13289,11 @@
       "mode": "0000644",
       "sha256": "755e93592b581593c463af59bad68b7e5b753c8305b80ff759501d878a31b209"
     },
+    {
+      "path": "tests/provision_repo_private.mjs",
+      "mode": "0000644",
+      "sha256": "9140b670c8ab76069c76238cf47bfdd539141198a40ef23f443813543947c4aa"
+    },
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
@@ -13382,7 +13402,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "642d29f2e29e38a0b3a7229309b03a9e1cb28969e7f6d942bd06dd092147b835"
+      "sha256": "ab01149d73158276a73464bc0feca3474ee2f054db03af378c9b43874a2056fb"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
@@ -13402,7 +13422,7 @@
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
-      "sha256": "6155e1e7c18417537636e6e0ca1d63f4b87264c350d736fb787dfdafb7950280"
+      "sha256": "b23049faa369d75b867a9c31237fe073424e694588627217a1105a5522c16fc6"
     },
     {
       "path": "tests/provisioning_teardown_states.mjs",

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -51,6 +51,10 @@ best-effort revokes the key by title. Pushes keep preferring the owner-token HTT
 - The flip-to-private refusal on the manage page (task 1003045) stays until existing
   already-provisioned instances get the same wiring on flip — a follow-up task, since their
   origin still rides the shared alias.
+  **Progress (2026-09-23):** the runner half has landed — task 1004167 let the wiring run
+  before a flip (`intendedPrivate`), and task 1004193 added the `repo-private` intent whose
+  runner leg wires the key and only then flips. The refusal stays until task 1003078 adds the
+  route and the manage-page control that enqueue it.
 - Builder **dev boxes** of a private-repo project were parked here as out of scope.
   **Answered on hardware 2026-08-25 (task 1003247): a box CAN read the private repo, and the
   auth design needed no change.** The GDS-backed credential helper (`otb-git-credential`,

package/docs/module-api-changelog.md

@@ -2424,5 +2424,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.973 with no explicit bump. run 35816317024. (task 1002620)
   1.19.975 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.974 with no explicit bump. run 35871083707. (task 1002620)
+  1.19.976 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.975 with no explicit bump. run 35878415178. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/migrations/provisioning_025_repo_private.sql

@@ -0,0 +1,34 @@
+-- provisioning_025_repo_private.sql — take an existing project's repository private
+-- (task 1004193, split (b) of task 1003078; ADR 0176).
+--
+-- WHY THIS EXISTS. A project stood up while its repository was public deploys through the
+-- platform's shared key, which cannot read a private repository. Flipping such a repository
+-- private from GitHub breaks the project's next deploy pull (walk finding N4), so the manage
+-- page has refused the flip since task 1003045. Standups after ADR 0176 give a private
+-- repository its own read-only deploy key; this action gives an EXISTING project the same
+-- wiring and only then flips it.
+--
+-- WHY AN INTENT. The wiring runs ssh-keygen and git config inside the project's checkout on
+-- the control-plane box, with the owner's stored GitHub credential. The web tier holds
+-- neither, so it may only ask; the runner (scripts/gds/provision-repo-private.js) does it —
+-- deploy key FIRST, flip SECOND, so there is never a moment the repository is private and
+-- the checkout still reads with the shared key.
+--
+-- WHY NO PAYLOAD. The action name IS the direction: it only ever means "make it private".
+-- Going public needs no wiring and stays a direct call on the core route. So nothing new
+-- is carried, and the target_version CHECK from provisioning_020 already holds for this
+-- action as written (repo-private is not an upgrade action, and carries no target).
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+-- INTENT_ACTIONS in modules/provisioning/provisioning.js is the other spelling of this list;
+-- tests/provisioning_restart.mjs and tests/core_upgrade_door.mjs fail if the two disagree.
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight', 'repo-private'));
+
+COMMIT;

package/modules/provisioning/provisioning.js

@@ -58,7 +58,7 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
 // 'core-upgrade' (task 1003159, ADR 0293): move this instance's core pin — the owner's
 // deploy door. The web tier only QUEUES it; the control-plane runner performs it.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight'];
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1158,7 +1158,7 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 // (the state CHECK has no 'superseded'; last_error says why) so the runner never
 // stands it up. A PENDING settings push is superseded the same way (task 1003140):
 // a push into a project about to be torn down is dead work, and letting it hold the
-// delete hostage would repeat 1002691. A pending 'restart' joins them for the same
+// delete hostage would repeat 1002691. A pending 'restart' or 'repo-private' (task 1004193) joins them for the same
 // reason (task 1003238) — and more sharply, since the owner reaches for Restart
 // precisely when a project looks broken, which is also when they give up and delete
 // it. A RUNNING intent is mid-flight and never yanked —
@@ -1171,7 +1171,7 @@ async function enqueueTeardown(db, instanceId, requestedBy) {
     `UPDATE provisioning_intents
         SET state = 'error', last_error = 'superseded: teardown requested',
             updated_at = now(), resolved_at = now()
-      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart') AND state = 'pending'
+      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
       RETURNING id`,
     [instanceId]
   );

package/modules/provisioning/repo-private.js

@@ -0,0 +1,29 @@
+// modules/provisioning/repo-private.js — the queue half of "make this project's repository
+// private" (task 1004193, split (b) of task 1003078; ADR 0176).
+//
+// A project stood up with a public repository reads its code with the platform's shared
+// key, which cannot read a private one — so the flip must wait until the project has its
+// own read-only deploy key. That wiring needs the box and the owner's stored credential, so
+// the web tier only enqueues; scripts/gds/provision-repo-private.js is the runner leg that
+// wires the key and THEN flips.
+//
+// Its own file because provisioning.js sits at the size ratchet. It reaches the queue
+// through the provisioning module OBJECT, so a test can stub enqueueIntent.
+'use strict';
+
+const provisioning = require('./provisioning');
+
+// Queue a flip-to-private. Arbitration is the restart shape: an open repo-private in
+// either state makes a repeat idempotent (the flip has no payload, so there is nothing a
+// second request could change); any OTHER open intent refuses it with
+// { conflict: 'open_intent' } rather than racing a standup, teardown or settings push over
+// the same checkout. The partial unique index ux_provisioning_intents_open stays the
+// arbiter if two requests interleave.
+async function enqueueRepoPrivate(db, instanceId, requestedBy) {
+  const { intent, created } = await provisioning.enqueueIntent(db, instanceId, 'repo-private', requestedBy);
+  if (created) return { intent, created: true };
+  if (intent.action === 'repo-private') return { intent, created: false };
+  return { intent, created: false, conflict: 'open_intent' };
+}
+
+module.exports = { enqueueRepoPrivate };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.975",
+  "version": "1.19.976",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.975",
+      "version": "1.19.976",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.975",
+  "version": "1.19.976",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo-private.js

@@ -0,0 +1,86 @@
+'use strict';
+// provision-repo-private.js — "make this project's repository private": the runner leg
+// (task 1004193, split (b) of task 1003078; ADR 0176).
+//
+// WHY. A project stood up while its repository was public reads its code with the
+// platform's shared deploy key, which cannot read a private repository. Flip such a
+// repository private and the project's next deploy pull fails (walk finding N4). Standups
+// since ADR 0176 give a private repository the project's own read-only deploy key; this
+// leg gives an EXISTING project the same wiring, and only then flips.
+//
+// ORDER IS THE SAFETY PROPERTY. Wire the key FIRST, flip SECOND. A deploy key authenticates
+// against a still-public repository, so wiring first leaves no window in which the repo is
+// private and the checkout still reads with the shared key. ensurePrivateRepoAccess would
+// see the repo as public and do nothing, so it is told where the repo is going
+// (`intendedPrivate`, task 1004167). If the flip then fails, the repository is public with
+// a working key — harmless, and the retry re-runs both steps idempotently.
+//
+// Every expected failure returns { ok:false } rather than throwing: a throw makes the
+// runner mark the whole project 'error', and a project that could not be made private is
+// still running fine. The error text is the owner's sentence — it rides error_note onto
+// the project card once the retries are spent.
+//
+// Its own file because provision.js sits at the size ratchet (the provision-disconnect.js
+// precedent). The web tier only enqueues (modules/provisioning/repo-private.js).
+
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+const { parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { ensurePrivateRepoAccess } = require('./provision-repo.js');
+
+async function repoPrivateInstance(inst, deps) {
+  const { db, provisioning, log, apply } = deps;
+  log(`repo-private ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
+
+  // Only a standalone project has its own checkout to wire; any other shape reads from a
+  // checkout this project does not own, so a key minted here would change nothing.
+  if (inst.hosting_shape !== 'standalone') {
+    return { ok: false, error: 'This project shares its code checkout with others, so its repository cannot be made private from here.' };
+  }
+  if (inst.status !== 'active') {
+    return { ok: false, error: `This project is ${inst.status}, not running, so its repository was not changed. Try again once it is live.` };
+  }
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) return { ok: false, error: 'This project has no GitHub repository on record, so there is nothing to make private.' };
+
+  let wired;
+  try {
+    wired = await ensurePrivateRepoAccess(inst, { ...deps, intendedPrivate: true });
+  } catch (e) {
+    return { ok: false, error: (e && e.message) || String(e) };
+  }
+  if (!apply) {
+    log(`  [repo-private] would then make ${repo.owner}/${repo.name} private with the owner's credential — only after the deploy key above is wired (dry-run — nothing ran)`);
+    return { ok: true, planned: true };
+  }
+  if (!wired || wired.private !== true) {
+    // Defensive: with intendedPrivate set, a standalone row with a repo either wires or
+    // throws. Anything else means the checkout is unwired, and flipping would break it.
+    return { ok: false, error: `The deploy key for ${repo.owner}/${repo.name} could not be set up, so the repository was left public.` };
+  }
+
+  const token = await resolveOwnerGithubToken(inst, deps);
+  if (!token) {
+    return { ok: false, error: `${repo.owner}/${repo.name} was not made private: the project's GitHub credential could not be read. Its deploy key is already in place, so reconnect GitHub and try again.` };
+  }
+  const ghRepos = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos'));
+  try {
+    log(`  [repo-private] making ${repo.owner}/${repo.name} private`);
+    await ghRepos.makeRepoPrivate(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+  } catch (e) {
+    const why = e && e.code === 'not_repo_admin' ? 'GitHub refused — the connected account cannot change this repository’s settings'
+      : e && e.code === 'repo_not_found' ? 'GitHub could not find the repository with the connected account'
+      : `GitHub could not make the change (${(e && e.message) || e})`;
+    return { ok: false, error: `${repo.owner}/${repo.name} is still public: ${why}. Its deploy key is already in place, so trying again is safe.` };
+  }
+
+  await provisioning.recordEvent(db, {
+    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
+    detail: `${repo.owner}/${repo.name} made private — the project now reads it with its own read-only deploy key${wired.minted ? ' (newly registered)' : ''}`,
+    actor: 'runner',
+  }).catch(() => {});
+  log(`  ✓ ${repo.owner}/${repo.name} is private; ${inst.slug} reads it with its own deploy key`);
+  return { ok: true, minted: !!wired.minted };
+}
+
+module.exports = { repoPrivateInstance };

package/scripts/gds/provision.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 'use strict';
-//
 // scripts/gds/provision.js — the INSTANCE-provisioning control-plane runner
 // (ADR 0111 §2/§3, BONGOS-V1 goal 32, task #1944). A sibling of box.js.
 //
@@ -1294,6 +1293,7 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
       else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
+      else if (intent.action === 'repo-private') result = await require('./provision-repo-private.js').repoPrivateInstance(inst, deps); // wire the deploy key, THEN flip (task 1004193); required here — this file is at the size ratchet
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
         if (intent.attempts >= MAX_INTENT_ATTEMPTS) {

package/src/bongos/github-repos.js

@@ -129,17 +129,14 @@ async function getUserRepo(token, { owner, name, fetchImpl = fetch } = {}) {
   };
 }
 
-// Flip one repo PUBLIC — and only public. Like createUserRepo's private:false,
-// the direction is deliberately not a parameter: the deploy pull still runs as
-// the shared deploy key that cannot read a private repo (walk finding N4), so
-// nothing in this codebase may flip a repo private until that fix lands — the
-// route refuses the request; this helper makes the refusal structural
-// (task 1003045). Returns the same shape as getUserRepo.
-async function makeRepoPublic(token, { owner, name, fetchImpl = fetch } = {}) {
+// The visibility PATCH both directions share. Deliberately NOT exported: callers get
+// one named function per direction, so the name stays the contract and no caller can
+// pass a direction it did not mean (the createUserRepo private:false precedent).
+async function setRepoPrivate(token, { owner, name, fetchImpl = fetch }, isPrivate) {
   const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
     method: 'PATCH',
     headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
-    body: JSON.stringify({ private: false }),
+    body: JSON.stringify({ private: isPrivate }),
   });
   if (res.status === 401) {
     throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
@@ -162,6 +159,22 @@ async function makeRepoPublic(token, { owner, name, fetchImpl = fetch } = {}) {
   };
 }
 
+// Flip one repo PUBLIC (task 1003045). Needs no deploy-key wiring — the shared key
+// reads a public repo — so the core route may call it directly. Returns the same
+// shape as getUserRepo.
+async function makeRepoPublic(token, ref = {}) {
+  return setRepoPrivate(token, ref, false);
+}
+
+// Flip one repo PRIVATE. Only the control-plane runner may call this, and only AFTER
+// ensurePrivateRepoAccess has wired the project's own read-only deploy key: the
+// shared key cannot read a private repo, so flipping first breaks the next deploy
+// pull (walk finding N4, ADR 0176). scripts/gds/provision-repo-private.js is that
+// caller (task 1004193); no web route calls it. Returns the same shape as getUserRepo.
+async function makeRepoPrivate(token, ref = {}) {
+  return setRepoPrivate(token, ref, true);
+}
+
 // ---- deploy keys (task 1002735 / ADR 0176) ----
 // The per-repo credential a PRIVATE repo's recurring deploy pull authenticates
 // with: provisioning mints an ed25519 keypair, registers its public half here with
@@ -237,7 +250,7 @@ async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch }
 }
 
 module.exports = {
-  listUserRepos, createUserRepo, getUserRepo, makeRepoPublic,
+  listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, makeRepoPrivate,
   listDeployKeys, addDeployKey, deleteDeployKey,
   GithubApiError, MAX_PAGES,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.975'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.976'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_repos_helpers.mjs

@@ -8,6 +8,7 @@
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -139,10 +140,9 @@ test('getUserRepo: 404 → typed repo_not_found (GitHub\'s own no-leak shape, fo
   );
 });
 
-test('makeRepoPublic: PATCHes exactly {private:false} — the private direction is structurally impossible', async () => {
-  // Like createUserRepo's private:false, the direction is deliberately not a
-  // parameter: the deploy pull runs as the shared deploy key that cannot read a
-  // private repo (N4), so nothing in the codebase may flip a repo private.
+test('makeRepoPublic: PATCHes exactly {private:false} — the name is the direction', async () => {
+  // Like createUserRepo's private:false, the direction is not a parameter: each
+  // direction is its own named function, so no caller can send one it did not mean.
   let sentMethod = '';
   let sentBody = null;
   const fetchImpl = async (url, init) => {
@@ -164,6 +164,57 @@ test('makeRepoPublic: 403 → typed not_repo_admin', async () => {
   );
 });
 
+// ---- the private direction (task 1004193, split (b) of task 1003078) ----
+
+test('makeRepoPrivate: PATCHes exactly {private:true} to the same endpoint', async () => {
+  // Arrange
+  let sentUrl = '';
+  let sentMethod = '';
+  let sentBody = null;
+  const fetchImpl = async (url, init) => {
+    sentUrl = url; sentMethod = init.method; sentBody = JSON.parse(init.body);
+    return res(200, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, permissions: { admin: true } });
+  };
+  // Act
+  const out = await gh.makeRepoPrivate('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  // Assert
+  assert.equal(sentMethod, 'PATCH');
+  assert.match(sentUrl, /\/repos\/me\/mercury$/);
+  assert.deepEqual(sentBody, { private: true });
+  assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, admin: true });
+});
+
+test('makeRepoPrivate: 403 → typed not_repo_admin, the same mapping as the public direction', async () => {
+  const fetchImpl = async () => res(403, { message: 'Must have admin rights' });
+  await assert.rejects(
+    () => gh.makeRepoPrivate('tok', { owner: 'other', name: 'repo', fetchImpl }),
+    (e) => e.code === 'not_repo_admin' && e.status === 403,
+  );
+});
+
+test('the shared visibility PATCH is not exported — only the two named directions are', () => {
+  assert.equal(typeof gh.makeRepoPublic, 'function');
+  assert.equal(typeof gh.makeRepoPrivate, 'function');
+  const visibilityExports = Object.keys(gh).filter((k) => /private|public|visibility/i.test(k)).sort();
+  assert.deepEqual(visibilityExports, ['makeRepoPrivate', 'makeRepoPublic'],
+    'a direction parameter on an export would let a caller flip private without the deploy-key wiring');
+});
+
+test('no web route may call makeRepoPrivate — only the runner flips a repo private, after wiring its key', () => {
+  // ADR 0176 / walk finding N4: flipping before the project's own deploy key is wired
+  // breaks its next deploy pull, and only the control-plane runner can wire that key.
+  const routeDirs = ['src/bongos/routes', 'modules/provisioning/routes'];
+  const offenders = [];
+  for (const dir of routeDirs) {
+    const abs = path.join(ROOT, dir);
+    if (!fs.existsSync(abs)) continue;
+    for (const f of fs.readdirSync(abs).filter((n) => n.endsWith('.js'))) {
+      if (/makeRepoPrivate/.test(fs.readFileSync(path.join(abs, f), 'utf8'))) offenders.push(`${dir}/${f}`);
+    }
+  }
+  assert.deepEqual(offenders, []);
+});
+
 // ---- deploy-key helpers (task 1002735 / ADR 0176) ----
 
 test('listDeployKeys: GETs /repos/{owner}/{name}/keys, maps id/title/key/read_only', async () => {

package/tests/provision_repo_private.mjs

@@ -0,0 +1,260 @@
+// tests/provision_repo_private.mjs
+//
+// Split (b) of task 1003078 (task 1004193, ADR 0176): the `repo-private` provisioning
+// intent — its queue seam (modules/provisioning/repo-private.js), its runner leg
+// (scripts/gds/provision-repo-private.js) and the run-intents dispatch that reaches it.
+// Hermetic — exec, db and GitHub are recording fakes; no shell, no DB, no network.
+//
+// The load-bearing assertions:
+//   • ORDER: the project's own deploy key is registered and the checkout re-pointed at it
+//     BEFORE the repository is flipped private. Flip first and the next deploy pull fails
+//     with the shared key (walk finding N4) — this is the whole point of the task
+//   • the wiring is asked for as a PRE-flip wiring (intendedPrivate), because GitHub still
+//     answers "public" at that moment and the un-told wiring would do nothing
+//   • any failure BEFORE the flip leaves the repository untouched — no PATCH is sent
+//   • every expected failure is ok:false (retried), never a throw, so a running project is
+//     never relabelled 'error' by a flip that could not happen
+//   • non-standalone and not-yet-live projects are refused without touching GitHub
+//   • dry-run calls GitHub not at all
+//   • the queue seam: idempotent on its own kind, conflicts with any other open intent
+//
+// Run:  node tests/provision_repo_private.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { repoPrivateInstance } = require('../scripts/gds/provision-repo-private.js');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const { enqueueRepoPrivate } = require('../modules/provisioning/repo-private.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const liveStandalone = { id: 18, slug: 'demo', hosting_shape: 'standalone', status: 'active', owner_builder_id: 7, target_ref: 'example-owner/demo' };
+
+// One ordered timeline across the shell AND GitHub, so the wire-before-flip order is
+// observable as positions in a single list rather than inferred from two.
+function recorder({ apply = true, token = 'gho_TOK', flipFails = null, getFails = null } = {}) {
+  const timeline = [], events = [], logs = [];
+  const deps = {
+    apply, log: (l) => logs.push(String(l)),
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: { recordEvent: async (_db, ev) => { events.push(ev); } },
+    exec: (cmd) => { timeline.push(['exec', cmd]); return { ok: true, stdout: '' }; },
+    getGithubToken: async () => (token ? { token, scope: 'read:user,repo' } : null),
+    fsImpl: { existsSync: () => false, readFileSync: () => 'ssh-ed25519 AAAAlocal cloudbongos-deploy-demo\n' },
+    githubRepos: {
+      getUserRepo: async (_t, a) => {
+        timeline.push(['gh', 'get']);
+        if (getFails) throw getFails;
+        return { full_name: `${a.owner}/${a.name}`, private: false, admin: true };
+      },
+      listDeployKeys: async () => { timeline.push(['gh', 'list']); return []; },
+      addDeployKey: async (_t, a) => { timeline.push(['gh', 'add', a.readOnly]); return { id: 99, title: a.title, read_only: true }; },
+      deleteDeployKey: async () => { timeline.push(['gh', 'del']); return true; },
+      makeRepoPrivate: async (_t, a) => {
+        timeline.push(['gh', 'flip-private', `${a.owner}/${a.name}`]);
+        if (flipFails) throw flipFails;
+        return { full_name: `${a.owner}/${a.name}`, private: true, admin: true };
+      },
+    },
+  };
+  const at = (pred) => timeline.findIndex(pred);
+  return { deps, timeline, events, logs, at };
+}
+const isFlip = (e) => e[0] === 'gh' && e[1] === 'flip-private';
+
+console.log('\nrunner leg — wire FIRST, flip SECOND:');
+
+await ta('the deploy key is registered and the checkout re-pointed BEFORE the repository is flipped private', async () => {
+  // Arrange
+  const r = recorder();
+  // Act
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  // Assert
+  assert.equal(out.ok, true, JSON.stringify(out));
+  const flip = r.at(isFlip);
+  const add = r.at((e) => e[0] === 'gh' && e[1] === 'add');
+  const sshCmd = r.at((e) => e[0] === 'exec' && /config core\.sshCommand/.test(e[1]));
+  const origin = r.at((e) => e[0] === 'exec' && /remote set-url origin git@github\.com:example-owner\/demo\.git/.test(e[1]));
+  assert.ok(flip >= 0, 'the repository is flipped');
+  assert.ok(add >= 0 && add < flip, 'the key is registered before the flip');
+  assert.ok(origin >= 0 && origin < flip, 'origin points at the plain GitHub URL before the flip');
+  assert.ok(sshCmd >= 0 && sshCmd < flip, 'core.sshCommand uses the project key before the flip');
+  assert.equal(r.timeline.filter(isFlip).length, 1, 'exactly one flip');
+  assert.equal(r.timeline[flip][2], 'example-owner/demo', 'the flip targets the project repository');
+});
+
+await ta('the wiring is a PRE-flip wiring — it runs although GitHub still reports the repository public', async () => {
+  const r = recorder();
+  await repoPrivateInstance(liveStandalone, r.deps);
+  // Without intendedPrivate, ensurePrivateRepoAccess reads private:false and registers nothing.
+  const add = r.timeline.find((e) => e[0] === 'gh' && e[1] === 'add');
+  assert.ok(add, 'a key was registered for a repo GitHub still calls public');
+  assert.equal(add[2], true, 'and it is read-only');
+});
+
+await ta('the flip records an event on the project, after it happens', async () => {
+  const r = recorder();
+  await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(r.events.length, 1);
+  assert.equal(r.events[0].event, 'repo-private');
+  assert.equal(r.events[0].instanceId, 18);
+  assert.equal(r.events[0].ownerBuilderId, 7);
+  assert.equal(r.events[0].actor, 'runner');
+  assert.match(r.events[0].detail, /example-owner\/demo made private/);
+});
+
+console.log('\nrunner leg — a failure before the flip leaves the repository alone:');
+
+await ta('no stored credential: ok:false, no key and NO flip — the repository stays public', async () => {
+  const r = recorder({ token: null });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /cannot be made private[\s\S]*credential/i);
+  assert.equal(r.at(isFlip), -1, 'nothing was flipped');
+});
+
+await ta('GitHub unreachable during the wiring: ok:false (a retry), never a throw, and NO flip', async () => {
+  const r = recorder({ getFails: new Error('ECONNRESET') });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /could not be reached/);
+  assert.equal(r.at(isFlip), -1);
+});
+
+await ta('the flip itself refused (403): ok:false, says the repository is STILL public and a retry is safe', async () => {
+  const e = Object.assign(new Error('GitHub refused the change for this account'), { code: 'not_repo_admin', status: 403 });
+  const r = recorder({ flipFails: e });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, false);
+  assert.match(out.error, /still public/);
+  assert.match(out.error, /cannot change this repository/);
+  assert.match(out.error, /trying again is safe/);
+  assert.equal(r.events.length, 0, 'no "made private" event for a flip that did not happen');
+});
+
+console.log('\nrunner leg — refusals that never reach GitHub:');
+
+for (const [label, inst, why] of [
+  ['a co-tenant project', { ...liveStandalone, hosting_shape: 'co-tenant' }, /shares its code checkout/],
+  ['a project that is not live yet', { ...liveStandalone, status: 'provisioning' }, /is provisioning, not running/],
+  ['a project with no repository on record', { ...liveStandalone, target_ref: null }, /no GitHub repository on record/],
+]) {
+  await ta(`${label}: ok:false with a plain reason, and no shell or GitHub call at all`, async () => {
+    const r = recorder();
+    const out = await repoPrivateInstance(inst, r.deps);
+    assert.equal(out.ok, false);
+    assert.match(out.error, why);
+    assert.deepEqual(r.timeline, []);
+  });
+}
+
+await ta('dry-run: plans the wire and the flip, and calls neither GitHub nor the shell', async () => {
+  const r = recorder({ apply: false });
+  const out = await repoPrivateInstance(liveStandalone, r.deps);
+  assert.equal(out.ok, true);
+  assert.equal(out.planned, true);
+  assert.deepEqual(r.timeline, []);
+  assert.ok(r.logs.some((l) => /ABOUT TO BE MADE PRIVATE/.test(l)), 'the plan names the pre-flip wiring');
+  assert.ok(r.logs.some((l) => /would then make example-owner\/demo private/.test(l)), 'and the flip after it');
+});
+
+console.log('\nrun-intents dispatch:');
+
+function drainDeps({ flipFails = null } = {}) {
+  let claims = 0; const resolved = [], statusWrites = [], updates = [];
+  const r = recorder({ flipFails });
+  const deps = {
+    ...r.deps, sleep: async () => {},
+    db: { query: async (sql, params) => { if (/UPDATE provisioning_intents/.test(sql)) updates.push({ sql, params }); return { rows: [] }; } },
+    provisioning: {
+      claimNextIntent: async () => (claims++ === 0 ? { id: 31, instance_id: 18, action: 'repo-private', attempts: 1 } : null),
+      getInstanceById: async () => ({ ...liveStandalone }),
+      resolveIntent: async (_db, id, state, err) => { resolved.push({ id, state, err }); },
+      setInstanceStatus: async (_db, _id, s, patch) => { statusWrites.push({ s, patch }); },
+      recordEvent: async () => {},
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    writeFile: () => ({ ok: true }), doApi: null,
+  };
+  return { deps, r, resolved, statusWrites, updates };
+}
+
+await ta("cmdRunIntents (--apply) routes 'repo-private' to the leg and resolves it done", async () => {
+  const d = drainDeps();
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 0, JSON.stringify(out));
+  assert.deepEqual(d.resolved, [{ id: 31, state: 'done', err: null }]);
+  assert.equal(d.r.timeline.filter(isFlip).length, 1, 'it really reached the flip');
+});
+
+await ta('cmdRunIntents: a flip that fails re-pends with the reason, and never marks the running project broken', async () => {
+  const d = drainDeps({ flipFails: Object.assign(new Error('boom'), { code: 'github_error' }) });
+  const out = await P.cmdRunIntents(d.deps);
+  assert.equal(out.errors, 1);
+  assert.equal(d.resolved.length, 0, 'not resolved — it re-pends for a later tick');
+  assert.match(d.updates[0].sql, /state='pending'/);
+  assert.match(d.updates[0].params[1], /still public/, 'the owner-facing reason rides last_error');
+  assert.equal(d.statusWrites.length, 0, 'a running project is not relabelled error');
+});
+
+console.log('\nqueue seam — modules/provisioning/repo-private.js:');
+
+async function withEnqueue(fake, fn) {
+  const orig = provisioning.enqueueIntent;
+  provisioning.enqueueIntent = fake;
+  try { await fn(); } finally { provisioning.enqueueIntent = orig; }
+}
+
+await ta('a fresh request is queued as repo-private, carrying the actor', async () => {
+  const calls = [];
+  await withEnqueue(async (_db, id, action, by) => { calls.push({ id, action, by }); return { intent: { id: 1, action }, created: true }; }, async () => {
+    const out = await enqueueRepoPrivate({}, 18, 'api:self');
+    assert.equal(out.created, true);
+    assert.equal(out.conflict, undefined);
+    assert.deepEqual(calls, [{ id: 18, action: 'repo-private', by: 'api:self' }]);
+  });
+});
+
+await ta('an open repo-private makes a repeat idempotent — not a conflict', async () => {
+  await withEnqueue(async () => ({ intent: { id: 1, action: 'repo-private', state: 'running' }, created: false }), async () => {
+    const out = await enqueueRepoPrivate({}, 18, 'api:self');
+    assert.equal(out.created, false);
+    assert.equal(out.conflict, undefined);
+  });
+});
+
+await ta('any OTHER open intent refuses it with open_intent — it never races a teardown or standup', async () => {
+  for (const action of ['teardown', 'provision', 'settings-apply', 'disconnect']) {
+    await withEnqueue(async () => ({ intent: { id: 2, action, state: 'pending' }, created: false }), async () => {
+      const out = await enqueueRepoPrivate({}, 18, 'api:self');
+      assert.equal(out.conflict, 'open_intent', action);
+    });
+  }
+});
+
+await ta('a teardown supersedes a PENDING repo-private — a queued flip must never hold the owner\'s delete hostage', async () => {
+  // Arrange — every intent shares one open slot per project, so an un-superseded pending
+  // flip would refuse the teardown until the runner worked through it (the 1002691 class).
+  const calls = [];
+  const db = { query: async (sql, params) => {
+    calls.push(sql);
+    if (/UPDATE provisioning_intents/.test(sql)) return { rows: [{ id: 5 }] };
+    return { rows: [{ id: 6, action: 'teardown', state: 'pending', instance_id: params[0] }] };
+  } };
+  // Act
+  const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
+  // Assert
+  assert.equal(r.superseded, true);
+  assert.match(calls[0], /'repo-private'/, 'repo-private is on the supersedable list');
+  assert.match(calls[0], /state = 'pending'/, 'pending only — a RUNNING flip is mid-wiring and never yanked');
+});
+
+console.log(`\nprovision_repo_private: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_settings_apply.mjs

@@ -131,7 +131,7 @@ await ta('enqueueTeardown supersedes a PENDING settings push (a push into a proj
   const r = await provisioning.enqueueTeardown(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.superseded, true, 'the queued push was cancelled so the teardown could take the slot');
-  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
+  assert.match(calls[0], /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/, 'pending-only, and only the supersedable actions');
 });
 
 // ── the route, over a real mounted router (stubbed data access) ─────────────────

package/tests/provisioning_teardown_intent.mjs

@@ -31,7 +31,7 @@ const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
 
 // The actions a teardown supersedes, mirroring enqueueTeardown's SQL.
-const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart']);
+const SUPERSEDABLE = new Set(['provision', 'settings-apply', 'restart', 'repo-private']);
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -79,7 +79,7 @@ function fakeIntentDb(seed = []) {
         // dead work in front of a teardown (task 1003140 widened it to the settings
         // push, task 1003238 to the restart; an open teardown is left alone for the
         // idempotent path).
-        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart'\) AND state = 'pending'/);
+        assert.match(sql, /action IN \('provision', 'settings-apply', 'restart', 'repo-private'\) AND state = 'pending'/);
         const hit = rows.filter((r) =>
           String(r.instance_id) === String(params[0]) && SUPERSEDABLE.has(r.action) && r.state === 'pending');
         for (const r of hit) { r.state = 'error'; r.last_error = 'superseded: teardown requested'; }