@bongos/core 1.21.124 → 1.21.126

package/modules/onboarding/howto-guide.js

@@ -0,0 +1,259 @@
+// modules/onboarding/howto-guide.js — the in-session how-to guide: ~25 short steps an AI walks a person through (task 1004627)
+//
+// WHY. The owner opened Bongos on their own project and did not know where to begin:
+// nothing told them `/builder-start` exists, what a goal is for, or what happens on a
+// first ship. This guide is the CONTENT an AI assistant walks a person through inside
+// their own session, one short step at a time, at the moment it is useful — so someone
+// who has never heard of a Bongos command is never lost.
+//
+// It is the single source of truth for the three tasks that build on it:
+//   • task 1004634 stores each person's read/unread state per step id;
+//   • task 1004635 shows the right unread step when its moment arrives, then marks it read;
+//   • task 1004636 lets a person reopen the guide, see progress, or skip it.
+// So the step ids are STABLE: a stored "read" mark names one. Never rename or reuse an
+// id — retire a step by deleting it and add a new id for new content
+// (tests/howto_guide.mjs pins the shape and the plain-language rule).
+//
+// Each step is: what the feature is FOR (`what`), WHEN to reach for it (`when`), and the
+// exact words or command to TRY (`try`). Plain language throughout — the reader may not
+// be technical; the test bans the accessibility scorer's jargon list. Commands are the
+// ones an instance actually gets (core skills + `npx bongos` verbs); a step names a
+// slash command AND the plain words that reach it, because typed-only commands do not
+// answer to plain words.
+//
+// Read it in a terminal: `node modules/onboarding/howto-guide.js` (add `--moment <id>`).
+
+'use strict';
+
+// The moments, in the order a new project meets them. `trigger` says, for task 1004635,
+// what event opens the moment; it is descriptive here, not wiring.
+const MOMENTS = Object.freeze([
+  { id: 'first_open', title: 'Opening the project for the first time', trigger: 'the first prompt of the first session in a project folder' },
+  { id: 'setup', title: 'Setting up the project', trigger: 'the project has no goal yet, or setup is unfinished' },
+  { id: 'goal', title: 'Creating a goal', trigger: 'the person asks to plan work, or the project has no open goal' },
+  { id: 'task', title: 'Creating a task', trigger: 'the person describes a change they want, or a goal has no tasks' },
+  { id: 'find_work', title: 'Finding work', trigger: 'the person asks what to do next, or starts a session with nothing claimed' },
+  { id: 'first_claim', title: 'Claiming your first task', trigger: 'the person claims a task for the first time' },
+  { id: 'first_ship', title: 'Your first ship', trigger: 'the person finishes the work on their first claimed task' },
+  { id: 'after_ship', title: 'After a ship', trigger: 'a task reaches shipped for the first time' },
+  { id: 'invite', title: 'Inviting people', trigger: 'the person mentions a teammate, or asks how others can help' },
+  { id: 'settings', title: 'Settings', trigger: 'the person asks to change how Bongos behaves for them or the project' },
+  { id: 'stuck', title: 'When something goes wrong', trigger: 'a command fails, or the person says they are stuck or confused' },
+]);
+
+const STEPS = Object.freeze([
+  // first_open
+  {
+    id: 'welcome', moment: 'first_open', title: 'What Bongos is',
+    what: 'Bongos keeps the list of everything your project needs, and the AI does the building. You decide what gets made; the AI does the work and records it.',
+    when: 'The first time you open this project with an AI assistant.',
+    try: 'Ask: "What is Bongos and what can it do for me?"',
+  },
+  {
+    id: 'where_to_start', moment: 'first_open', title: 'Where to start',
+    what: 'There are three ways in: finish setting up the project, make a goal (a bigger outcome you want), or make a task (one piece of work).',
+    when: 'Any time you are not sure what to do first.',
+    try: 'Say: "Where should I start?" The AI will look at the project and suggest one of the three.',
+  },
+  {
+    id: 'ask_in_plain_words', moment: 'first_open', title: 'Just ask in plain words',
+    what: 'You never need to memorise commands. Describe what you want and the AI picks the right one, then tells you which it used.',
+    when: 'Whenever you want something done and do not know the command.',
+    try: 'Say: "I want to add a contact form to the website."',
+  },
+  {
+    id: 'the_hall', moment: 'first_open', title: 'The hall: your project in a browser',
+    what: 'The hall is your project\'s web page. It shows goals, tasks, who is working on what, and what has shipped.',
+    when: 'When you want to see everything at a glance instead of asking.',
+    try: 'Ask: "Open the hall for this project" or "What is the hall link?"',
+  },
+  // setup
+  {
+    id: 'sign_in', moment: 'setup', title: 'Sign in once',
+    what: 'Signing in links this computer to your project, so the AI can claim and ship work in your name.',
+    when: 'The first time on a new computer, or when the AI says your sign-in has expired.',
+    try: 'Type /builder-setup, or in a terminal run `npx bongos login`.',
+  },
+  {
+    id: 'check_setup', moment: 'setup', title: 'Check everything is ready',
+    what: 'A quick health check of this computer and your sign-in, with a plain fix for anything missing.',
+    when: 'Before your first task, or when something that used to work stops working.',
+    try: 'Say: "Check my setup", or run `npx bongos doctor`.',
+  },
+  {
+    id: 'project_status', moment: 'setup', title: 'See where the project stands',
+    what: 'A summary of the current version: what is done, what is left, and what is blocking.',
+    when: 'At the start of a working session, or before planning.',
+    try: 'Type /status, or say "How far along is the project?"',
+  },
+  // goal
+  {
+    id: 'what_is_a_goal', moment: 'goal', title: 'What a goal is',
+    what: 'A goal is a bigger outcome, like "people can sign up" — a home for the tasks that get you there, with a clear "done when".',
+    when: 'When what you want is too big to finish in one sitting.',
+    try: 'Ask: "Should this be a goal or a single task?"',
+  },
+  {
+    id: 'create_goal', moment: 'goal', title: 'Create a goal',
+    what: 'The AI asks what the goal is for and what "done" looks like, then writes it up with its first few tasks.',
+    when: 'When you have decided on a new outcome to work towards.',
+    try: 'Type /goal-create, or say "Make a goal for letting people sign up."',
+  },
+  // task
+  {
+    id: 'what_is_a_task', moment: 'task', title: 'What a task is',
+    what: 'A task is one piece of work small enough to finish and check in one go. Every change to the project belongs to a task, so there is always a record of it.',
+    when: 'Whenever you want something changed.',
+    try: 'Ask: "What makes a good task?"',
+  },
+  {
+    id: 'create_task', moment: 'task', title: 'Create a task',
+    what: 'Describe the change and how you will know it is done. The AI writes it up and files it under the right goal.',
+    when: 'When you know a specific change you want.',
+    try: 'Say: "Make a task: the contact form should email me each message."',
+  },
+  {
+    id: 'capture_an_idea', moment: 'task', title: 'Save an idea for later',
+    what: 'Not ready to commit to it? Save it as an idea. Ideas wait in a list until you decide to turn them into tasks or drop them.',
+    when: 'When a thought comes up in the middle of other work.',
+    try: 'Say: "Save an idea: a dark mode for the website."',
+  },
+  // find_work
+  {
+    id: 'whats_claimable', moment: 'find_work', title: 'See what you can work on',
+    what: 'A list of the tasks that are ready right now and safe to start without clashing with anyone else\'s work.',
+    when: 'At the start of a session, or when you finish a task.',
+    try: 'Type /builder-start, or say "What can I work on?"',
+  },
+  {
+    id: 'work_a_goal', moment: 'find_work', title: 'Work through a whole goal',
+    what: 'The AI takes the goal\'s tasks one at a time — start, build, ship, next — and stops to ask you only when it needs a decision.',
+    when: 'When a goal has several tasks that follow on from each other.',
+    try: 'Say: "Work through goal 12 end to end", or type /builder-sequence.',
+  },
+  // first_claim
+  {
+    id: 'claim_a_task', moment: 'first_claim', title: 'Claiming a task',
+    what: 'Claiming says "I am on this one", so nobody else starts the same work. The AI then works on it in its own separate copy of the project, so your main folder stays tidy.',
+    when: 'When you pick a task to work on.',
+    try: 'Type /builder-claim followed by the task number, or say "Claim task 42."',
+  },
+  {
+    id: 'give_a_task_back', moment: 'first_claim', title: 'Give a task back',
+    what: 'Changed your mind? Giving it back makes the task available again. Nothing is lost and nothing is charged.',
+    when: 'When you will not finish a task you claimed.',
+    try: 'Type /builder-release, or say "Give this task back."',
+  },
+  {
+    id: 'preview_before_ship', moment: 'first_claim', title: 'See a change before it ships',
+    what: 'For changes you can see, the AI can show you the page as it will look, before anything goes live.',
+    when: 'When the task changes something on screen.',
+    try: 'Say: "Let me see it before you ship", or type /builder-stage.',
+  },
+  // first_ship
+  {
+    id: 'what_ship_does', moment: 'first_ship', title: 'What shipping does',
+    what: 'Shipping finishes a task: automatic reviewers check the work, then it is added to the project. Going live for your users can wait for a person to say yes.',
+    when: 'When the work on your task is finished.',
+    try: 'Type /builder-ship, or say "Ship it."',
+  },
+  {
+    id: 'review_findings', moment: 'first_ship', title: 'When the reviewers ask for fixes',
+    what: 'If the reviewers find a problem, the task is held, not lost. The AI fixes what they listed and asks for another review.',
+    when: 'When a ship says it needs fixes.',
+    try: 'Say: "Fix what the reviewers found and try again."',
+  },
+  // after_ship
+  {
+    id: 'what_happens_after', moment: 'after_ship', title: 'What happens after a ship',
+    what: 'The task is marked shipped, anything that was waiting on it becomes ready, and the record of the work is kept for the next person.',
+    when: 'Right after your first task ships.',
+    try: 'Ask: "What did that ship unlock?"',
+  },
+  {
+    id: 'fresh_session', moment: 'after_ship', title: 'Start fresh after a few tasks',
+    what: 'A long conversation gets slower and costlier. After a few tasks, the AI can write a short note so a fresh conversation picks up exactly where you left off.',
+    when: 'After three or so tasks in one conversation.',
+    try: 'Say: "Hand this off to a fresh session", or type /session-handoff.',
+  },
+  // invite
+  {
+    id: 'invite_people', moment: 'invite', title: 'Invite people',
+    what: 'Bring someone onto the project by their GitHub name. You choose whether anyone can join, people must ask first, or only invited people can sign in.',
+    when: 'When you want someone else to help build.',
+    try: 'In the hall, use "Invite someone" and enter their GitHub name, or ask "How do I invite someone?"',
+  },
+  {
+    id: 'ask_for_help', moment: 'invite', title: 'Ask a teammate for help',
+    what: 'Send a named person, or anyone with the right skills, a request for help on a task. It shows up in their own list.',
+    when: 'When you are stuck on a task and someone else knows the area.',
+    try: 'Say: "Ask Sam to help with task 42", or type /ask-for-help.',
+  },
+  // settings
+  {
+    id: 'ship_mode', moment: 'settings', title: 'Ship mode: who starts a ship',
+    what: 'In Auto, the AI ships a finished task by itself. In Manual, it stops and waits for you to say "ship it".',
+    when: 'When you want more, or less, control over when work is added to the project.',
+    try: 'In the hall\'s project settings pick Auto or Manual, or run `npx bongos ship-mode` to see the current one.',
+  },
+  {
+    id: 'how_the_ai_talks', moment: 'settings', title: 'How the AI talks to you',
+    what: 'Tell Bongos how technical you are and how long you like answers. Every AI session on this project follows it.',
+    when: 'When answers feel too technical, too long, or too short.',
+    try: 'Open your settings in the hall and look for how the AI talks to you, or say "Keep your answers shorter."',
+  },
+  // stuck
+  {
+    id: 'when_stuck', moment: 'stuck', title: 'When something goes wrong',
+    what: 'Every refusal comes with a plain explanation: what happened, what the AI will do, and whether it needs you. Most fix themselves.',
+    when: 'When a command fails or you do not understand what happened.',
+    try: 'Say: "Explain that in plain words and fix it."',
+  },
+  {
+    id: 'tell_the_bongos_team', moment: 'stuck', title: 'Tell the Bongos team',
+    what: 'If Bongos itself gets in your way, say so. Your words go to the people who build Bongos, and each complaint becomes a fix.',
+    when: 'Whenever Bongos is confusing, slow, or broken.',
+    try: 'Say: "Bongos feedback: …" followed by what went wrong.',
+  },
+]);
+
+const MOMENT_IDS = new Set(MOMENTS.map((m) => m.id));
+
+function stepById(id) { return STEPS.find((s) => s.id === id) || null; }
+
+// The steps for one moment, in guide order. Unknown moment → [].
+function stepsForMoment(momentId) { return STEPS.filter((s) => s.moment === momentId); }
+
+// The first step not in `readIds` (an iterable of step ids), in guide order — what
+// "continue the tutorial" means. null when everything is read.
+function nextUnread(readIds) {
+  const read = new Set(readIds || []);
+  return STEPS.find((s) => !read.has(s.id)) || null;
+}
+
+function formatStep(step) {
+  return [`${step.title}  [${step.id}]`, `  What it is for: ${step.what}`, `  When: ${step.when}`, `  Try: ${step.try}`].join('\n');
+}
+
+function formatGuide({ moment = null } = {}) {
+  const out = [];
+  for (const m of MOMENTS) {
+    if (moment && m.id !== moment) continue;
+    out.push(`## ${m.title}`);
+    for (const s of stepsForMoment(m.id)) out.push(formatStep(s), '');
+  }
+  return out.join('\n').trimEnd() + '\n';
+}
+
+if (require.main === module) {
+  const i = process.argv.indexOf('--moment');
+  const moment = i > -1 ? process.argv[i + 1] : null;
+  if (moment && !MOMENT_IDS.has(moment)) {
+    process.stderr.write(`unknown moment "${moment}" — one of: ${[...MOMENT_IDS].join(', ')}\n`);
+    process.exitCode = 2;
+  } else {
+    process.stdout.write(formatGuide({ moment }));
+  }
+}
+
+module.exports = { MOMENTS, STEPS, MOMENT_IDS, stepById, stepsForMoment, nextUnread, formatStep, formatGuide };

package/modules/platform-identity/invite-authz.js

@@ -18,7 +18,7 @@
 // .owner_github_id` and `platform_identity_projects.owner_github_id` are ATTRIBUTION, not
 // authority — their own migration says so and ADR 0238 restates it. The authority is
 // `provisioning_instances.owner_builder_id`, the fact the manage view already trusts and
-// `instanceAccessDenied` already enforces. This module may not import provisioning (ADR 0083's
+// `requireProjectOwner` already enforces. This module may not import provisioning (ADR 0083's
 // one-way rule), so the fact travels on the kernel port `provisioning.projectOwnedBy` —
 // resolveOptional and NOT declared in `consumes` (the `provisioning.projectPlanets`
 // precedent): provisioning is default-off, and a hub running without it simply has no

package/modules/provisioning/catalog-bridge.js

@@ -12,7 +12,7 @@
 // re-pointed address), which is the property a once-at-standup write can never have.
 //
 // IT GRANTS NOTHING. The catalog row is attribution (ADR 0238): ownership stays
-// `provisioning_instances.owner_builder_id`, which is what `instanceAccessDenied` already
+// `provisioning_instances.owner_builder_id`, which is what `requireProjectOwner` already
 // enforces on every route that calls this. The projection carries the owner's github id only
 // so the hub can attribute the row and claim-check its own writes.
 'use strict';

package/modules/provisioning/provisioning.js

@@ -1402,7 +1402,7 @@ async function instanceStateForSlug(db, slug) {
 // control-plane project a hub catalog row names? Lets a hub surface own-scope a project it
 // did not create — without importing this module (ADR 0083) and without promoting the hub's
 // own `owner_github_id` columns, which are attribution and never authority (ADR 0238). The
-// fact returned is the one `instanceAccessDenied` already enforces on every owner-facing
+// fact returned is the one `requireProjectOwner` already enforces on every owner-facing
 // route here: `provisioning_instances.owner_builder_id`.
 //
 // BOTH HALVES OF THE PROJECTION MUST AGREE, which is why this takes a slug AND a host rather

package/modules/provisioning/route-helpers.js

@@ -0,0 +1,50 @@
+// modules/provisioning/route-helpers.js — the one owner-or-archon gate every own-scoped
+// /provisioning/instances/:id route mounts (task 1004159, ADR 0328 decision 2). It replaced
+// three hand-written copies of the same rule, and the three routes that had only the owner
+// half of it (teardown, domain, github-app).
+'use strict';
+
+const api = require('../../src/module-api');
+const { failFrom } = require('./public-refusal');
+
+const log = api.logger('provisioning');
+
+function isProjectOwner(inst, builder) {
+  return String(inst.owner_builder_id) === String(builder.id);
+}
+
+// The audit actor for a request the gate admitted: the owner acts as themselves, and an
+// archon on someone else's project is named, so the override never reads as the owner's act.
+function projectActor(req) {
+  return isProjectOwner(req.project, req.builder) ? 'api:self' : `api:archon:${req.builder.id}`;
+}
+
+// requireProjectOwner(loadFn, { archonOverride }) — mounted after requireBuilder, and spelled
+// in the route's own middleware list so route-rank-check.js can see it (ADR 0328 §4). Loads
+// the row with the caller's loader (`loadFn(id)`) and admits its owner or, by default, an
+// archon. That is a plain RANK test on purpose: `provisioning.fleet.manage` floors at metic
+// (ADR 0157), so gating on it would widen every route it guards.
+//
+// A missing row and someone else's row are the same 404, and the gate runs before the
+// handler's body validator, so a stranger cannot tell a real id from a malformed request.
+// The loaded row rides on `req.project`.
+function requireProjectOwner(loadFn, { archonOverride = true } = {}) {
+  return async function projectOwnerGate(req, res, next) {
+    const id = api.parseId(req, res); // sends 400 bad_id + returns null on failure
+    if (!id) return;
+    let inst;
+    try {
+      inst = await loadFn(id);
+    } catch (err) {
+      log.error(`[provisioning] ${req.method} ${req.path} — project load`, err);
+      return failFrom(res, err, 'instance_read_failed');
+    }
+    const admitted = !!inst
+      && (isProjectOwner(inst, req.builder) || (archonOverride && req.builder.rank === 'archon'));
+    if (!admitted) return res.fail('instance_not_found', 404);
+    req.project = inst;
+    return next();
+  };
+}
+
+module.exports = { requireProjectOwner, projectActor, isProjectOwner };

package/modules/provisioning/routes/disconnect.js

@@ -12,8 +12,10 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const disconnect = require('../disconnect');
 const { failFrom } = require('../public-refusal');
+const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');
 
 const log = api.logger('provisioning');
+const loadInstance = (id) => provisioning.getInstanceById(pool, id);
 
 module.exports = function buildDisconnectRouter() {
   const router = express.Router();
@@ -24,19 +26,18 @@ module.exports = function buildDisconnectRouter() {
   // this erases a database, so a replayed or scripted request must carry the same proof
   // the button does. No status gate — any state may be disconnected; the queue refuses
   // while another run is open (disconnect.enqueueDisconnect).
-  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/disconnect', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     if (validateOrRespond(req, res, { confirm_slug: { required: true, type: 'string', maxLength: 40 } })) return;
     try {
-      const inst = await provisioning.getInstanceById(pool, id);
-      const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
-      if (!inst || (!isOwner && req.builder.rank !== 'archon')) return res.fail('instance_not_found', 404);
+      const inst = req.project;
+      const isOwner = isProjectOwner(inst, req.builder);
       if (String(req.body.confirm_slug).trim().toLowerCase() !== inst.slug) {
         return res.fail('confirm_mismatch', { status: 400,
           message: `Type the project's name exactly — ${inst.slug} — to disconnect it. Nothing was changed.` });
       }
-      const actor = isOwner ? 'api:self' : `api:archon:${req.builder.id}`;
+      const actor = projectActor(req);
       const r = await disconnect.enqueueDisconnect(pool, id, actor);
       if (r.conflict) {
         return res.fail('intent_conflict', { status: 409,

package/modules/provisioning/routes/env-manifest.js

@@ -21,26 +21,14 @@
 
 const express = require('express');
 const api = require('../../../src/module-api');
-const { pool, validateOrRespond, parseId } = api;
+const { pool, validateOrRespond } = api;
 const provisioning = require('../provisioning');
 const envManifest = require('../env-manifest');
 const { failFrom } = require('../public-refusal');
+const { requireProjectOwner } = require('../route-helpers');
 
 const log = api.logger('provisioning');
-
-// Resolve the project and decide whether this caller may see it. Returns the instance, or
-// null having already sent the 404 — the same own-or-archon rule as ./disconnect.js.
-async function resolveOwnInstance(req, res) {
-  const id = parseId(req, res); // sends 400 bad_id + returns null on failure
-  if (!id) return null;
-  const inst = await provisioning.getInstanceById(pool, id);
-  const isOwner = !!inst && String(inst.owner_builder_id) === String(req.builder.id);
-  if (!inst || (!isOwner && req.builder.rank !== 'archon')) {
-    res.fail('instance_not_found', 404);
-    return null;
-  }
-  return inst;
-}
+const loadInstance = (id) => provisioning.getInstanceById(pool, id);
 
 // The `:varId` path segment. parseId reads `:id`, which is the PROJECT here, so the
 // declaration's id is parsed separately. A non-numeric id is a 400 naming the field
@@ -103,10 +91,9 @@ module.exports = function buildEnvManifestRouter() {
 
   // GET — the declared surface. This is the route a BUILDER SESSION reads to learn which
   // variables a project has, which is the whole reason the manifest exists.
-  router.get('/provisioning/instances/:id/env-manifest', api.requireBuilder, async (req, res) => {
+  router.get('/provisioning/instances/:id/env-manifest', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const vars = await envManifest.listEnvVars(pool, inst.id);
       res.json({
         instance: { id: String(inst.id), slug: inst.slug, hosting_shape: inst.hosting_shape },
@@ -126,7 +113,7 @@ module.exports = function buildEnvManifestRouter() {
 
   // POST — declare a variable, or re-declare one that exists (an edit, not a duplicate:
   // see ../env-manifest.js's declareEnvVar).
-  router.post('/provisioning/instances/:id/env-manifest', api.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances/:id/env-manifest', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     if (refusesValue(req, res)) return;   // before the strict validator — see refusesValue
     if (validateOrRespond(req, res, {
       name: { required: true, type: 'string', maxLength: envManifest.ENV_NAME_MAX },
@@ -135,8 +122,7 @@ module.exports = function buildEnvManifestRouter() {
       required: { type: 'boolean' },
     })) return;
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       if (badDeclaration(req, res, { nameRequired: true })) return;
       const { row, created } = await envManifest.declareEnvVar(pool, {
         instanceId: inst.id,
@@ -154,7 +140,7 @@ module.exports = function buildEnvManifestRouter() {
 
   // PATCH — edit one declaration. Merge-patch: an omitted field is left alone, so the
   // hall can fix a description without restating the environments.
-  router.patch('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, async (req, res) => {
+  router.patch('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     if (refusesValue(req, res)) return;   // before the strict validator — see refusesValue
     if (validateOrRespond(req, res, {
       name: { type: 'string', maxLength: envManifest.ENV_NAME_MAX },
@@ -163,8 +149,7 @@ module.exports = function buildEnvManifestRouter() {
       required: { type: 'boolean' },
     })) return;
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const varId = parseVarId(req, res);
       if (!varId) return;
       if (badDeclaration(req, res, { nameRequired: false })) return;
@@ -182,10 +167,9 @@ module.exports = function buildEnvManifestRouter() {
   // DELETE — remove one declaration. Nothing outside this table is affected: the value,
   // wherever it lives, is untouched, and the response says so rather than letting an
   // owner believe removing the name removed the secret.
-  router.delete('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, async (req, res) => {
+  router.delete('/provisioning/instances/:id/env-manifest/:varId', api.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
     try {
-      const inst = await resolveOwnInstance(req, res);
-      if (!inst) return;
+      const inst = req.project;
       const varId = parseVarId(req, res);
       if (!varId) return;
       const removed = await envManifest.removeEnvVar(pool, inst.id, varId);