@bongos/core 1.25.16 → 1.25.17

package/tests/first_read.mjs

@@ -0,0 +1,303 @@
+// tests/first_read.mjs — THE FIRST READ-THROUGH of a project that already exists (task
+// 1005280, goal 1000106).
+//
+// Done-when: an adopted project's Genesis step hands the owner a prompt for their OWN AI
+// session; that session's map comes back in a defined, validated shape; the owner
+// accepts it whole or item by item into DRAFT goals and tasks; a rejection files
+// nothing; a re-run files nothing twice; the shape has room for task 1005281's
+// recommended modules.
+//
+// Everything here RUNS: the real prompt and Genesis checklist, the real validator and
+// acceptance planner, the real store over an in-memory fake pool, and the real router
+// over a socket.
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const fr = require('../modules/lifecycle/first-read.js');
+const storeModule = require('../modules/lifecycle/first-read-db.js');
+// A snapshot of the real store: the route section below re-points the module's exports
+// at its own pool, and module-level code runs before any test does.
+const store = { ...storeModule };
+const { genesisChecklist } = require('../modules/lifecycle/kickoff-checklist.js');
+
+const clone = (o) => JSON.parse(JSON.stringify(o));
+
+// ── an in-memory pool that answers exactly the store's statements ─────────────
+
+function fakePool() {
+  const s = { maps: [], filed: new Map(), goals: [], tasks: [], nextId: 1 };
+  const query = async (sql, p = []) => {
+    const q = sql.replace(/\s+/g, ' ').trim();
+    if (/^(BEGIN|COMMIT|ROLLBACK)$/.test(q) || /pg_advisory_xact_lock/.test(q)) return { rows: [] };
+    if (/^INSERT INTO lifecycle_repo_maps/.test(q)) {
+      const row = { id: String(s.nextId++), schema: p[0], map: JSON.parse(p[1]), status: 'pending', submitted_by: p[2], submitted_at: new Date() };
+      s.maps.push(row); return { rows: [row] };
+    }
+    if (/FROM lifecycle_repo_maps ORDER BY/.test(q)) return { rows: s.maps.slice(-1) };
+    if (/^SELECT .* FROM lifecycle_repo_maps WHERE id = \$1/.test(q)) return { rows: s.maps.filter((m) => m.id === String(p[0])) };
+    if (/^SELECT ref, kind, entity_id FROM lifecycle_repo_map_filed/.test(q)) {
+      return { rows: p[0].filter((r) => s.filed.has(r)).map((r) => ({ ref: r, ...s.filed.get(r) })) };
+    }
+    if (/^INSERT INTO lifecycle_repo_map_filed .* unnest/.test(q)) {
+      s.filedWrites = (s.filedWrites || 0) + 1;
+      p[0].forEach((ref, i) => {
+        if (s.filed.has(ref)) throw Object.assign(new Error('duplicate key'), { code: '23505' });
+        s.filed.set(ref, { kind: p[1][i], entity_id: p[2][i], map_id: p[3] });
+      });
+      return { rows: [] };
+    }
+    if (/^SELECT id FROM versions/.test(q)) return { rows: [{ id: 'V1' }] };
+    if (/^UPDATE lifecycle_repo_maps SET status = 'accepted'/.test(q)) { s.maps.find((m) => m.id === String(p[0])).status = 'accepted'; return { rows: [] }; }
+    if (/^UPDATE lifecycle_repo_maps SET status = 'rejected'/.test(q)) {
+      const m = s.maps.find((x) => x.id === String(p[0]) && x.status === 'pending');
+      if (!m) return { rows: [] };
+      m.status = 'rejected'; return { rows: [{ id: m.id }] };
+    }
+    throw new Error('unexpected SQL: ' + q);
+  };
+  const pool = { query, connect: async () => ({ query, release() {} }), state: s };
+  const deps = {
+    pool,
+    createGoal: async (row, d) => { assert.ok(d && d.client, 'goals are created inside the accept transaction'); const g = { id: String(100 + s.goals.length), ...row }; s.goals.push(g); return g; },
+    createTask: async (row, d) => { assert.ok(d && d.client, 'tasks are created inside the accept transaction'); const t = { id: String(500 + s.tasks.length), ...row }; s.tasks.push(t); return t; },
+  };
+  return { pool, deps, s };
+}
+
+// ── the prompt ───────────────────────────────────────────────────────────────
+
+test('the prompt sends the owner\'s own session to read locally, map in the defined shape, and accept only with a yes', () => {
+  const p = fr.firstReadPrompt();
+  for (const must of [
+    'own AI session', 'Bongos itself never reads this repository', 'Do not upload, paste or send any source code',
+    fr.MAP_FILE, fr.SCHEMA, '"goals"', '"next"', '"why"', '"seen_at"', 'errors or mishaps',
+    'first-read check', 'first-read submit', 'first-read accept', 'first-read reject', 'Never accept on your own',
+    'not filed twice',
+  ]) assert.ok(p.includes(must), `the prompt says: ${must}`);
+  // The example it prints is itself a valid map, so a session that copies it is on the shape.
+  assert.equal(fr.validateRepoMap(fr.exampleMap()).ok, true);
+  const printed = JSON.parse(p.slice(p.indexOf('{'), p.lastIndexOf('}') + 1));
+  assert.deepEqual(printed, fr.exampleMap());
+});
+
+test('an adopted project\'s Genesis step carries the prompt; a new project\'s does not', () => {
+  const existing = genesisChecklist({ existing: true }).scope;
+  assert.equal(existing[0].ref, 'genesis:scope:existing', 'the step keeps its ref, so a seeded project is not refiled');
+  assert.ok(existing[0].description.includes(fr.firstReadPrompt()), 'the hall copy-prompt hands over the whole prompt');
+  assert.ok(/own AI/.test(existing[0].title));
+  const fresh = genesisChecklist().scope;
+  assert.ok(fresh.every((t) => !t.description.includes(fr.SCHEMA)));
+});
+
+// ── validation ───────────────────────────────────────────────────────────────
+
+test('a good map validates into a flat review list with stable refs', () => {
+  const v = fr.validateRepoMap(fr.exampleMap());
+  assert.equal(v.ok, true);
+  assert.deepEqual(v.items.map((i) => [i.type, i.ref]), [
+    ['goal', 'goal:take-payments-for-bookings'],
+    ['task', 'task:take-payments-for-bookings:finish-the-checkout-page'],
+    ['task', 'task:take-payments-for-bookings:send-a-receipt-by-email'],
+    ['next', 'next:fix-the-failing-booking-test'],
+  ]);
+  assert.ok(v.items.every((i) => i.why && i.seen_at.length));
+  assert.equal(v.items[3].goal_ref, fr.NEXT_GOAL.ref, 'a next item naming no goal lands under the fix-what-was-found goal');
+});
+
+test('a later section (recommended modules) rides along without breaking the shape', () => {
+  const raw = { ...fr.exampleMap(), recommended_modules: [{ key: 'payments', why: 'a checkout exists' }] };
+  const v = fr.validateRepoMap(raw);
+  assert.equal(v.ok, true);
+  assert.deepEqual(v.map.recommended_modules, raw.recommended_modules);
+});
+
+test('a prototype-shaped key in the map is never copied onto it', () => {
+  const raw = JSON.parse(`{"schema":"${fr.SCHEMA}","summary":"s","next":[{"title":"t","why":"w","seen_at":["a"]}],"__proto__":{"polluted":true},"constructor":{"x":1}}`);
+  const v = fr.validateRepoMap(raw);
+  assert.equal(v.ok, true);
+  assert.equal(v.map.polluted, undefined);
+  assert.equal(Object.getPrototypeOf(v.map), Object.prototype);
+  assert.ok(!Object.prototype.hasOwnProperty.call(v.map, 'constructor'));
+  assert.equal(({}).polluted, undefined);
+});
+
+test('malformed maps are refused, each error naming its field', () => {
+  const cases = [
+    [null, /JSON object/],
+    [[], /JSON object/],
+    [{ ...fr.exampleMap(), schema: 'other/1' }, /schema must be/],
+    [{ ...fr.exampleMap(), goals: 'lots' }, /goals must be a list/],
+    [{ schema: fr.SCHEMA, summary: 'x', goals: [], next: [] }, /no goals and nothing next/],
+    [(() => { const m = fr.exampleMap(); delete m.goals[0].why; return m; })(), /goals\[0\]\.why is missing/],
+    [(() => { const m = fr.exampleMap(); m.goals[0].tasks[0].seen_at = []; return m; })(), /goals\[0\]\.tasks\[0\]\.seen_at needs at least one place/],
+    [(() => { const m = fr.exampleMap(); m.goals[0].tasks[1].status = 'half'; return m; })(), /status must be one of/],
+    [(() => { const m = fr.exampleMap(); m.goals[0].tasks[1].title = m.goals[0].tasks[0].title; return m; })(), /repeats another item's title/],
+    [(() => { const m = fr.exampleMap(); m.next[0].goal = 'No such goal'; return m; })(), /not a goal in this map/],
+    [(() => { const m = fr.exampleMap(); m.next[0].kind = 'oops'; return m; })(), /kind must be one of/],
+    [(() => { const m = fr.exampleMap(); m.goals[0].why = 'x'.repeat(fr.LIMITS.WHY + 1); return m; })(), /longer than/],
+    [(() => { const m = fr.exampleMap(); m.summary = 'y'.repeat(fr.LIMITS.BYTES); return m; })(), /larger than/],
+    [(() => { const m = fr.exampleMap(); m.goals[0].title = '!!!'; return m; })(), /needs letters or numbers/],
+  ];
+  for (const [raw, re] of cases) {
+    const v = fr.validateRepoMap(raw);
+    assert.equal(v.ok, false, `refused: ${re}`);
+    assert.ok(v.errors.some((e) => re.test(e)), `${re} in ${JSON.stringify(v.errors)}`);
+  }
+});
+
+// ── the store: submit, accept, reject, re-run ────────────────────────────────
+
+test('submitting files nothing: the map waits pending', async () => {
+  const { deps, s } = fakePool();
+  const out = await store.submitMap({ raw: fr.exampleMap(), builderId: '1' }, deps);
+  assert.equal(out.ok, true);
+  assert.equal(s.maps[0].status, 'pending');
+  assert.equal(s.goals.length + s.tasks.length, 0);
+  const bad = await store.submitMap({ raw: { schema: 'nope' } }, deps);
+  assert.equal(bad.ok, false);
+  assert.equal(s.maps.length, 1, 'a malformed map is not stored');
+});
+
+test('accepting the whole map files draft goals and backlog tasks, nothing claimable', async () => {
+  const { deps, s } = fakePool();
+  const { map_id } = await store.submitMap({ raw: fr.exampleMap(), builderId: '1' }, deps);
+  const out = await store.acceptMap({ mapId: map_id, select: 'all', builderId: '1' }, deps);
+  assert.equal(out.ok, true);
+  assert.deepEqual(s.goals.map((g) => g.title), ['Take payments for bookings', fr.NEXT_GOAL.title]);
+  assert.equal(s.tasks.length, 3);
+  for (const t of s.tasks) {
+    assert.equal(t.status, 'backlog');
+    assert.equal(t.source, store.TASK_SOURCE);
+    assert.ok(t.goalId, 'every task has a goal home');
+    assert.ok(t.description.includes('Seen at:'));
+  }
+  assert.equal(s.tasks.find((t) => t.title === 'Fix the failing booking test').kind, 'bug');
+  assert.equal(s.tasks.find((t) => t.title === 'Fix the failing booking test').goalId, s.goals[1].id);
+  assert.equal(s.maps[0].status, 'accepted');
+  assert.equal(s.filedWrites, 1, 'every filed ref is remembered in one statement');
+  assert.equal(s.filed.size, 5);
+});
+
+test('accepting item by item files only what the owner chose (and the goal it needs)', async () => {
+  const { deps, s } = fakePool();
+  const { map_id } = await store.submitMap({ raw: fr.exampleMap() }, deps);
+  const out = await store.acceptMap({ mapId: map_id, select: ['task:take-payments-for-bookings:send-a-receipt-by-email'] }, deps);
+  assert.equal(out.ok, true);
+  assert.deepEqual(s.goals.map((g) => g.title), ['Take payments for bookings']);
+  assert.deepEqual(s.tasks.map((t) => t.title), ['Send a receipt by email']);
+  const unknown = await store.acceptMap({ mapId: map_id, select: ['task:nope'] }, deps);
+  assert.equal(unknown.code, 'unknown_items');
+  const none = await store.acceptMap({ mapId: map_id, select: [] }, deps);
+  assert.equal(none.code, 'nothing_selected');
+  assert.equal(s.tasks.length, 1, 'a refused accept files nothing');
+});
+
+test('a task the map says is done is shown, never filed', async () => {
+  const { deps, s } = fakePool();
+  const raw = fr.exampleMap();
+  raw.goals[0].tasks[0].status = 'done';
+  const { map_id } = await store.submitMap({ raw }, deps);
+  const out = await store.acceptMap({ mapId: map_id, select: 'all' }, deps);
+  assert.ok(out.skipped.some((x) => x.reason === 'already_done'));
+  assert.ok(!s.tasks.some((t) => t.title === 'Finish the checkout page'));
+});
+
+test('rejecting files nothing, and a rejected map cannot then be accepted', async () => {
+  const { deps, s } = fakePool();
+  const { map_id } = await store.submitMap({ raw: fr.exampleMap() }, deps);
+  assert.equal((await store.rejectMap({ mapId: map_id, builderId: '1' }, deps)).ok, true);
+  assert.equal(s.maps[0].status, 'rejected');
+  const again = await store.acceptMap({ mapId: map_id, select: 'all' }, deps);
+  assert.equal(again.code, 'map_rejected');
+  assert.equal(s.goals.length + s.tasks.length, 0);
+  assert.equal((await store.rejectMap({ mapId: map_id }, deps)).code, 'not_pending');
+  assert.equal((await store.rejectMap({ mapId: '99' }, deps)).code, 'not_found');
+});
+
+test('a re-run does not duplicate: the same items are skipped, only new ones are filed', async () => {
+  const { deps, s } = fakePool();
+  const first = await store.submitMap({ raw: fr.exampleMap() }, deps);
+  await store.acceptMap({ mapId: first.map_id, select: 'all' }, deps);
+  const goalsBefore = s.goals.length;
+  const tasksBefore = s.tasks.length;
+  // Accepting the same map again files nothing.
+  const twice = await store.acceptMap({ mapId: first.map_id, select: 'all' }, deps);
+  assert.equal(twice.filed.goals.length + twice.filed.tasks.length, 0);
+  // A second read-through names the same items (reordered, retitled in case) plus one new task.
+  const raw = clone(fr.exampleMap());
+  raw.goals[0].title = 'TAKE PAYMENTS FOR BOOKINGS';
+  raw.goals[0].tasks.reverse();
+  raw.goals[0].tasks.push({ title: 'Refund a booking', status: 'not_started', why: 'No refund path exists.', seen_at: ['src/payments/'] });
+  const second = await store.submitMap({ raw }, deps);
+  const review = await store.reviewMap('latest', deps);
+  assert.equal(review.map_id, second.map_id);
+  assert.equal(review.items.filter((i) => i.filed).length, 4, 'the review marks what is already in Bongos');
+  const out = await store.acceptMap({ mapId: second.map_id, select: 'all' }, deps);
+  assert.equal(s.goals.length, goalsBefore, 'no goal filed twice');
+  assert.equal(s.tasks.length, tasksBefore + 1);
+  assert.deepEqual(out.filed.tasks.map((t) => t.title), ['Refund a booking']);
+  assert.equal(out.filed.tasks[0].goal_id, s.goals[0].id, 'the new task joins the goal filed by the first run');
+  assert.equal(out.skipped.filter((x) => x.reason === 'already_filed').length, 4);
+});
+
+// ── the routes, over a real socket ───────────────────────────────────────────
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const perms = [];
+api.requireBuilder = (req, _res, next) => { req.builder = { id: '7', rank: 'archon' }; next(); };
+api.requirePermission = (...p) => { perms.push(p.join(',')); return (_req, _res, next) => next(); };
+api.requireActAlone = (area) => { perms.push('act-alone:' + area); return (_req, _res, next) => next(); };
+
+const route = fakePool();
+for (const fn of ['submitMap', 'reviewMap', 'acceptMap', 'rejectMap']) {
+  storeModule[fn] = (a) => store[fn](a, route.deps);
+}
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, status, details) => res.status(status || 400).json({ error: code, ...(details || {}) });
+  next();
+});
+app.use('/api/bongos', require('../modules/lifecycle/routes/first-read.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+after(() => server.close());
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+const call = async (method, p, body) => {
+  const r = await fetch(base + p, { method, headers: { 'content-type': 'application/json' }, body: body ? JSON.stringify(body) : undefined });
+  return { status: r.status, body: await r.json().catch(() => null) };
+};
+
+test('the routes: filing is gated like creating a goal, and the flow runs end to end', async () => {
+  assert.ok(perms.includes('goal.create'));
+  assert.ok(perms.includes('act-alone:planning'));
+  const prompt = await call('GET', '/first-read/prompt');
+  assert.equal(prompt.status, 200);
+  assert.equal(prompt.body.prompt, fr.firstReadPrompt());
+
+  const bad = await call('POST', '/first-read/maps', { map: { schema: fr.SCHEMA, summary: 'x', goals: [{ title: 'A' }] } });
+  assert.equal(bad.status, 400);
+  assert.equal(bad.body.error, 'invalid_map');
+  assert.ok(bad.body.errors.length >= 2);
+
+  const ok = await call('POST', '/first-read/maps', { map: fr.exampleMap() });
+  assert.equal(ok.status, 201);
+  assert.equal(route.s.tasks.length, 0, 'submit files nothing');
+
+  const bogus = await call('POST', `/first-read/maps/${ok.body.map_id}/accept`, { items: ['x'], all: true });
+  assert.equal(bogus.status, 400);
+  const accepted = await call('POST', `/first-read/maps/${ok.body.map_id}/accept`, { items: ['goal:take-payments-for-bookings'] });
+  assert.equal(accepted.status, 200);
+  assert.equal(accepted.body.filed.goals.length, 1);
+  assert.equal(accepted.body.filed.tasks.length, 0);
+
+  const shown = await call('GET', '/first-read/maps/latest');
+  assert.equal(shown.status, 200);
+  assert.equal(shown.body.items.find((i) => i.ref === 'goal:take-payments-for-bookings').filed.kind, 'goal');
+  assert.equal((await call('GET', '/first-read/maps/999')).status, 404);
+  assert.equal((await call('POST', `/first-read/maps/${ok.body.map_id}/reject`)).status, 409, 'an accepted map is not then rejected');
+});

package/tests/government_act_alone_buildings.mjs

@@ -216,6 +216,7 @@ for (const rel of [
   'modules/lifecycle/routes/goals.js',
   'modules/lifecycle/routes/versions.js',
   'modules/lifecycle/routes/project-settings.js',
+  'modules/lifecycle/routes/first-read.js',
   'modules/render-deploy/routes/act.js',
   'modules/npm-release/routes/release.js',
   'modules/provisioning/routes/core-upgrade.js',
@@ -262,6 +263,7 @@ const REQUESTS = {
   'POST /goals/reorder': ['POST', '/goals/reorder', {}],
   'POST /work-categories': ['POST', '/work-categories', {}],
   'PUT /versions/focus': ['PUT', '/versions/focus', { version_id: '   ' }],
+  'POST /first-read/maps/:id/accept': ['POST', `/first-read/maps/${BAD}/accept`, { all: true }], // task 1005280
   'POST /autonomy/fence': ['POST', '/autonomy/fence', { enabled: 'yes' }],
   'POST /autonomy/fence/goals': ['POST', '/autonomy/fence/goals', { goal_id: 0 }],
   'DELETE /autonomy/fence/goals/:goalId': ['DELETE', `/autonomy/fence/goals/${BAD}`],

package/tests/provisioning_app_status.mjs

@@ -193,6 +193,7 @@ await ta('it knocks only on an onrender.com address, and follows no redirect', a
 await ta('a sweep marks only answering apps live, compare-and-set on the state it read', async () => {
   const writes = [];
   const db = { query: async (sql, params) => {
+    if (/app_host->'sandbox'/.test(sql)) return { rows: [] }; // the sandbox read (task 1005289)
     if (/^\s*SELECT/.test(sql)) {
       assert.match(sql, /app_host->>'state' IN \('deploying', 'linked'\)/);
       return { rows: [
@@ -213,7 +214,7 @@ await ta('a sweep marks only answering apps live, compare-and-set on the state i
 await ta('the knocks run a few at a time, never all at once and never one by one', async () => {
   let inFlight = 0, peak = 0;
   const rows = Array.from({ length: 12 }, (_, i) => ({ id: i + 1, slug: `a${i}`, app_host: { state: 'deploying', serviceUrl: `https://a${i}.onrender.com` } }));
-  const db = { query: async (sql) => (/^\s*SELECT/.test(sql) ? { rows } : { rowCount: 1 }) };
+  const db = { query: async (sql) => (/app_host->'sandbox'/.test(sql) ? { rows: [] } : /^\s*SELECT/.test(sql) ? { rows } : { rowCount: 1 }) };
   const fetchImpl = async () => { inFlight++; peak = Math.max(peak, inFlight); await new Promise((r) => setTimeout(r, 5)); inFlight--; return res(200); };
   const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
   assert.deepEqual(out, { checked: 12, live: 12 });
@@ -233,7 +234,7 @@ await ta('a run that starts while the previous sweep is in flight is skipped (ta
   const [firstOut, second] = await Promise.all([first, secondRun]);
   assert.deepEqual(second, { skipped: true });
   assert.deepEqual(firstOut, { checked: 0, live: 0 });
-  assert.equal(reads, 1, 'the overlapping run never touched the database');
+  assert.equal(reads, 2, 'the overlapping run never touched the database (the one run read the apps, then the sandboxes)');
   assert.deepEqual(await liveness.tick({ pool: { query: async () => ({ rows: [] }) }, log: () => {} }), { checked: 0, live: 0 },
     'once the first finished, the next run goes ahead');
 });

package/tests/provisioning_render_route.mjs

@@ -95,7 +95,7 @@ await ta('the owner queues it: ciphertext only, the request recorded on the row,
   assert.equal(r.status, 200, r.raw);
   assert.equal(enqueueCalls.length, 1);
   assert.equal(enqueueCalls[0].keyEnc, `v1.sealed(${KEY.length})`);
-  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null,
+  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null, sandboxWanted: true,
     runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', database: true, webPlan: 'standard' });
   assert.equal(events.length, 1);
   noKeyAnywhere(enqueueCalls, events, r.body);

package/tests/provisioning_teardown_intent.mjs

@@ -256,6 +256,56 @@ await ta('a mid-flight provision is a 409 conflict — never the false "teardown
   assert.doesNotMatch(String(res.body.error.message), /already queued/i, 'the old lie is gone');
 });
 
+// The owner's Render key on a teardown removes the project's sandbox (task 1005289, ADR 0406 §7).
+const renderSandbox = require('../modules/provisioning/render-sandbox.js');
+const secretBox = require('../src/bongos/secret-box.js');
+let lentCalls = [];
+renderSandbox.lendKeyToTeardown = async (_db, intentId, keyEnc) => { lentCalls.push({ intentId, keyEnc }); return true; };
+function postWithKey(path, key) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': 2, 'x-render-key': key } }, (res) => {
+      let d = ''; res.on('data', (c) => { d += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d), raw: d }));
+    });
+    req.on('error', reject);
+    req.end('{}');
+  });
+}
+const RKEY = 'rnd_abcdefghijklmnopqrstuvwx';
+console.log('\nPOST /provisioning/instances/:id/teardown — the Render key for the sandbox:');
+await ta('a well-formed key is sealed and lent to the teardown just queued, never echoed', async () => {
+  const realConf = secretBox.isConfigured, realEnc = secretBox.encrypt;
+  secretBox.isConfigured = () => true; secretBox.encrypt = (p) => `v1.sealed(${p.length})`;
+  try {
+    lentCalls = [];
+    teardownOutcome = { intent: { id: 31, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    const res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.sandbox_key_lent, true);
+    assert.deepEqual(lentCalls, [{ intentId: 31, keyEnc: `v1.sealed(${RKEY.length})` }], 'ciphertext only, on THIS teardown');
+    assert.ok(!res.raw.includes(RKEY), 'the key is never sent back');
+  } finally { secretBox.isConfigured = realConf; secretBox.encrypt = realEnc; }
+});
+await ta('a malformed key, an already-queued teardown, or no safe seal: nothing lent, the teardown still answers', async () => {
+  const realConf = secretBox.isConfigured, realEnc = secretBox.encrypt;
+  secretBox.encrypt = (p) => `v1.sealed(${p.length})`;
+  try {
+    secretBox.isConfigured = () => true;
+    lentCalls = [];
+    teardownOutcome = { intent: { id: 32, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    let res = await postWithKey('/provisioning/instances/16/teardown', 'not-a-key');
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false);
+    teardownOutcome = { intent: { id: 32, action: 'teardown', state: 'pending' }, created: false, superseded: false };
+    res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false, 'not on a teardown queued earlier');
+    secretBox.isConfigured = () => false;
+    teardownOutcome = { intent: { id: 33, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false, 'never stored unsealed');
+    assert.equal(lentCalls.length, 0);
+  } finally { secretBox.isConfigured = realConf; secretBox.encrypt = realEnc; }
+});
+
 console.log('\nPOST /provisioning/instances/:id/force-teardown — same truthful mapping (archon):');
 
 await ta('force-teardown surfaces the same 409 conflict instead of a false success', async () => {

package/tests/render_api.mjs

@@ -127,10 +127,13 @@ await ta('listOwners returns every workspace the key reaches, unwrapped', async
 });
 
 console.log('\nno delete:');
-await ta('there is no delete method, and the verb is refused', async () => {
+await ta('there is no delete method but the sandbox one, and the verb is refused', async () => {
   const { api, calls } = live({});
   const methods = Object.getOwnPropertyNames(RenderApi.prototype);
-  assert.ok(!methods.some((m) => /delete|destroy|remove|suspend/i.test(m)), `no destructive method: ${methods.join(', ')}`);
+  // ADR 0406 §7 / task 1005289: the ONE destructive method removes a free `…-sandbox`
+  // service the platform made (tests/render_sandbox.mjs proves it refuses anything else).
+  const destructive = methods.filter((m) => /delete|destroy|remove|suspend/i.test(m));
+  assert.deepEqual(destructive, ['deleteSandboxService'], `no other destructive method: ${methods.join(', ')}`);
   await assert.rejects(api._req('DELETE', '/services/srv-1'), /never deletes/);
   assert.equal(calls.length, 0);
 });