@bongos/core 1.25.16 → 1.25.18

package/tests/provisioning_render_route.mjs

@@ -95,7 +95,7 @@ await ta('the owner queues it: ciphertext only, the request recorded on the row,
   assert.equal(r.status, 200, r.raw);
   assert.equal(enqueueCalls.length, 1);
   assert.equal(enqueueCalls[0].keyEnc, `v1.sealed(${KEY.length})`);
-  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null,
+  assert.deepEqual(enqueueCalls[0].appHost, { platform: 'render', mode: 'greenfield', ownerId: 'tea-abcdefgh1234', state: 'requested', error: null, sandboxWanted: true,
     runtime: 'node', startCommand: 'npm start', buildCommand: 'npm ci', database: true, webPlan: 'standard' });
   assert.equal(events.length, 1);
   noKeyAnywhere(enqueueCalls, events, r.body);

package/tests/provisioning_teardown_intent.mjs

@@ -256,6 +256,56 @@ await ta('a mid-flight provision is a 409 conflict — never the false "teardown
   assert.doesNotMatch(String(res.body.error.message), /already queued/i, 'the old lie is gone');
 });
 
+// The owner's Render key on a teardown removes the project's sandbox (task 1005289, ADR 0406 §7).
+const renderSandbox = require('../modules/provisioning/render-sandbox.js');
+const secretBox = require('../src/bongos/secret-box.js');
+let lentCalls = [];
+renderSandbox.lendKeyToTeardown = async (_db, intentId, keyEnc) => { lentCalls.push({ intentId, keyEnc }); return true; };
+function postWithKey(path, key) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': 2, 'x-render-key': key } }, (res) => {
+      let d = ''; res.on('data', (c) => { d += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d), raw: d }));
+    });
+    req.on('error', reject);
+    req.end('{}');
+  });
+}
+const RKEY = 'rnd_abcdefghijklmnopqrstuvwx';
+console.log('\nPOST /provisioning/instances/:id/teardown — the Render key for the sandbox:');
+await ta('a well-formed key is sealed and lent to the teardown just queued, never echoed', async () => {
+  const realConf = secretBox.isConfigured, realEnc = secretBox.encrypt;
+  secretBox.isConfigured = () => true; secretBox.encrypt = (p) => `v1.sealed(${p.length})`;
+  try {
+    lentCalls = [];
+    teardownOutcome = { intent: { id: 31, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    const res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200, res.raw);
+    assert.equal(res.body.sandbox_key_lent, true);
+    assert.deepEqual(lentCalls, [{ intentId: 31, keyEnc: `v1.sealed(${RKEY.length})` }], 'ciphertext only, on THIS teardown');
+    assert.ok(!res.raw.includes(RKEY), 'the key is never sent back');
+  } finally { secretBox.isConfigured = realConf; secretBox.encrypt = realEnc; }
+});
+await ta('a malformed key, an already-queued teardown, or no safe seal: nothing lent, the teardown still answers', async () => {
+  const realConf = secretBox.isConfigured, realEnc = secretBox.encrypt;
+  secretBox.encrypt = (p) => `v1.sealed(${p.length})`;
+  try {
+    secretBox.isConfigured = () => true;
+    lentCalls = [];
+    teardownOutcome = { intent: { id: 32, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    let res = await postWithKey('/provisioning/instances/16/teardown', 'not-a-key');
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false);
+    teardownOutcome = { intent: { id: 32, action: 'teardown', state: 'pending' }, created: false, superseded: false };
+    res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false, 'not on a teardown queued earlier');
+    secretBox.isConfigured = () => false;
+    teardownOutcome = { intent: { id: 33, action: 'teardown', state: 'pending' }, created: true, superseded: false };
+    res = await postWithKey('/provisioning/instances/16/teardown', RKEY);
+    assert.equal(res.status, 200); assert.equal(res.body.sandbox_key_lent, false, 'never stored unsealed');
+    assert.equal(lentCalls.length, 0);
+  } finally { secretBox.isConfigured = realConf; secretBox.encrypt = realEnc; }
+});
+
 console.log('\nPOST /provisioning/instances/:id/force-teardown — same truthful mapping (archon):');
 
 await ta('force-teardown surfaces the same 409 conflict instead of a false success', async () => {

package/tests/render_api.mjs

@@ -127,10 +127,13 @@ await ta('listOwners returns every workspace the key reaches, unwrapped', async
 });
 
 console.log('\nno delete:');
-await ta('there is no delete method, and the verb is refused', async () => {
+await ta('there is no delete method but the sandbox one, and the verb is refused', async () => {
   const { api, calls } = live({});
   const methods = Object.getOwnPropertyNames(RenderApi.prototype);
-  assert.ok(!methods.some((m) => /delete|destroy|remove|suspend/i.test(m)), `no destructive method: ${methods.join(', ')}`);
+  // ADR 0406 §7 / task 1005289: the ONE destructive method removes a free `…-sandbox`
+  // service the platform made (tests/render_sandbox.mjs proves it refuses anything else).
+  const destructive = methods.filter((m) => /delete|destroy|remove|suspend/i.test(m));
+  assert.deepEqual(destructive, ['deleteSandboxService'], `no other destructive method: ${methods.join(', ')}`);
   await assert.rejects(api._req('DELETE', '/services/srv-1'), /never deletes/);
   assert.equal(calls.length, 0);
 });

package/tests/render_sandbox.mjs

@@ -0,0 +1,447 @@
+// tests/render_sandbox.mjs — every project on Render gets a sandbox (task 1005289; ADR 0406).
+//
+// The runner legs (scripts/bongos/provision-render.js + provision-render-sandbox.js) are
+// driven over the REAL Render client (render-api.js) and a recording fake of Render's API,
+// so the workspace guard and the sandbox-only delete are exercised end to end. The SQL that
+// makes the sandbox's database is a recording fake too. No network, no database, no spend.
+//
+// The task's DONE WHEN, case by case:
+//   • create-with-sandbox — a new app gets a free `<slug>-sandbox` service following main,
+//     with BONGOS_SANDBOX=1 and its OWN database inside the app's paid server; the live
+//     service is never written to after it is made
+//   • add-to-existing — an app already up adds a sandbox with one action and the live app
+//     is not touched (no create, no write)
+//   • status read — the sandbox's address and state beside the app's, in its shape
+//   • teardown — removes the sandbox service and database, never the live app; without a
+//     key it is forgotten and the owner is told what to remove
+//   • no app — a project with no app gets no sandbox and says so plainly
+// Plus: the database stage is separate — when it fails the sandbox still runs, with no
+// database, and nothing paid is bought in its place.
+//
+// Run:  node tests/render_sandbox.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const { RenderApi } = require('../scripts/bongos/render-api.js');
+const { renderStandupInstance, forgetRenderApp } = require('../scripts/bongos/provision-render.js');
+const payload = require('../scripts/bongos/render-payload.js');
+const renderSandbox = require('../modules/provisioning/render-sandbox.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const LIVE_URL = 'https://demo.onrender.com';
+const SB_URL = 'https://demo-sandbox.onrender.com';
+const SB_NAME_Q = `GET /services?name=demo-sandbox&ownerId=${OURS}&limit=20`;
+
+// A fake Render account. `over` replaces any answer; a function answer sees the body.
+function fakeRender(over = {}) {
+  const calls = [];
+  const answers = {
+    'GET /owners?limit=100': [{ owner: { id: OURS } }],
+    'POST /postgres': { id: 'dpg-new', status: 'creating', plan: 'basic_256mb', owner: { id: OURS } },
+    'GET /postgres/dpg-new': { id: 'dpg-new', status: 'available', plan: 'basic_256mb', owner: { id: OURS } },
+    'GET /postgres/dpg-new/connection-info': {
+      internalConnectionString: 'postgresql://u:p@dpg-new-a/demo_db',
+      externalConnectionString: 'postgresql://u:p@dpg-new-a.virginia-postgres.render.com/demo_db',
+    },
+    'POST /services': (b) => (b.name === 'demo-sandbox'
+      ? { deployId: 'dep-s', service: { id: 'srv-sbx00001', name: 'demo-sandbox', ownerId: OURS, serviceDetails: { url: SB_URL, plan: 'free' } } }
+      : { deployId: 'dep-1', service: { id: 'srv-live0001', name: 'demo', ownerId: OURS, serviceDetails: { url: LIVE_URL, plan: 'starter' } } }),
+    'GET /services/srv-live0001': { id: 'srv-live0001', name: 'demo', ownerId: OURS, repo: 'https://github.com/example-owner/demo',
+      serviceDetails: { url: LIVE_URL, plan: 'starter', runtime: 'python', region: 'oregon', envSpecificDetails: { buildCommand: 'pip install -r requirements.txt', startCommand: 'gunicorn app:app' } } },
+    'GET /services/srv-sbx00001': { id: 'srv-sbx00001', name: 'demo-sandbox', ownerId: OURS, serviceDetails: { url: SB_URL, plan: 'free' } },
+    'DELETE /services/srv-sbx00001': null,
+    [SB_NAME_Q]: [],
+    ...over,
+  };
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    const body = init.body ? JSON.parse(init.body) : null;
+    calls.push({ method: init.method, path, body });
+    const key = `${init.method} ${path}`;
+    const a0 = answers[key];
+    const a = typeof a0 === 'function' ? a0(body) : a0;
+    if (a === undefined) return { ok: false, status: 404, text: async () => '{"message":"not found"}' };
+    if (a instanceof Error) return { ok: false, status: 500, text: async () => JSON.stringify({ message: a.message }) };
+    if (a === null) return { ok: true, status: 204, text: async () => '' };
+    return { ok: true, status: 200, text: async () => JSON.stringify(a) };
+  };
+  return { calls, fetchImpl };
+}
+
+// The row, kept in memory: the two app_host writes the legs make (the app's merge and the
+// sandbox's nested merge) are applied the way Postgres would.
+function harness({ host = {}, render = {}, sql = null, intentKey = 'v1.enc', teardownKey = null } = {}) {
+  const r = fakeRender(render);
+  const logs = [], sqlRan = [], intentWrites = [];
+  const inst = { id: 18, slug: 'demo', owner_builder_id: 7, target_ref: 'example-owner/demo', status: 'active',
+    app_host: { platform: 'render', mode: 'greenfield', ownerId: OURS, runtime: 'node', buildCommand: 'npm ci', startCommand: 'npm start', database: true, sandboxWanted: true, ...host } };
+  const db = {
+    query: async (text, params) => {
+      const t = text.replace(/\s+/g, ' ');
+      if (/jsonb_build_object\('sandbox'/.test(t)) {
+        const patch = JSON.parse(params[1]);
+        inst.app_host = { ...inst.app_host, sandbox: { ...(inst.app_host.sandbox || {}), ...patch } };
+        return { rows: [] };
+      }
+      if (/SET app_host = COALESCE\(app_host, '\{\}'::jsonb\) \|\| \$2::jsonb/.test(t)) {
+        inst.app_host = { ...inst.app_host, ...JSON.parse(params[1]) };
+        return { rows: [] };
+      }
+      if (/FROM provisioning_intents/.test(t) && /action = 'teardown'/.test(t)) return { rows: teardownKey ? [{ id: 77, borrowed_key_enc: teardownKey }] : [] };
+      if (/UPDATE provisioning_intents SET borrowed_key_enc = NULL/.test(t)) { intentWrites.push(params[0]); return { rows: [] }; }
+      return { rows: [] };
+    },
+  };
+  const sqlRunner = sql || (async (conn, statements) => {
+    sqlRan.push({ conn, statements: statements.map((s) => s.text) });
+    return statements.map(() => ({ rows: [] }));
+  });
+  const deps = {
+    db, apply: true, log: (l) => logs.push(l), sleepFn: async () => {}, sqlRunner,
+    secretBox: { decrypt: () => 'rnd_borrowed' },
+    renderApiFactory: ({ token, ownerId }) => new RenderApi({ token, ownerId, dryRun: false, fetchImpl: r.fetchImpl }),
+    provisioning: { getInstanceById: async () => ({ ...inst, app_host: { ...inst.app_host } }) },
+  };
+  const it = { id: 44, action: 'render-standup', borrowed_key_enc: intentKey, created_at: new Date().toISOString() };
+  return { r, inst, logs, sqlRan, intentWrites, deps, run: () => renderStandupInstance(inst, deps, it) };
+}
+const writesTo = (calls) => calls.filter((c) => c.method !== 'GET').map((c) => `${c.method} ${c.path}`);
+const created = (h, name) => h.r.calls.find((c) => c.method === 'POST' && c.path === '/services' && c.body.name === name);
+
+console.log('create with a sandbox:');
+await ta('a new app with a database: the app, then its sandbox — free, follows main, its own database', async () => {
+  const h = harness();
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), ['POST /postgres', 'POST /services', 'POST /services'], 'database, live app, sandbox — and nothing else written');
+  const sb = created(h, 'demo-sandbox').body;
+  assert.equal(sb.serviceDetails.plan, 'free');
+  assert.equal(sb.branch, 'main');
+  assert.equal(sb.autoDeploy, 'yes', 'the sandbox follows every merge');
+  assert.equal(sb.repo, 'https://github.com/example-owner/demo');
+  assert.deepEqual(sb.envVars, [
+    { key: 'BONGOS_SANDBOX', value: '1' },
+    { key: 'DATABASE_URL', value: 'postgresql://u:p@dpg-new-a/demo_sandbox' },
+  ], 'its own database on the same server — never the live one');
+  // the second database is made with SQL on the app's server, existence checked first
+  assert.equal(h.sqlRan.length, 2);
+  assert.match(h.sqlRan[0].statements[0], /FROM pg_database WHERE datname = \$1/);
+  assert.equal(h.sqlRan[1].statements[0], 'CREATE DATABASE "demo_sandbox"');
+  assert.ok(h.sqlRan.every((s) => s.conn.includes('render.com/demo_db')), 'over the server’s external address');
+  // no paid database bought for it: one POST /postgres in all, the app's own
+  assert.equal(h.r.calls.filter((c) => c.method === 'POST' && c.path === '/postgres').length, 1);
+  const s = h.inst.app_host.sandbox;
+  assert.deepEqual([s.state, s.serviceId, s.serviceUrl, s.database, s.dbName], ['deploying', 'srv-sbx00001', SB_URL, 'ready', 'demo_sandbox']);
+  assert.equal(h.inst.app_host.state, 'deploying', 'the app’s own state is its own');
+});
+
+await ta('an app with no database: the sandbox has none either, and says so', async () => {
+  const h = harness({ host: { database: false } });
+  assert.equal((await h.run()).ok, true);
+  assert.deepEqual(created(h, 'demo-sandbox').body.envVars, [{ key: 'BONGOS_SANDBOX', value: '1' }]);
+  assert.equal(h.sqlRan.length, 0);
+  assert.equal(h.inst.app_host.sandbox.database, 'none');
+  assert.match(h.inst.app_host.sandbox.dbNote, /no database, so its sandbox has none/);
+});
+
+await ta('a linked (adopted) app: the sandbox copies its build, and the live service gets no write', async () => {
+  const h = harness({ host: { mode: 'adopt', serviceId: 'srv-live0001', runtime: undefined, buildCommand: undefined, startCommand: undefined, database: undefined } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), ['POST /services'], 'the only write is the sandbox');
+  const sb = created(h, 'demo-sandbox').body;
+  assert.equal(sb.serviceDetails.runtime, 'python');
+  assert.equal(sb.serviceDetails.region, 'oregon');
+  assert.deepEqual(sb.serviceDetails.envSpecificDetails, { buildCommand: 'pip install -r requirements.txt', startCommand: 'gunicorn app:app' });
+  assert.equal(h.inst.app_host.sandbox.database, 'none', 'we do not know a linked app’s database, so none');
+});
+
+await ta('the database stage fails: the sandbox still runs, with no database, and nothing paid is bought', async () => {
+  const h = harness({ sql: async () => { throw new Error('permission denied to create database'); } });
+  const out = await h.run();
+  assert.equal(out.ok, true);
+  assert.deepEqual(created(h, 'demo-sandbox').body.envVars, [{ key: 'BONGOS_SANDBOX', value: '1' }], 'no DATABASE_URL at all — never the live one');
+  const s = h.inst.app_host.sandbox;
+  assert.equal(s.state, 'deploying');
+  assert.equal(s.database, 'failed');
+  assert.match(s.dbNote, /runs with no data: permission denied/);
+  assert.equal(h.r.calls.filter((c) => c.path === '/postgres' && c.method === 'POST').length, 1, 'only the app’s own database');
+});
+
+await ta('the sandbox failing never fails the app, and the key is still cleared', async () => {
+  const h = harness({ host: { database: false }, render: { 'POST /services': (b) => (b.name === 'demo-sandbox'
+    ? new Error('free instance limit reached')
+    : { service: { id: 'srv-live0001', ownerId: OURS, serviceDetails: { url: LIVE_URL } } }) } });
+  const out = await h.run();
+  assert.equal(out.ok, true, 'the app is up');
+  assert.equal(h.inst.app_host.state, 'deploying');
+  assert.equal(h.inst.app_host.sandbox.state, 'failed');
+  assert.match(h.inst.app_host.sandbox.error, /free instance limit reached/);
+  assert.deepEqual(h.intentWrites, [44], 'the key is cleared');
+});
+
+await ta('a re-run finds the sandbox by name and never makes a second one', async () => {
+  const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-live0001', state: 'deploying', sandbox: { state: 'requested' } },
+    render: { [SB_NAME_Q]: [{ service: { id: 'srv-sbx00001', name: 'demo-sandbox', ownerId: OURS, serviceDetails: { url: SB_URL } } }] } });
+  assert.equal((await h.run()).ok, true);
+  assert.ok(!created(h, 'demo-sandbox'), 'no second sandbox');
+  assert.equal(h.inst.app_host.sandbox.serviceId, 'srv-sbx00001');
+});
+
+await ta('a sandbox found under another workspace is refused by the guard', async () => {
+  const h = harness({ host: { database: false }, render: { [SB_NAME_Q]: [{ service: { id: 'srv-x', name: 'demo-sandbox', ownerId: 'tea-theirs000001' } }] } });
+  assert.equal((await h.run()).ok, true, 'the app stands');
+  assert.equal(h.inst.app_host.sandbox.state, 'failed');
+  assert.match(h.inst.app_host.sandbox.error, /workspace/);
+  assert.ok(!created(h, 'demo-sandbox'));
+});
+
+console.log('\nadd to an existing project:');
+await ta('an app already live adds its sandbox: the live app is not created, read-written or redeployed', async () => {
+  const h = harness({ host: { postgresId: 'dpg-new', serviceId: 'srv-live0001', state: 'live', sandbox: { state: 'requested' } } });
+  const out = await h.run();
+  assert.equal(out.ok, true, out.error);
+  assert.deepEqual(writesTo(h.r.calls), ['POST /services'], 'one write: the sandbox');
+  assert.ok(created(h, 'demo-sandbox'));
+  assert.equal(h.inst.app_host.state, 'live', 'the app stays live — not knocked back to building');
+  assert.equal(h.inst.app_host.sandbox.state, 'deploying');
+});
+
+await ta('enqueueSandboxAdd: one statement queues the key and marks the row; a collision keeps nothing', async () => {
+  const seen = [];
+  const guard = require('../modules/provisioning/control-plane-guard.js');
+  const orig = guard.assertIntentAllowed;
+  guard.assertIntentAllowed = async () => {};
+  try {
+    const db = { query: async (t, p) => { seen.push({ t: t.replace(/\s+/g, ' '), p }); return { rows: [{ id: 5, action: 'render-standup', state: 'pending' }] }; } };
+    const r = await renderSandbox.enqueueSandboxAdd(db, 18, { keyEnc: 'v1.enc', requestedBy: 'api:self' });
+    assert.equal(r.intent.id, 5);
+    assert.equal(seen.length, 1);
+    assert.match(seen[0].t, /INSERT INTO provisioning_intents .* 'render-standup'/);
+    assert.match(seen[0].t, /'sandboxWanted', true/);
+    assert.deepEqual(seen[0].p, [18, 'api:self', 'v1.enc']);
+    let n = 0;
+    const busy = { query: async () => { if (n++ === 0) { const e = new Error('dup'); e.code = '23505'; throw e; } return { rows: [{ id: 3, action: 'provision', state: 'running' }] }; } };
+    const c = await renderSandbox.enqueueSandboxAdd(busy, 18, { keyEnc: 'v1.enc' });
+    assert.equal(c.conflict, 'open_intent');
+    assert.equal(c.intent.action, 'provision');
+  } finally { guard.assertIntentAllowed = orig; }
+});
+
+console.log('\nteardown:');
+await ta('with the key: the sandbox service and its database are removed — the live app is not', async () => {
+  const h = harness({ teardownKey: 'v1.td', host: { postgresId: 'dpg-new', serviceId: 'srv-live0001', state: 'live',
+    sandbox: { state: 'live', serviceId: 'srv-sbx00001', serviceUrl: SB_URL, dbName: 'demo_sandbox' } } });
+  await forgetRenderApp(h.inst, h.deps);
+  assert.deepEqual(writesTo(h.r.calls), ['DELETE /services/srv-sbx00001'], 'one delete, the sandbox; nothing on the live app');
+  assert.deepEqual(h.sqlRan.map((s) => s.statements[0]), ['DROP DATABASE IF EXISTS "demo_sandbox" WITH (FORCE)']);
+  assert.deepEqual(h.intentWrites, [77], 'the teardown’s lent key is cleared');
+  const s = h.inst.app_host.sandbox;
+  assert.deepEqual([s.state, s.serviceId, s.dbName], ['removed', null, null]);
+  assert.equal(h.inst.app_host.state, 'disconnected', 'the live app is forgotten, as before — never deleted');
+  assert.equal(h.inst.app_host.serviceId, 'srv-live0001', 'its id stays on the row');
+});
+
+await ta('the delete refuses the live app even if it is named as the sandbox', async () => {
+  const h = harness({ teardownKey: 'v1.td', host: { serviceId: 'srv-live0001', state: 'live', sandbox: { state: 'live', serviceId: 'srv-live0001' } } });
+  await forgetRenderApp(h.inst, h.deps);
+  assert.ok(!h.r.calls.some((c) => c.method === 'DELETE'), 'no DELETE was sent');
+  assert.equal(h.inst.app_host.sandbox.state, 'left');
+  assert.match(h.inst.app_host.sandbox.error, /not a free sandbox/);
+  assert.deepEqual(h.intentWrites, [77], 'the key is cleared on a refusal too');
+});
+
+await ta('deleteSandboxService: refuses a paid service and one not named -sandbox', async () => {
+  const r = fakeRender({ 'GET /services/srv-paid0001': { id: 'srv-paid0001', name: 'demo-sandbox', ownerId: OURS, serviceDetails: { plan: 'starter' } } });
+  const api = new RenderApi({ token: 'rnd_x', ownerId: OURS, dryRun: false, fetchImpl: r.fetchImpl });
+  await assert.rejects(api.deleteSandboxService('srv-paid0001'), /not a free sandbox/);
+  await assert.rejects(api.deleteSandboxService('srv-live0001'), /not a free sandbox/);
+  assert.ok(!r.calls.some((c) => c.method === 'DELETE'));
+  await assert.rejects(api._req('DELETE', '/services/srv-sbx00001'), /never deletes/, 'the plain verb is still refused');
+});
+
+await ta('without a key: no Render call, the sandbox is left and the owner is told what to remove', async () => {
+  const h = harness({ host: { serviceId: 'srv-live0001', state: 'live', sandbox: { state: 'live', serviceId: 'srv-sbx00001', dbName: 'demo_sandbox' } } });
+  await forgetRenderApp(h.inst, h.deps);
+  assert.equal(h.r.calls.length, 0);
+  assert.equal(h.inst.app_host.sandbox.state, 'left');
+  assert.match(h.inst.app_host.sandbox.error, /demo-sandbox.*demo_sandbox/);
+});
+
+await ta('lendKeyToTeardown puts the key only on a PENDING teardown', async () => {
+  let seen;
+  const db = { query: async (t, p) => { seen = { t: t.replace(/\s+/g, ' '), p }; return { rowCount: 1 }; } };
+  assert.equal(await renderSandbox.lendKeyToTeardown(db, 77, 'v1.td'), true);
+  assert.match(seen.t, /WHERE id = \$1 AND action = 'teardown' AND state = 'pending'/);
+});
+
+console.log('\nstatus read:');
+const row = (app_host, status = 'active') => ({ id: 18, status, app_host });
+await ta('a running sandbox: its address, links and stage in the app-status shape, plus its database', async () => {
+  const s = renderSandbox.sandboxStatus(row({ platform: 'render', state: 'live', serviceId: 'srv-live0001', sandboxWanted: true,
+    sandbox: { state: 'live', serviceId: 'srv-sbx00001', serviceUrl: SB_URL, database: 'ready', updatedAt: new Date().toISOString() } }));
+  assert.equal(s.stage, 'live');
+  assert.equal(s.url, SB_URL);
+  assert.equal(s.links.service, 'https://dashboard.render.com/web/srv-sbx00001');
+  assert.equal(s.plan, 'free');
+  assert.equal(s.follows, 'main');
+  assert.equal(s.database.state, 'ready');
+  assert.equal(s.can_add, false);
+});
+await ta('waiting, failed (with a retry) and left read plainly', async () => {
+  const base = { platform: 'render', state: 'live', serviceId: 'srv-live0001', sandboxWanted: true };
+  assert.equal(renderSandbox.sandboxStatus(row({ ...base, sandbox: { state: 'requested' } })).stage, 'creating');
+  const f = renderSandbox.sandboxStatus(row({ ...base, sandbox: { state: 'failed', error: 'The sandbox could not be set up: x' } }));
+  assert.equal(f.error, 'The sandbox could not be set up: x.');
+  assert.equal(f.can_add, true, 'the owner can try again');
+  assert.equal(renderSandbox.sandboxStatus(row({ ...base, sandbox: { state: 'left', error: 'remove it' } })).error, 'remove it');
+});
+await ta('a ready sandbox database says plainly that it starts empty', () => {
+  const s = renderSandbox.sandboxStatus(row({ platform: 'render', state: 'live', serviceId: 'srv-live0001', sandboxWanted: true,
+    sandbox: { state: 'live', serviceId: 'srv-sbx00001', serviceUrl: SB_URL, database: 'ready' } }));
+  assert.match(s.database.note, /separate from your live data/);
+  assert.match(s.database.note, /starts empty/);
+});
+await ta('the sandbox knocks run a few at a time too', async () => {
+  const liveness = require('../modules/provisioning/pollers/app-liveness.js');
+  let inFlight = 0, peak = 0;
+  const sbs = Array.from({ length: 12 }, (_, i) => ({ id: i + 1, slug: `s${i}`, sb: { state: 'deploying', serviceUrl: `https://s${i}-sandbox.onrender.com` } }));
+  const db = { query: async (sql) => (/app_host->'sandbox'->>'state' = 'deploying'/.test(sql) && /^\s*SELECT/.test(sql) ? { rows: sbs } : /^\s*SELECT/.test(sql) ? { rows: [] } : { rowCount: 1 }) };
+  const fetchImpl = async () => { inFlight++; peak = Math.max(peak, inFlight); await new Promise((r) => setTimeout(r, 5)); inFlight--; return { status: 200, headers: { get: () => null } }; };
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 12, live: 12 });
+  assert.equal(peak, 5);
+});
+await ta('an existing app with no sandbox yet can add one', async () => {
+  const s = renderSandbox.sandboxStatus(row({ platform: 'render', state: 'live', serviceId: 'srv-live0001' }));
+  assert.equal(s.state, 'none');
+  assert.equal(s.can_add, true);
+});
+
+console.log('\nno app:');
+await ta('a project with no app gets no sandbox, and says so plainly', async () => {
+  const s = renderSandbox.sandboxStatus(row(null));
+  assert.deepEqual([s.state, s.can_add], ['none', false]);
+  assert.match(s.message, /no app yet, so there is nothing to run in a sandbox/);
+  assert.match(renderSandbox.noSandboxReason(row({ platform: 'vercel' })), /Render only/);
+  assert.match(renderSandbox.noSandboxReason(row({ platform: 'render', state: 'failed' })), /not set up on Render yet/);
+});
+
+// ---- the routes, over express, with the module's own pieces stubbed at their seams ----
+const provisioning = require('../modules/provisioning/provisioning.js');
+const secretBox = require('../src/bongos/secret-box.js');
+const kapi = require('../src/module-api.js');
+let instance = null, enq = [], builder = { id: 7 };
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async () => {};
+renderSandbox.enqueueSandboxAdd = async (_db, id, args) => { enq.push({ id, ...args }); return { intent: { id: 9 } }; };
+secretBox.isConfigured = () => true;
+secretBox.encrypt = (plain) => `v1.sealed(${plain.length})`;
+kapi.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+kapi.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+Object.defineProperty(kapi, 'pool', { configurable: true, get: () => ({ query: async () => ({ rows: [{ waiting: false }] }) }) });
+const envManifest = require('../modules/provisioning/env-manifest.js');
+envManifest.listEnvVars = async () => [];
+const express = require('express');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => { res.fail = (code, o) => res.status(typeof o === 'number' ? o : (o && o.status) || 400).json({ error: { code, ...(typeof o === 'object' ? o : {}) } }); next(); });
+app.use('/api/bongos', require('../modules/provisioning/routes/render-standup.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(`${base}${path}`, { method, headers: { 'Content-Type': 'application/json' } }, (res) => {
+      let d = ''; res.on('data', (c) => { d += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: d ? JSON.parse(d) : null, raw: d }));
+    });
+    req.on('error', reject);
+    req.end(body ? JSON.stringify(body) : undefined);
+  });
+}
+const KEY = 'rnd_abcdefghijklmnopqrstuvwx';
+const OWNED = { owner_builder_id: 7, slug: 'demo', status: 'active', target_ref: 'example-owner/demo' };
+
+await ta('POST …/render/sandbox on a project with no app: 409, said plainly, nothing queued', async () => {
+  instance = { ...OWNED, app_host: null }; enq = [];
+  const r = await call('POST', '/provisioning/instances/18/render/sandbox', { key: KEY });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error.code, 'sandbox_unavailable');
+  assert.match(r.body.error.message, /no app yet/);
+  assert.equal(enq.length, 0);
+});
+await ta('POST …/render/sandbox by the owner of a live app: queued with ciphertext only', async () => {
+  instance = { ...OWNED, app_host: { platform: 'render', state: 'live', serviceId: 'srv-live0001' } }; enq = [];
+  const r = await call('POST', '/provisioning/instances/18/render/sandbox', { key: KEY });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enq.length, 1);
+  assert.equal(enq[0].keyEnc, `v1.sealed(${KEY.length})`);
+  assert.ok(!r.raw.includes(KEY), 'the key is never sent back');
+});
+await ta('POST …/render/sandbox by anyone else: the stranger’s 404', async () => {
+  instance = { ...OWNED, owner_builder_id: 99, app_host: { platform: 'render', state: 'live', serviceId: 'srv-live0001' } }; enq = [];
+  const r = await call('POST', '/provisioning/instances/18/render/sandbox', { key: KEY });
+  assert.equal(r.status, 404);
+  assert.equal(enq.length, 0);
+});
+await ta('POST …/render/sandbox when one already runs: refused', async () => {
+  instance = { ...OWNED, app_host: { platform: 'render', state: 'live', serviceId: 'srv-live0001', sandbox: { state: 'live' } } }; enq = [];
+  const r = await call('POST', '/provisioning/instances/18/render/sandbox', { key: KEY });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error.code, 'sandbox_exists');
+});
+await ta('GET …/render carries the sandbox beside the app', async () => {
+  instance = { ...OWNED, app_host: { platform: 'render', state: 'live', serviceId: 'srv-live0001', serviceUrl: LIVE_URL, sandboxWanted: true,
+    sandbox: { state: 'deploying', serviceId: 'srv-sbx00001', serviceUrl: SB_URL, database: 'none', dbNote: 'Your app has no database, so its sandbox has none either.', updatedAt: new Date().toISOString() } } };
+  const r = await call('GET', '/provisioning/instances/18/render');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.app.url, LIVE_URL);
+  assert.equal(r.body.sandbox.url, SB_URL);
+  assert.equal(r.body.sandbox.stage, 'building');
+  assert.match(r.body.sandbox.database.note, /no database/);
+});
+await ta('GET …/render with no app: the sandbox says why it has none', async () => {
+  instance = { ...OWNED, app_host: null };
+  const r = await call('GET', '/provisioning/instances/18/render');
+  assert.equal(r.body.app, null);
+  assert.equal(r.body.sandbox.state, 'none');
+  assert.match(r.body.sandbox.message, /no app yet/);
+});
+server.close();
+
+console.log('\nthe liveness poller:');
+await ta('a deploying sandbox that answers is marked live, compare-and-set', async () => {
+  const liveness = require('../modules/provisioning/pollers/app-liveness.js');
+  const writes = [];
+  const db = { query: async (sql, params) => {
+    if (/app_host->'sandbox'->>'state' = 'deploying'/.test(sql) && /^\s*SELECT/.test(sql)) return { rows: [{ id: 18, slug: 'demo', sb: { state: 'deploying', serviceUrl: SB_URL } }] };
+    if (/^\s*SELECT/.test(sql)) return { rows: [] };
+    writes.push({ sql: sql.replace(/\s+/g, ' '), params });
+    return { rowCount: 1 };
+  } };
+  const fetchImpl = async () => ({ status: 200, headers: { get: () => null } });
+  const out = await liveness.sweepOnce({ pool: db, fetchImpl, log: () => {} });
+  assert.deepEqual(out, { checked: 1, live: 1 });
+  assert.match(writes[0].sql, /jsonb_set\(app_host, '\{sandbox\}'/);
+  assert.match(writes[0].sql, /AND app_host->'sandbox'->>'state' = 'deploying'/);
+});
+
+console.log('\npayload:');
+await ta('the sandbox database name is a safe identifier', () => {
+  assert.equal(payload.sandboxDbName({ id: 1, slug: 'my-app' }), 'my_app_sandbox');
+  assert.equal(payload.sandboxDbName({ id: 2, slug: '9lives' }), 'lives_sandbox');
+  assert.ok(payload.SANDBOX_DB_RE.test(payload.sandboxDbName({ id: 3, slug: 'x'.repeat(80) })));
+});
+
+console.log(`\nrender_sandbox: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);