@bongos/core 1.25.20 → 1.25.21

package/modules/government/routes/government.js

@@ -137,7 +137,7 @@ const governmentPort = {
   // an ordinary amendment under the constitution in force — for the genesis
   // home, which renders the stages from GET /government/constitution's
   // `charter` block. Opening a sitting decides nothing; the vote does.
-  proposeCharter: board.proposeCharter,
+  proposeCharter: (a) => require('../sole-member').proposeCharter(a), // task 1005130: a board of one decides by filing (sole-member.js), here and on every amendment route
   charterAdvice: (input) => require('../charter-advice').charterAdvice(input), // task 1005119: advice only, never a write
   genesisStageStatus: board.genesisStageStatus,
   // task 1004529 — who decides what. The table, resolved, and the check a
@@ -972,7 +972,7 @@ module.exports = function buildGovernmentRouter() {
       });
     }
     try {
-      const out = await board.proposeAmendment({
+      const out = await require('../sole-member').proposeAmendment({
         proposal: req.body.proposal,
         rationaleMd: req.body.rationale_md ?? null,
         proposedBy: req.builder.id,
@@ -1002,7 +1002,7 @@ module.exports = function buildGovernmentRouter() {
       if (wording && typeof wording.flagInvestmentWording === 'function' && typeof req.body.rationale_md === 'string') {
         wording.flagInvestmentWording(req.body.rationale_md, { where: 'board item', ref: out.item && out.item.id });
       }
-      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item });
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item , decided: out.decided });
     } catch (err) {
       log.error('[gds] POST /government/board/items', err);
       res.fail('propose_failed', { status: 500, message: 'internal error' });
@@ -1033,7 +1033,7 @@ module.exports = function buildGovernmentRouter() {
       return res.fail('invalid_proposal', 400, { reason: 'bad_window_minutes', expected: 'null (no clock) or a whole number of minutes' });
     }
     try {
-      const out = await board.proposeCharter({
+      const out = await require('../sole-member').proposeCharter({
         form: body.form ?? undefined,
         franchise: body.franchise ?? undefined,
         councilRank: body.council_rank ?? undefined,
@@ -1054,7 +1054,7 @@ module.exports = function buildGovernmentRouter() {
           });
         }
         if (out.reason === 'no_change') {
-          return res.fail('no_change', 409, { reason: 'the constitution in force already has these settings' });
+          return res.fail('no_change', 409, { reason: 'the constitution in force already has these settings', in_force: out.in_force, complete: true, message: out.message });
         }
         return res.fail('invalid_charter', 400, {
           reason: out.reason,
@@ -1063,7 +1063,7 @@ module.exports = function buildGovernmentRouter() {
           ...(out.rank_key ? { rank_key: out.rank_key } : {}),
         });
       }
-      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, reads_as: out.reads_as });
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, reads_as: out.reads_as, what_happens_next: out.what_happens_next , decided: out.decided });
     } catch (err) {
       log.error('[gds] POST /government/board/charter', err);
       res.fail('charter_failed', { status: 500, message: 'internal error' });
@@ -1090,7 +1090,7 @@ module.exports = function buildGovernmentRouter() {
       rationale_md: { type: 'string', maxLength: 5000 },
     })) return;
     try {
-      const out = await board.proposeDecisionRules({
+      const out = await require('../sole-member').proposeDecisionRules({
         rules: req.body.rules,
         rationaleMd: req.body.rationale_md ?? null,
         proposedBy: req.builder.id,
@@ -1105,7 +1105,7 @@ module.exports = function buildGovernmentRouter() {
           ...(out.rank_key ? { rank_key: out.rank_key } : {}),
         });
       }
-      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, rules: out.rules });
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, rules: out.rules , decided: out.decided });
     } catch (err) {
       log.error('[gds] POST /government/board/decision-rules', err);
       res.fail('propose_failed', { status: 500, message: 'internal error' });
@@ -1129,7 +1129,7 @@ module.exports = function buildGovernmentRouter() {
       rationale_md: { type: 'string', maxLength: 5000 },
     })) return;
     try {
-      const out = await board.proposeLaws({
+      const out = await require('../sole-member').proposeLaws({
         enact: req.body.enact,
         repeal: req.body.repeal,
         rationaleMd: req.body.rationale_md ?? null,
@@ -1150,7 +1150,7 @@ module.exports = function buildGovernmentRouter() {
           ...(out.setting ? { setting: out.setting } : {}),
         });
       }
-      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, proposal: out.proposal });
+      res.status(201).json({ ok: true, amendment: out.amendment, item: out.item, proposal: out.proposal , decided: out.decided });
     } catch (err) {
       log.error('[gds] POST /government/board/laws', err);
       res.fail('propose_failed', { status: 500, message: 'internal error' });
@@ -1200,14 +1200,14 @@ module.exports = function buildGovernmentRouter() {
         if (sw.reason === 'preset_in_force') return res.fail('preset_in_force', 409, { preset: req.body.preset });
         return res.fail('invalid_preset', 400, { reason: sw.reason, ...(sw.expected ? { expected: sw.expected } : {}) });
       }
-      const out = await board.proposeLaws({ ...sw.proposal, rationaleMd: sw.rationale, proposedBy: req.builder.id });
+      const out = await require('../sole-member').proposeLaws({ ...sw.proposal, rationaleMd: sw.rationale, proposedBy: req.builder.id });
       if (!out.ok) {
         if (out.reason === 'already_in_force' || out.reason === 'setting_already_locked' || out.reason === 'not_in_force') {
           return res.fail(out.reason, 409, { ...(out.law_id ? { law_id: out.law_id } : {}), ...(out.setting ? { setting: out.setting } : {}) });
         }
         return res.fail('invalid_preset', 400, { reason: out.reason });
       }
-      res.status(201).json({ ok: true, preset: req.body.preset, amendment: out.amendment, item: out.item, proposal: out.proposal });
+      res.status(201).json({ ok: true, preset: req.body.preset, amendment: out.amendment, item: out.item, proposal: out.proposal , decided: out.decided });
     } catch (err) {
       log.error('[gds] POST /government/board/presets', err);
       res.fail('propose_failed', { status: 500, message: 'internal error' });

package/modules/government/sole-member.js

@@ -0,0 +1,75 @@
+'use strict';
+// modules/government/sole-member.js — a board of ONE decides by filing (task 1005130,
+// part C; owner feedback 2026-11-07, the ruling task 1005121 shipped for closing a
+// genesis stage, applied wherever it holds).
+//
+// WHY. Under monarchy the board is one person, and a sitting it opens exists only to
+// collect that person's yes. Asking them to vote on their own instruction is a second
+// step that decides nothing: "the government is in place after it is defined, but it
+// still asked me to cast a vote". So when the SOLE member files an amendment, their
+// yes is cast in the same call and the sitting closes.
+//
+// EXACTLY THREE CONDITIONS, read on the server from the item's own snapshot — the
+// constitution in force at the moment of filing — never from the request:
+//   1. the pass rule is first_ratifier (one yes decides);
+//   2. the board that snapshot seats has exactly one member (live rows, uncached);
+//   3. the person filing IS that member.
+// Anything else — two or more members, any other rule, a caller who is not the sole
+// member — returns the filing untouched, byte for byte what it was before. Under
+// first_ratifier the first yes closes regardless of a window or early-close setting,
+// so neither changes the outcome here.
+//
+// NOTHING IS SKIPPED. The filing ran its own permission gate, strict validation and
+// self-removal guard before this is reached; the yes goes through board.castVote,
+// which re-checks membership under the snapshot, the window and the clock; the close
+// goes through board.maybeCloseAfterVote → closeItem, so a passed amendment is applied
+// and recorded exactly as a clicked ballot's would be. The vote is that member's,
+// attributed and timestamped, marked cast_via 'filed' (government_039) so the record
+// tells it from a ballot — the stage-close precedent — and it earns no vote karma.
+//
+// FAIL-OPEN. The filing already stands; if the confirm or the close fails, the
+// sitting is simply left open for an ordinary vote, as before this existed.
+//
+// Composed only from board.js's exports, looked up at call time (genesis-close.js's
+// pattern), so a test's stubs on board's db bite exactly as they do for board itself.
+const board = require('./board.js');
+const { resolveBoardMembers } = require('./board-membership.js');
+const log = require('../../src/module-api').logger('government');
+
+// confirmIfSoleMember(out, filedBy) → the filing's answer, plus `decided` when the
+// sole member's filing decided it: { closed, outcome, cast_via, constitution_not_applied? }.
+async function confirmIfSoleMember(out, filedBy) {
+  if (!out || !out.ok || !out.item || filedBy == null || filedBy === '') return out;
+  const item = out.item;
+  const constitution = item.constitution || {};
+  if (constitution.pass_rule !== 'first_ratifier') return out;
+  try {
+    const members = await resolveBoardMembers(constitution);
+    if (members.length !== 1 || String(members[0].builder_id) !== String(filedBy)) return out;
+    const v = await board.castVote({ itemId: item.id, voterId: filedBy, direction: 'yes', castVia: 'filed' });
+    if (!v.ok || !v.fresh) return out;
+    const c = await board.maybeCloseAfterVote(item.id);
+    return {
+      ...out,
+      decided: {
+        closed: !!(c && c.closed),
+        outcome: (c && c.outcome) || null,
+        cast_via: 'filed',
+        ...(c && c.constitution_not_applied ? { constitution_not_applied: c.constitution_not_applied } : {}),
+      },
+    };
+  } catch (err) {
+    log.error('[government] sole-member confirm failed (the filing stands; the sitting is left open):', err);
+    return out;
+  }
+}
+
+// The amendment filers, each followed by the confirm. Same arguments, same answer,
+// plus `decided` when a board of one decided it.
+const wrap = (name) => async (args = {}) => confirmIfSoleMember(await board[name](args), args.proposedBy);
+const proposeAmendment = wrap('proposeAmendment');
+const proposeCharter = wrap('proposeCharter');
+const proposeLaws = wrap('proposeLaws');
+const proposeDecisionRules = wrap('proposeDecisionRules');
+
+module.exports = { proposeAmendment, proposeCharter, proposeLaws, proposeDecisionRules };

package/modules/hall-ui/public/genesis-home.js

@@ -35,9 +35,11 @@
 
   // What saving the plan did to the government, when it was not settled in the same
   // click. The server's charter outcome (modules/onboarding/genesis-home.js
-  // applyGovernmentChoice); in_force and none need no sentence.
+  // applyGovernmentChoice). The server's own words come first (task 1005130): an
+  // already-in-force choice is said plainly, never silently; none needs no sentence.
   function charterNote(c) {
     if (!c) return '';
+    if ((c.state === 'in_force' || c.state === 'sitting' || c.state === 'adopted') && c.message) return c.message;
     if (c.state === 'sitting') return 'Your starting government is in the Board Room for a vote.';
     if (c.state === 'needs_council') return 'A Foundation needs a council first. Add a council rank, then choose Foundation on the Charter.';
     if (c.state === 'not_filed') return 'The plan is saved, but the government could not be changed just now. You can change it on the Charter.';
@@ -133,7 +135,9 @@
 
   // The starting government: the real academic names, each with its plain sentence
   // (spec D10), the recommended one picked. Read from the government module's own
-  // constitution view so the names and explanations are never typed twice.
+  // constitution view so the names and explanations are never typed twice. Task
+  // 1005130: what is in force is said first and its form is marked, and each form says
+  // who decides and what closing something takes, in the server's own words.
   function governmentHtml(gov) {
     if (!gov || !gov.forms || !gov.forms.length) return '';
     var rec = gov.recommended && gov.recommended.key;
@@ -142,9 +146,12 @@
     return '<fieldset class="genesis__pick genesis__pick--gov"><legend>Starting government</legend>'
       + '<label class="genesis__expected">Builders you expect in the first year '
       + '<input type="number" min="1" max="100000" value="' + esc(String(gov.headcount || 1)) + '" data-expected></label>'
+      + (gov.in_force && gov.in_force.line ? '<p class="genesis__later">' + esc(gov.in_force.line) + '</p>' : '')
       + avail.map(function (f) {
-        var hint = f.explanation + (f.key === rec && gov.recommended.why ? ' Recommended: ' + gov.recommended.why : '');
-        return radio('gov', f.key, f.name + (f.key === rec ? ' · recommended' : ''), hint, f.key === rec);
+        var duty = f.who_decides ? ' ' + f.who_decides + ' ' + (f.to_close || '') : '';
+        var hint = f.explanation + duty + (f.key === rec && gov.recommended.why ? ' Recommended: ' + gov.recommended.why : '');
+        var tags = (f.current ? ' · in force now' : '') + (f.key === rec ? ' · recommended' : '');
+        return radio('gov', f.key, f.name + tags, hint, f.key === rec);
       }).join('')
       + (later.length ? '<p class="genesis__later">Coming later: ' + later.map(function (f) { return esc(f.name); }).join(', ') + '.</p>' : '')
       + '</fieldset>';
@@ -385,7 +392,7 @@
     var q = expected ? '?headcount=' + encodeURIComponent(expected) : '';
     return send('GET', '/government/constitution' + q).then(function (c) {
       var ch = c && c.charter;
-      return ch ? { forms: ch.forms || [], recommended: c.recommended || null, headcount: expected || c.headcount || 1 } : null;
+      return ch ? { forms: ch.forms || [], in_force: ch.in_force || null, recommended: c.recommended || null, headcount: expected || c.headcount || 1 } : null;
     }).catch(function () { return null; });
   }
 

package/modules/onboarding/genesis-home.js

@@ -395,7 +395,10 @@ async function savePlan(body, builderId, deps = {}) {
 // Never refuses the plan — the plan is saved first, and a choice that cannot be filed
 // says why in `state`:
 //   none          no government was picked
-//   in_force      the constitution already reads as that form (Monarchy at birth)
+//   in_force      the constitution already reads as that form (Monarchy at birth):
+//                 nothing is filed, `message` says so and `complete` is true
+//   adopted       filed AND decided in the same call: the founder is the board's only
+//                 member under first_ratifier (task 1005130), so it is in force now
 //   sitting       filed; `item_id`, and `one_vote_decides` when one yes carries it
 //   needs_council Foundation, which needs a council rank before it can seat anyone
 //   not_filed     anything else (`reason`), or no government module to file it with
@@ -411,16 +414,25 @@ async function applyGovernmentChoice(form, builderId, s) {
   }
   if (out && out.ok) {
     const snap = (out.item && out.item.constitution) || {};
+    // task 1005130: the founder is the board's only member, so choosing it WAS their
+    // one yes — it is in force now, and saying "in the Board Room" would be untrue.
+    if (out.decided && out.decided.closed && out.decided.outcome === 'passed') {
+      const name = out.reads_as ? out.reads_as.name : form;
+      return { state: 'adopted', form, item_id: out.item ? String(out.item.id) : null, complete: true,
+        message: `${name} is in force now. As the board's only member, choosing it was your one yes.` };
+    }
     return {
       state: 'sitting',
       form,
       item_id: out.item ? String(out.item.id) : null,
       one_vote_decides: snap.pass_rule === 'first_ratifier',
       reads_as: out.reads_as ? out.reads_as.name : null,
+      message: out.what_happens_next || null, // task 1005130: what happens next, in words
     };
   }
   const reason = (out && out.reason) || 'charter_failed';
-  if (reason === 'no_change') return { state: 'in_force', form };
+  // task 1005130: already in force is said plainly and counts as done, never silent.
+  if (reason === 'no_change') return { state: 'in_force', form, complete: true, message: out.message || null };
   if (reason === 'council_needs_a_rank') return { state: 'needs_council', form };
   return { state: 'not_filed', form, reason };
 }

package/modules/platform-identity/module.json

@@ -16,6 +16,6 @@
     "migrations": true,
     "pollers": ["code-sweep", "visibility-pull", "guild-totals"]
   },
-  "provides": ["platform-identity.hub", "project.publishGate", "project.catalog"],
+  "provides": ["platform-identity.hub", "project.publishGate", "project.catalog", "platform-identity.projectMembershipKind"],
   "consumes": ["ideas.capture"]
 }

package/modules/platform-identity/project-standing.js

@@ -0,0 +1,49 @@
+// modules/platform-identity/project-standing.js — "what is this person's standing on this
+// project?", for the WORDING of a refusal only (task 1004162, ADR 0407 §6).
+//
+// Published as the port `platform-identity.projectMembershipKind` so provisioning can tell a
+// stranger (who keeps the 404 that confirms nothing) from someone already connected to the
+// project (who is told what to do next), without importing this module (ADR 0083).
+//
+// IT NEVER ADMITS ANYONE, and must never be read to. A `member` row is written at every hub
+// sign-in, including the device flow any GitHub user can start (ADR 0328 amendment), so no
+// answer here is a grant. Admission is provisioning's own grant row (ADR 0407 §1-3).
+//
+// Answers, most specific first:
+//   'owner' | 'member' | 'visitor' — a membership the hub itself witnessed (signin_verified_at)
+//   'pending'                      — a live invitation from the project (inside its 30 days)
+//   'applied'                      — no row, but this person asked to join inside the
+//                                    application window and the project took the request
+//   null                           — none of these: a stranger
+'use strict';
+
+const api = require('../../src/module-api');
+const { isNumericGithubId } = require('./platform-identity');
+const { APPLICATION_ECHO_WINDOW_DAYS } = require('./application-echo');
+
+const KINDS = Object.freeze(['owner', 'member', 'visitor', 'pending', 'applied']);
+
+async function projectMembershipKind(clientId, githubId, { pool = api.pool } = {}) {
+  const client = String(clientId || '');
+  if (!client || !isNumericGithubId(githubId)) return null;
+  const { rows } = await pool.query(
+    `SELECT m.membership_kind
+       FROM platform_identity_project_memberships m
+      WHERE m.client_id = $1 AND m.github_id = $2::bigint
+        AND (   (m.membership_kind <> 'pending' AND m.signin_verified_at IS NOT NULL)
+             OR (m.membership_kind = 'pending' AND m.joined_at > now() - make_interval(days => $3::int)))
+      LIMIT 1`,
+    [client, String(githubId), api.inviteExpiry.INVITE_EXPIRY_DAYS],
+  );
+  if (rows[0] && KINDS.includes(rows[0].membership_kind)) return rows[0].membership_kind;
+  const { rows: asked } = await pool.query(
+    `SELECT 1 FROM platform_identity_application_echoes
+      WHERE github_id = $1::bigint AND client_id = $2
+        AND applied_at > now() - make_interval(days => $3::int)
+      LIMIT 1`,
+    [String(githubId), client, APPLICATION_ECHO_WINDOW_DAYS],
+  );
+  return asked.length ? 'applied' : null;
+}
+
+module.exports = { projectMembershipKind };

package/modules/platform-identity/routes/my-projects.js

@@ -27,6 +27,7 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
+const projectStanding = require('../project-standing');
 const guilds = require('../guilds');
 const { isMintedPersonKey } = require('../account-logins');
 const guildEngagements = require('../guild-engagements');
@@ -159,6 +160,13 @@ async function applicationVouchHeaders(client, builder) {
 }
 
 module.exports = function myProjectsRoutes() {
+  // PROVIDES port `platform-identity.projectMembershipKind` (task 1004162, ADR 0407 §6): a
+  // person's standing on one project, so provisioning can word a REFUSAL — never admit.
+  if (!api.hasProvider('platform-identity.projectMembershipKind')) {
+    api.registerProvider('platform-identity.projectMembershipKind', {
+      projectMembershipKind: (clientId, githubId) => projectStanding.projectMembershipKind(clientId, githubId, { pool: api.pool }),
+    });
+  }
   const router = express.Router();
 
   // rank: any-builder — the caller's OWN cross-project memberships (own data).

package/modules/provisioning/grants.js

@@ -0,0 +1,126 @@
+// modules/provisioning/grants.js — the owner-made grant to help run a hosted project, and its
+// ONLY writer (task 1004161, ADR 0407).
+//
+// Why it exists: a sign-in on the hub writes a `member` membership row for any GitHub user,
+// the device flow included, so membership can never admit anyone to a project's hosting
+// (ADR 0328 amendment). A grant is the one thing that can: a row in
+// `provisioning_project_grants` (migration provisioning_039) that only the project's OWNER
+// creates, from their own hub session. Nothing a visitor sends, nothing a project reports at
+// check-in, and no sign-in reaches this file.
+//
+// Every INSERT and UPDATE of that table lives here; tests/provisioning_project_grants.mjs
+// fails if another file writes it. Who may call which function is decided by the routes
+// (routes/grants.js); this file holds the data rules that must hold whoever calls.
+'use strict';
+
+const GRANT_LEVELS = Object.freeze(['operate']);
+const MAX_LIVE_GRANTS = 25;
+
+const GRANT_COLUMNS = `g.id, g.instance_id, g.grantee_builder_id, g.level, g.granted_by_builder_id,
+  g.granted_at, g.revoked_at, g.revoked_by_builder_id`;
+
+// The live grant one person holds on one project, or null. Read on every request a
+// grant-admitting route serves (ADR 0016: authority is read fresh, never cached), so a revoke
+// binds on the grantee's very next request.
+async function liveGrant(db, instanceId, builderId) {
+  const { rows } = await db.query(
+    `SELECT ${GRANT_COLUMNS} FROM provisioning_project_grants g
+      WHERE g.instance_id = $1 AND g.grantee_builder_id = $2 AND g.revoked_at IS NULL
+      LIMIT 1`,
+    [instanceId, builderId],
+  );
+  return rows[0] || null;
+}
+
+// The project's live grants, with who each one names — the owner's "People with access" list.
+async function listLiveGrants(db, instanceId) {
+  const { rows } = await db.query(
+    `SELECT ${GRANT_COLUMNS}, b.github_login, b.display_name, b.avatar_url
+       FROM provisioning_project_grants g
+       JOIN builders b ON b.id = g.grantee_builder_id
+      WHERE g.instance_id = $1 AND g.revoked_at IS NULL
+      ORDER BY g.granted_at, g.id`,
+    [instanceId],
+  );
+  return rows;
+}
+
+// The ACTIVE hub builder a GitHub login names, or null. The owner names a person by login;
+// the grant stores the builder id, so a later login rename cannot move the grant to someone else.
+async function findGranteeByLogin(db, login) {
+  const { rows } = await db.query(
+    `SELECT id, github_login, display_name, avatar_url FROM builders
+      WHERE lower(github_login) = lower($1) AND status IS DISTINCT FROM 'inactive'
+      LIMIT 1`,
+    [login],
+  );
+  return rows[0] || null;
+}
+
+// Make a grant. Returns { grant } on success or { refused: code } — never throws for a rule.
+// Rules held here: a known level only; never the project's own owner; at most MAX_LIVE_GRANTS
+// live grants per project; one live grant per person (an existing one is returned as is).
+// The count and the insert run under the project row's lock, so two requests cannot both
+// take the 25th place.
+async function grantProjectAccess(db, { instanceId, granteeBuilderId, level = 'operate', grantedByBuilderId }) {
+  if (!GRANT_LEVELS.includes(level)) return { refused: 'bad_level' };
+  const client = typeof db.connect === 'function' ? await db.connect() : db;
+  const owned = client !== db;
+  try {
+    await client.query('BEGIN');
+    const { rows: inst } = await client.query(
+      'SELECT id, owner_builder_id FROM provisioning_instances WHERE id = $1 FOR UPDATE', [instanceId]);
+    if (!inst[0]) { await client.query('ROLLBACK'); return { refused: 'instance_not_found' }; }
+    if (String(inst[0].owner_builder_id) === String(granteeBuilderId)) {
+      await client.query('ROLLBACK');
+      return { refused: 'grantee_is_owner' };
+    }
+    const existing = await liveGrant(client, instanceId, granteeBuilderId);
+    if (existing) { await client.query('ROLLBACK'); return { grant: existing, created: false }; }
+    const { rows: n } = await client.query(
+      `SELECT count(*)::int AS n FROM provisioning_project_grants
+        WHERE instance_id = $1 AND revoked_at IS NULL`, [instanceId]);
+    if (n[0].n >= MAX_LIVE_GRANTS) { await client.query('ROLLBACK'); return { refused: 'grant_limit' }; }
+    const { rows } = await client.query(
+      `INSERT INTO provisioning_project_grants (instance_id, grantee_builder_id, level, granted_by_builder_id)
+       VALUES ($1, $2, $3, $4)
+       RETURNING id, instance_id, grantee_builder_id, level, granted_by_builder_id, granted_at, revoked_at, revoked_by_builder_id`,
+      [instanceId, granteeBuilderId, level, grantedByBuilderId],
+    );
+    await client.query('COMMIT');
+    return { grant: rows[0], created: true };
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    if (owned) client.release();
+  }
+}
+
+// Revoke one live grant of this project. Returns the revoked row, or null when there is no
+// such live grant (already revoked, another project's id, or none). A stamp, never a delete.
+async function revokeProjectAccess(db, { instanceId, grantId, revokedByBuilderId }) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_project_grants
+        SET revoked_at = now(), revoked_by_builder_id = $3
+      WHERE id = $1 AND instance_id = $2 AND revoked_at IS NULL
+      RETURNING id, instance_id, grantee_builder_id, level, granted_by_builder_id, granted_at, revoked_at, revoked_by_builder_id`,
+    [grantId, instanceId, revokedByBuilderId],
+  );
+  return rows[0] || null;
+}
+
+// One grant of this project by id, live or not — the revoke route reads it to decide who may
+// revoke (the grantee may revoke their own).
+async function getGrant(db, instanceId, grantId) {
+  const { rows } = await db.query(
+    `SELECT ${GRANT_COLUMNS} FROM provisioning_project_grants g WHERE g.id = $1 AND g.instance_id = $2`,
+    [grantId, instanceId],
+  );
+  return rows[0] || null;
+}
+
+module.exports = {
+  GRANT_LEVELS, MAX_LIVE_GRANTS,
+  liveGrant, listLiveGrants, findGranteeByLogin, grantProjectAccess, revokeProjectAccess, getGrant,
+};

package/modules/provisioning/migrations/provisioning_038_render_promote.sql

@@ -0,0 +1,43 @@
+-- provisioning_038_render_promote.sql — a person promotes what ran on the sandbox to the
+-- live app, and every promotion is recorded (task 1005290, ADR 0406 §2).
+--
+-- WHY. Once a project has a sandbox, finished work lands on the sandbox only: the live
+-- Render service stops deploying on every merge, and moves only when a person presses
+-- promote. That press queues a `render-promote` intent carrying the owner's borrowed key
+-- (ADR 0327 §2), and the runner records the promotion BEFORE it asks Render to deploy, so
+-- nothing reaches the live app through Bongos without a row here saying who, which change,
+-- and what came of it.
+--
+-- Additive and namespaced (ADR 0083): one new action on the intent CHECK, one new table.
+-- Idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight', 'repo-private', 'render-standup',
+                    'render-promote'));
+
+CREATE TABLE IF NOT EXISTS provisioning_promotions (
+  id                bigserial PRIMARY KEY,
+  instance_id       bigint NOT NULL REFERENCES provisioning_instances(id) ON DELETE CASCADE,
+  commit_id         text NOT NULL,
+  commit_message    text,
+  from_commit_id    text,
+  sandbox_deploy_id text,
+  render_deploy_id  text,
+  requested_by      text,
+  state             text NOT NULL DEFAULT 'started' CHECK (state IN ('started', 'sent', 'failed')),
+  error             text,
+  created_at        timestamptz NOT NULL DEFAULT now(),
+  updated_at        timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS ix_provisioning_promotions_instance ON provisioning_promotions (instance_id, created_at DESC);
+
+COMMENT ON TABLE provisioning_promotions IS
+  'Every promotion of a sandbox change to a project''s live Render app (task 1005290, ADR 0406): who asked, which commit, from which, and what Render answered. Written by the runner before it deploys.';
+
+COMMIT;

package/modules/provisioning/migrations/provisioning_039_project_grants.sql

@@ -0,0 +1,40 @@
+-- provisioning_039_project_grants.sql — an owner-made grant to help run a hosted project
+-- (task 1004161, ADR 0407). Landed as provisioning_038 beside render_promote's 038; renumbered
+-- by task 1004162 so the series has one migration per number. Every statement is IF NOT EXISTS,
+-- so a database that already ran it under the old name runs it again harmlessly.
+--
+-- WHY. A hosted project's provisioning routes admitted only its owner (or an archon).
+-- ADR 0328 Phase 2 would have admitted a `member` row of platform_identity_project_memberships,
+-- but the hub writes that row at every sign-in — the device flow any GitHub user can start
+-- included — so it is not a grant (ADR 0328 amendment, ADR 0407). This table is the grant:
+-- made on purpose by the project's owner from their own hub session, stored apart from every
+-- sign-in and check-in path, with one writer (modules/provisioning/grants.js).
+--
+-- A revoke is a stamp, never a delete, so the record survives. One LIVE grant per person per
+-- project (the partial unique index); granting again after a revoke makes a new row. Deleting
+-- the project row (disconnect) takes its grants with it.
+--
+-- `level` is a closed list. 'operate' is the only level (ADR 0407 §3); a second one is an ADR
+-- amendment and a new migration, never a free string.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS provisioning_project_grants (
+  id                     bigserial PRIMARY KEY,
+  instance_id            bigint NOT NULL REFERENCES provisioning_instances(id) ON DELETE CASCADE,
+  grantee_builder_id     bigint NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  level                  text   NOT NULL CHECK (level IN ('operate')),
+  granted_by_builder_id  bigint NOT NULL REFERENCES builders(id),
+  granted_at             timestamptz NOT NULL DEFAULT now(),
+  revoked_at             timestamptz,
+  revoked_by_builder_id  bigint REFERENCES builders(id),
+  CHECK ((revoked_at IS NULL) = (revoked_by_builder_id IS NULL))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS ux_provisioning_project_grants_live
+  ON provisioning_project_grants (instance_id, grantee_builder_id)
+  WHERE revoked_at IS NULL;
+
+COMMIT;

package/modules/provisioning/module.json

@@ -24,7 +24,8 @@
       "render-standup",
       "look",
       "demo",
-      "github-setup"
+      "github-setup",
+      "grants"
     ],
     "migrations": true,
     "pollers": [