@bongos/core 1.25.20 → 1.25.21

package/modules/provisioning/routes/provisioning.js

@@ -68,7 +68,8 @@ const { callbackPage } = require('./callback-page'); const githubSetup = require
 const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth'); const testProject = require('../test-project'); const guideHandoff = require('../guide-handoff');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
-const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');   // the owner-or-archon gate (task 1004159, ADR 0328)
+const { requireProjectOwner, projectActor, projectActorLabel, isProjectOwner, grantedView } = require('../route-helpers');
+const GRANTEE = { grantee: 'operate' };   // the three routes here a granted helper may use (task 1004161, ADR 0407 §3)   // the owner-or-archon gate (task 1004159, ADR 0328)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -658,7 +659,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/instances/:id — read one instance (the manage page's read).
   // rank: any authenticated builder (own resource; archon may read any — task
   // 1003041). 404 otherwise — does not leak another owner's instance existence.
-  router.get('/provisioning/instances/:id', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.get('/provisioning/instances/:id', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -676,7 +677,7 @@ module.exports = function provisioningRoutes() {
       // panel recovers it from server state after a reload — not from sessionStorage.
       const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
       const githubSetupNow = await githubSetup.githubSetupRead(pool, inst, manifest, manifest ? provisioning.publicGithubApp(manifest).status : null, { withState: false });
-      res.json({
+      res.json(grantedView(req, {
         // the standing install nudge rides the instance, as on the list read (task 1004763)
         instance: { ...ownerInstance(inst), github_install: githubSetup.installNudge(githubSetupNow) },
         open_intent: open ? { action: open.action, state: open.state } : null,
@@ -684,7 +685,7 @@ module.exports = function provisioningRoutes() {
         // the four-step checklist from what the runner verified (task 1004649) — the
         // install link rides WITHOUT the state token this read never carries
         github_setup: githubSetupNow,
-      });
+      }));
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);
       failFrom(res, err, 'read_failed');
@@ -874,7 +875,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/instances/:id/settings — read a project's effective
   // settings + the allowed values (so a form can render its choices).
   // rank: any authenticated builder (own resource; archon may read any).
-  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     try {
       const inst = req.project;
       // `planet` rides beside `settings` (task 1003347): the same row, read by a
@@ -1038,7 +1039,7 @@ module.exports = function provisioningRoutes() {
   // Every refusal names the action that IS available in that state rather than
   // hiding behind a code, and no branch promises a duration — a restart's downtime
   // is exactly what this route cannot know (the F16 rule, ADR 0190 §7).
-  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -1069,7 +1070,7 @@ module.exports = function provisioningRoutes() {
       if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'restart',
-          detail: 'restart requested by owner', actor,
+          detail: `restart requested by ${projectActorLabel(req)}`, actor,
         }).catch(() => {});
       }
       res.json({ ok: true, queued: r.created, action: 'restart', status: inst.status, message: r.created

package/modules/provisioning/routes/render-standup.js

@@ -23,7 +23,8 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const renderStandup = require('../render-standup');
 const { failFrom } = require('../public-refusal');
-const { lookupRender, RenderLookupError } = require('../render-lookup');
+const { lookupRender, lookupPromotion, RenderLookupError } = require('../render-lookup');
+const renderPromote = require('../render-promote');
 const { appStatus } = require('../app-status');
 const renderSandbox = require('../render-sandbox');
 const envManifest = require('../env-manifest');
@@ -46,6 +47,10 @@ const LOOKUP_STATUS = { render_key_refused: 422, render_workspace_unreachable: 4
 // OWNER ONLY, no archon override, for every Render route: the key and the account it acts
 // in are the owner's. A missing project and someone else's answer the same 404, so an id is
 // never confirmed.
+// One sentence for "another run holds this project, so the key was dropped" — the sandbox
+// and promote routes say it the same way (voice.md V1: one fixed sentence per concept).
+const BUSY_KEY_NOT_KEPT = 'Something else is being done to this project right now, so your key was not kept. Try again in a minute.';
+
 function ownedBy(inst, builder) { return !!(inst && builder && String(inst.owner_builder_id) === String(builder.id)); }
 
 module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
@@ -105,7 +110,9 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
         : [];
       // The sandbox beside it (ADR 0406, task 1005289), in the same shape.
       const sandbox = renderSandbox.sandboxStatus(inst);
-      res.json({ ok: true, app, sandbox, env_vars: envVars, values_held: false });
+      // Promoting from it (ADR 0406 §2, task 1005290): whether the owner can, and the record.
+      const promote = { ...renderPromote.promoteView(inst), recent: await renderPromote.listPromotions(pool, id) };
+      res.json({ ok: true, app, sandbox, promote, env_vars: envVars, values_held: false });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/render', err && err.message);
       failFrom(res, err, 'render_status_failed');
@@ -139,7 +146,7 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
       const r = await renderSandbox.enqueueSandboxAdd(pool, id, { keyEnc: api.secretBox.encrypt(req.body.key), requestedBy: 'api:self' });
       if (r.conflict) {
         return res.fail('intent_conflict', { status: 409,
-          message: `A '${r.intent.action}' run is ${r.intent.state} for this project, so your key was not kept. Try again once it has finished.`,
+          message: BUSY_KEY_NOT_KEPT,
           details: { action: r.intent.action, state: r.intent.state } });
       }
       await provisioning.recordEvent(pool, {
@@ -155,6 +162,78 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
     }
   });
 
+  // POST /provisioning/instances/:id/render/promote/look — rank: any authenticated builder,
+  // and OWNER ONLY. What is waiting on the sandbox to go live (ADR 0406 §2, task 1005290):
+  // the change the live app runs, and every change that has run on the sandbox since, newest
+  // first. A read-only look at Render on the owner's key held for this one request (ADR 0348
+  // as widened by ADR 0406 §11): GET only, never stored, logged or sent back.
+  router.post('/provisioning/instances/:id/render/promote/look', api.requireBuilder, lookupLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, { key: { required: true, type: 'string', maxLength: 200 } })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (!renderStandup.KEY_RE.test(req.body.key)) return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+      const why = renderPromote.noPromoteReason(inst);
+      if (why) return res.fail('promote_unavailable', { status: 409, message: why });
+      const h = inst.app_host;
+      const out = await lookupPromotion(req.body.key, { ownerId: h.ownerId, liveServiceId: h.serviceId, sandboxServiceId: h.sandbox.serviceId, fetchImpl: fetchImpl || globalThis.fetch });
+      res.json({ ok: true, ...out });
+    } catch (err) {
+      if (err instanceof RenderLookupError) return res.fail(err.code, { status: LOOKUP_STATUS[err.code] || 502, message: err.message });
+      log.error('[provisioning] POST /provisioning/instances/:id/render/promote/look', err && err.message);
+      failFrom(res, err, 'render_lookup_failed');
+    }
+  });
+
+  // POST /provisioning/instances/:id/render/promote — rank: any authenticated builder, and
+  // OWNER ONLY: the key and the live app are the owner's, so the server decides only the
+  // owner may move it (an archon on someone else's project gets the stranger's 404). Takes
+  // the change the owner chose (`commit_id`) and the change live ran when they looked
+  // (`expect_live_commit`); the runner refuses if either moved. This is the ONLY way Bongos
+  // moves a live app that has a sandbox, and the reply is a receipt: nothing is live yet.
+  router.post('/provisioning/instances/:id/render/promote', api.requireBuilder, sandboxLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      commit_id: { required: true, type: 'string', maxLength: 64 },
+      expect_live_commit: { type: 'string', maxLength: 64 },
+    })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (!renderStandup.KEY_RE.test(req.body.key)) return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+      const commit = String(req.body.commit_id).trim().toLowerCase();
+      const expect = req.body.expect_live_commit == null ? null : String(req.body.expect_live_commit).trim().toLowerCase();
+      if (!renderPromote.COMMIT_RE.test(commit) || (expect !== null && !renderPromote.COMMIT_RE.test(expect))) {
+        return res.fail('promote_request_invalid', { status: 400, message: 'Choose one of the changes waiting on your sandbox.' });
+      }
+      const why = renderPromote.noPromoteReason(inst);
+      if (why) return res.fail('promote_unavailable', { status: 409, message: why });
+      if (!api.secretBox.isConfigured()) {
+        return res.fail('render_unavailable', { status: 503, message: 'The platform can’t take a key safely right now, so nothing was sent. Try again later.' });
+      }
+      const r = await renderPromote.enqueuePromote(pool, id, { keyEnc: api.secretBox.encrypt(req.body.key), commitId: commit, expectLiveCommit: expect, requestedBy: req.builder.id });
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: BUSY_KEY_NOT_KEPT,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-promote',
+        detail: `promote of ${commit.slice(0, 7)} to the live app requested by owner`, actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, queued: true, action: 'render-promote',
+        message: 'Queued. That change goes to your live app in a moment; Render then builds it, which usually takes a few minutes. Your key is used once and then thrown away.' });
+    } catch (err) {
+      // Never log the request: it carries the key.
+      log.error('[provisioning] POST /provisioning/instances/:id/render/promote', err && err.message);
+      failFrom(res, err, 'render_promote_failed');
+    }
+  });
+
   // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
   // ONLY: the key is the owner's and so is the account it acts in, so an archon on
   // someone else's project gets the same 404 as a stranger. The reply is a receipt;

package/modules/public-landing/public/projects.html

@@ -2313,6 +2313,7 @@ summary{min-height:24px;padding:3px 0;}
     }
     if (app.links) v.root.appendChild(appPara([appLink(app.links.service, 'Open it on Render')]));
     sandboxView(data.sandbox, v);
+    promoteView(data.promote, data.sandbox, v);
     var vars = (data.env_vars || []).filter(function (x) { return !x.set_for_you; });
     if (vars.length) {
       v.root.appendChild(appEl('h3', null, 'Still to set on Render'));
@@ -2380,8 +2381,60 @@ summary{min-height:24px;padding:3px 0;}
     }
     v.root.appendChild(box);
   }
+  /* ── promote: a person moves what ran on the sandbox to the live app (task 1005290, ADR 0406) ──
+     The look at what is waiting and the press each take the owner's Render key, held in this
+     closure and the field for the two requests and then dropped. The second press is the
+     confirm: it names the change that goes live. Nothing here moves the live app by itself. */
+  function promoteView(p, sb, v) {
+    if (!p || !sb || ['none', 'requested'].indexOf(sb.state) >= 0) return;
+    var box = appEl('div', 'appPromote');
+    box.appendChild(appEl('h3', null, 'Going live'));
+    box.appendChild(appPara([p.live_follows_main
+      ? 'Your live app still takes every finished change by itself. It stops once your sandbox is running or you promote for the first time.'
+      : 'Your live app changes only when you promote. Look at your sandbox first, then promote what you are happy with.'], 'finePrint'));
+    var last = p.last;
+    if (last && last.state === 'requested') box.appendChild(appPara(['Promoting ' + (last.commit || 'your change') + ' to your live app…']));
+    else if (last && last.state === 'sent') box.appendChild(appPara(['Sent ' + (last.commit || 'your change') + ' to your live app. Render is building it; that usually takes a few minutes.']));
+    else if (last && last.state === 'failed') box.appendChild(appPara([String(last.error || 'The last promotion did not go through.')], 'err'));
+    if (p.can) {
+      v.prBtn = appEl('button', 'btn ghost small appPrBtn', 'See what is waiting to go live');
+      v.prBtn.type = 'button';
+      box.appendChild(v.prBtn);
+      v.prForm = appEl('div', 'appRetry appPrForm');
+      v.prForm.hidden = true;
+      var lab = appEl('label', 'wizField');
+      lab.appendChild(appEl('span', null, 'Render API key'));
+      v.prKey = appEl('input', 'appRetryKey');
+      v.prKey.type = 'password'; v.prKey.autocomplete = 'off'; v.prKey.spellcheck = false; v.prKey.maxLength = 200; v.prKey.placeholder = 'rnd_…';
+      lab.appendChild(v.prKey);
+      v.prForm.appendChild(lab);
+      v.prLook = appEl('button', 'btn small', 'Look');
+      v.prLook.type = 'button';
+      v.prForm.appendChild(v.prLook);
+      v.prList = appEl('div', 'appPrList');
+      v.prForm.appendChild(v.prList);
+      v.prHint = appEl('div', 'hint appRetryHint', 'Your key is used for this look and the promotion, then thrown away.');
+      v.prHint.setAttribute('role', 'status');
+      v.prForm.appendChild(v.prHint);
+      box.appendChild(v.prForm);
+    } else if (p.reason && sb.state !== 'failed') {
+      box.appendChild(appPara([String(p.reason)], 'finePrint'));
+    }
+    if (p.recent && p.recent.length) {
+      box.appendChild(appEl('h4', null, 'Recent promotions'));
+      var ul = appEl('ul', 'appPrRecent');
+      p.recent.forEach(function (r) {
+        var when = r.at ? new Date(r.at).toLocaleString() : '';
+        var what = r.state === 'failed' ? ' — did not go through' : (r.state === 'started' ? ' — being sent' : '');
+        ul.appendChild(appEl('li', null, when + ': ' + r.commit + (r.message ? ' — ' + r.message : '') + what));
+      });
+      box.appendChild(ul);
+    }
+    v.root.appendChild(box);
+  }
+  function promotePending(data) { var l = data && data.promote && data.promote.last; return !!(l && l.state === 'requested'); }
   function sandboxSettled(sb) { return !sb || ['none', 'left', 'removed'].indexOf(sb.state) >= 0 || !!sb.error || sb.stage === 'live' || sb.stage === 'quiet'; }
-  function appTerminal(data) { var a = data && data.app; return (!a || a.state === 'disconnected' || !!a.error || a.stage === 'live') && sandboxSettled(data && data.sandbox); }
+  function appTerminal(data) { var a = data && data.app; return (!a || a.state === 'disconnected' || !!a.error || a.stage === 'live') && sandboxSettled(data && data.sandbox) && !promotePending(data); }
   function fetchAppStatus(id) {
     return fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/render', { credentials: 'same-origin' })
       .then(function (res) { return res.ok ? res.json() : null; })
@@ -2416,6 +2469,7 @@ summary{min-height:24px;padding:3px 0;}
     function tick() { fetchAppStatus(id).then(paint); }
     function wire(v) {
       if (v.sbBtn) wireSandbox(v);
+      if (v.prBtn) wirePromote(v);
       if (!v.retryBtn) return;
       v.retryBtn.addEventListener('click', function () {
         v.retryForm.hidden = false; v.retryBtn.hidden = true; v.keyEl.focus();
@@ -2445,6 +2499,50 @@ summary{min-height:24px;padding:3px 0;}
         });
       });
     }
+    function wirePromote(v) {
+      var key = '';
+      function hint(t, bad) { v.prHint.textContent = t; v.prHint.className = 'hint appRetryHint' + (bad ? ' err' : ''); }
+      function send(path, body) {
+        return fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + path, {
+          method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body)
+        }).then(function (res) {
+          return res.json().catch(function () { return {}; }).then(function (d) {
+            if (!res.ok) throw new Error((d.error && d.error.message) || 'That did not go through.');
+            return d;
+          });
+        });
+      }
+      function drop() { key = ''; v.prKey.value = ''; }
+      v.prBtn.addEventListener('click', function () { v.prForm.hidden = false; v.prBtn.hidden = true; v.prKey.focus(); });
+      v.prLook.addEventListener('click', function () {
+        key = String(v.prKey.value || '').trim();
+        if (!/^rnd_[A-Za-z0-9]{16,128}$/.test(key)) { key = ''; hint('That doesn’t look like a Render API key. It starts with “rnd_”.', true); return; }
+        v.prLook.disabled = true; hint('Asking Render…');
+        send('/render/promote/look', { key: key }).then(function (d) {
+          v.prList.textContent = ''; v.prLook.disabled = false;
+          v.prList.appendChild(appPara([d.live ? 'Live now: ' + d.live.short + (d.live.message ? ' — ' + d.live.message : '') : 'Nothing is live on your app yet.']));
+          if (!d.waiting || !d.waiting.length) { drop(); hint('Nothing new is waiting: your live app already runs what your sandbox runs.'); return; }
+          var ul = appEl('ul', 'appPrWaiting');
+          d.waiting.forEach(function (w) { ul.appendChild(appEl('li', null, w.short + (w.message ? ' — ' + w.message : ''))); });
+          v.prList.appendChild(appPara(['Waiting on your sandbox, newest first:']));
+          v.prList.appendChild(ul);
+          var go = appEl('button', 'btn small appPrGo', 'Promote ' + d.waiting[0].short + ' to my live app');
+          go.type = 'button';
+          v.prList.appendChild(go);
+          hint('Promoting the newest brings everything listed above.');
+          go.addEventListener('click', function () {
+            if (!go.dataset.sure) { go.dataset.sure = '1'; go.textContent = 'Yes, put ' + d.waiting[0].short + ' live'; hint('Press again to confirm. Your live app will change.'); return; }
+            go.disabled = true; hint('Sending…');
+            var body = { key: key, commit_id: d.waiting[0].commit_id };
+            if (d.live && d.live.commit_id) body.expect_live_commit = d.live.commit_id;
+            send('/render/promote', body).then(function (r) {
+              body.key = ''; drop(); hint(r.message || 'Queued.');
+              v.prForm.hidden = true; view = null; clearTimeout(t); ticks = 0; tick();
+            }).catch(function (err) { body.key = ''; drop(); go.disabled = false; hint(err.message + ' Enter your key again to retry.', true); });
+          });
+        }).catch(function (err) { drop(); v.prLook.disabled = false; hint(err.message, true); });
+      });
+    }
     function wireSandbox(v) {
       v.sbBtn.addEventListener('click', function () { v.sbForm.hidden = false; v.sbBtn.hidden = true; v.sbKey.focus(); });
       v.sbSend.addEventListener('click', function () {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.20",
+  "version": "1.25.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.20",
+      "version": "1.25.21",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.20",
+  "version": "1.25.21",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11868,5 +11868,23 @@
       "id": "1005274",
       "text": "A founder who planned their project with the guide now finds the project form and the first Genesis question already filled in, plus a plan file for their own AI."
     }
+  ],
+  "1.25.21": [
+    {
+      "id": "1004162",
+      "text": "Someone already connected to a hosted project who can't manage it is now told what to do next (apply to join, accept their invite, or ask the owner) instead of \"not found\"; strangers still learn nothing, and private projects s"
+    },
+    {
+      "id": "1005130",
+      "text": "When founding a project, the charter step now tells the founder the project is already a monarchy, what every form of government will ask of them day to day, and plainly when a choice changes nothing."
+    },
+    {
+      "id": "1004161",
+      "text": "A project owner can now give a named teammate access to help run their hosted project (view it, restart it, keep its settings list) and take it back; signing in alone still gives nobody access."
+    },
+    {
+      "id": "1005290",
+      "text": "Finished work now reaches a project's test copy first; the owner sees what is waiting and presses promote to put it on the live site, and every promotion is recorded."
+    }
   ]
 }

package/scripts/bongos/genesis.js

@@ -58,7 +58,17 @@ function formatStage(s) {
 // Pure: the charter stage's recommendation from the founder's answers (task 1005119).
 // A recommendation only: choosing is still the founder's.
 function formatAdvice(a) {
-  const out = [`  Recommended government: ${a.charter.name}`, `    Why: ${a.charter.why}`];
+  const out = [];
+  // task 1005130: what is in force now, and what each form asks of you day to day.
+  if (a.in_force) out.push(`  In force now: ${a.in_force.line}`);
+  if (a.forms) {
+    out.push('  The forms you can choose:');
+    for (const f of a.forms.filter((x) => x.available)) {
+      out.push(`    ${f.name}${f.current ? ' (in force now)' : ''}: ${f.who_decides} ${f.to_close}`);
+    }
+  }
+  out.push(`  Recommended government: ${a.charter.name}`, `    Why: ${a.charter.why}`);
+  if (a.charter.on_choose) out.push(`    ${a.charter.on_choose.line}`);
   if (a.charter.council_rank) out.push(`    It is governed by a council rank you create: ${a.charter.council_rank}.`);
   out.push('    It is a recommendation. Any form, or your own settings, is still yours to choose.');
   if (a.preset) {

package/scripts/bongos/government-walk-sole.js

@@ -0,0 +1,41 @@
+'use strict';
+// scripts/bongos/government-walk-sole.js — the government walk's board-of-one rows
+// (task 1005130, part C). Its own file so government-walk.js stays under the size
+// ratchet; the walk calls it with its own helpers, so the rows run through the same
+// real routers and in-memory store as every other row.
+//
+// WHY. A board of one decides by filing: when the sole member of a first_ratifier
+// board files an amendment, their yes is cast in the same call (sole-member.js).
+// These rows prove the other side of that rule through the real routes: a lower rank
+// is refused by the route's own permission gate before anything is filed, and a
+// filing by a builder the board does not seat — a charter change and a rules change —
+// waits for the board with no vote cast.
+
+// What a filing decided in the same call, when a board of one decided it.
+const decidedOf = (r) => (r.json && r.json.decided) || {};
+
+// The genesis pick was adopted by filing: the item passed, and the vote that passed it
+// is the founder's own, recorded as cast by filing.
+function adoptedByFiling({ store, stateOf, itemId, voterId }) {
+  const via = (store.votes.find((v) => v.item_id === String(itemId) && v.voter_id === String(voterId)) || {}).cast_via || 'none';
+  return { got: `${stateOf(itemId)}; the founder's yes, cast by ${via === 'filed' ? 'filing' : via}`, pass: stateOf(itemId) === 'passed' && via === 'filed' };
+}
+
+async function soleMemberRows({ check, call, vote, code, store, stateOf, itemIdOf, ids: { EVE, BEN, FOUNDER_ID }, SHORT_LAW }) {
+  await check('A builder without the right to propose is refused before anything is filed', '403; nothing filed', async () => {
+    const before = store.items.length;
+    const r = await call(EVE, 'POST', '/government/board/laws', { enact: [SHORT_LAW] });
+    return { got: `${r.status}; ${store.items.length === before ? 'nothing filed' : 'a sitting was opened'}`, pass: r.status === 403 && store.items.length === before };
+  });
+  await check('A charter and a rules change filed by a builder the board does not seat wait for the board', 'both sitting open; no vote cast', async () => {
+    const c = await call(BEN, 'POST', '/government/board/charter', { form: 'direct-democracy' });
+    const d = await call(BEN, 'POST', '/government/board/decision-rules', { rules: [{ area: 'review', decided_by: 'rank:council', rule: 'majority' }] });
+    const items = [itemIdOf(c), itemIdOf(d)];
+    const open = items.every((id) => id && stateOf(id) === 'open');
+    const cast = store.votes.filter((v) => items.includes(v.item_id)).length;
+    for (const id of items) if (id) await vote(FOUNDER_ID, id, 'no'); // the board returns both, so nothing is left standing
+    return { got: `${open ? 'both sitting open' : `${c.status} ${code(c)} ${stateOf(items[0])}, ${d.status} ${code(d)} ${stateOf(items[1])}`}; ${cast ? `${cast} vote cast` : 'no vote cast'}`, pass: open && cast === 0 };
+  });
+}
+
+module.exports = { decidedOf, adoptedByFiling, soleMemberRows };

package/scripts/bongos/government-walk.js

@@ -49,6 +49,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { decidedOf, adoptedByFiling, soleMemberRows } = require('./government-walk-sole'); // task 1005130: a board of one decides by filing
 
 const ROOT = path.resolve(__dirname, '..', '..');
 const DOC_PATH = path.join(ROOT, 'docs', 'governance', 'government-walk.md');
@@ -262,9 +263,9 @@ function makeStore(catalog) {
       }
       return item.opened_by ?? null;
     },
-    async insertBoardVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null }) {
+    async insertBoardVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null, castVia = 'ballot' }) {
       if (s.votes.some((v) => v.item_id === String(itemId) && v.voter_id === String(voterId))) return null;
-      const row = { id: next(), item_id: String(itemId), voter_id: String(voterId), direction, reason_md: reasonMd, section_key: sectionKey, cast_at: tick() };
+      const row = { id: next(), item_id: String(itemId), voter_id: String(voterId), direction, reason_md: reasonMd, section_key: sectionKey, cast_via: castVia, cast_at: tick() };
       s.votes.push(row);
       return copy(row);
     },
@@ -774,20 +775,17 @@ async function runWalk() {
     return { got: `${r.status}, stage ${stage}`, pass: r.status === 200 && stage === 'decide' };
   });
   let charterItem = null;
-  await check(`Deciding with ${CHOSEN} saves the plan and files the pick as a charter amendment`, 'plan saved, charter sitting, one vote decides', async () => {
+  await check(`Deciding with ${CHOSEN} saves the plan and files the pick as a charter amendment`, 'plan saved, charter adopted', async () => {
     const r = await call(FOUNDER, 'POST', '/founding/plan', { government: CHOSEN });
     const c = (r.json && r.json.charter) || {};
     charterItem = c.item_id || null;
-    return { got: `${r.status}, charter ${c.state}, one vote decides ${c.one_vote_decides}`, pass: r.status === 200 && c.state === 'sitting' && c.one_vote_decides === true };
+    return { got: `${r.status}, charter ${c.state}`, pass: r.status === 200 && c.state === 'adopted' && !!charterItem };
   });
   await check('Saving the plan moved the project to its first stage', 'stage scope', async () => {
     const g = await genesis.readGenesis();
     return { got: `stage ${g && g.stage}`, pass: !!g && g.stage === 'scope' };
   });
-  await check('The founder\'s one yes ratifies the pick under the Monarchy it is born with', 'passed', async () => {
-    const r = await vote(FOUNDER, charterItem);
-    return { got: `${r.status} ${r.json && r.json.outcome}`, pass: r.status === 201 && r.json.outcome === 'passed' };
-  });
+  await check('The founder\'s one yes ratifies the pick under the Monarchy it is born with: as its only member, choosing it was that yes', 'passed; the founder\'s yes, cast by filing', async () => adoptedByFiling({ store, stateOf, itemId: charterItem, voterId: FOUNDER }));
   await check('The constitution now reads as the government chosen at decide', `reads as ${CHOSEN}, no divergence`, async () => {
     const c = await constitution();
     const f = c && c.charter && c.charter.reads_as && c.charter.reads_as.form;
@@ -928,8 +926,8 @@ async function runWalk() {
     const r = await call(FOUNDER, 'POST', '/government/board/decision-rules', { rules });
     const itemId = r.json && r.json.item && r.json.item.id;
     if (r.status !== 201 || !itemId) return { ok: false, why: `${r.status} ${code(r)}` };
-    const v = await vote(FOUNDER, itemId);
-    return { ok: v.status === 201 && v.json.outcome === 'passed', why: `vote ${v.status} ${v.json && v.json.outcome}` };
+    const d = decidedOf(r); // the founder is the Monarchy's only member, so filing it is their one yes
+    return { ok: d.closed === true && d.outcome === 'passed', why: `filed ${d.outcome || 'undecided'}` };
   }
   const rowOf = async (area) => {
     const c = await constitution();
@@ -1094,12 +1092,13 @@ async function walkNewMachinery({ call, code, vote, voteAll, check, section, sta
     const s = await positionsPort().lawsForSession();
     return { got: `${book.in_force} in force; ${s.inject ? 'a laws block' : 'no laws block'}`, pass: book.in_force === 0 && s.inject === false };
   });
-  await check('A law is proposed: filed as a laws amendment, and proposing writes nothing', '201, sitting open; still 0 in force', async () => {
-    const r = await call(FOUNDER_ID, 'POST', '/government/board/laws', { enact: [SHORT_LAW] });
+  await check('A law is proposed by a builder the board does not seat: filed as a laws amendment, and proposing writes nothing', '201, sitting open; still 0 in force', async () => {
+    const r = await call(BEN, 'POST', '/government/board/laws', { enact: [SHORT_LAW] });
     lawItem = itemIdOf(r);
     const book = await lawsInForce();
     return { got: `${r.status}, sitting ${stateOf(lawItem)}; still ${book.in_force} in force`, pass: r.status === 201 && stateOf(lawItem) === 'open' && book.in_force === 0 };
   });
+  await soleMemberRows({ check, call, vote, code, store, stateOf, itemIdOf, ids: { EVE, BEN, FOUNDER_ID }, SHORT_LAW });
   await check('Someone the board does not seat cannot pass it', '403 not_board_member', async () => {
     const r = await vote(BEN, lawItem);
     return { got: `${r.status} ${code(r)}`, pass: r.status === 403 && code(r) === 'not_board_member' };
@@ -1134,9 +1133,9 @@ async function walkNewMachinery({ call, code, vote, voteAll, check, section, sta
     const r = await call(BEN, 'PATCH', '/me/interaction', { verbosity: 'concise' });
     return { got: `${r.status}`, pass: r.status === 200 };
   });
-  await check('Repealed by a vote, the law leaves every session and unlocks the setting', 'passed; 0 in force; no laws block; 200', async () => {
+  await check('Repealed by the founder, the board\'s only member, whose filing is their one yes: the law leaves every session and unlocks the setting', 'passed; 0 in force; no laws block; 200', async () => {
     const r = await call(FOUNDER_ID, 'POST', '/government/board/laws', { repeal: [lawId] });
-    const v = await vote(FOUNDER_ID, itemIdOf(r));
+    const v = { json: { outcome: decidedOf(r).outcome } };
     const book = await lawsInForce();
     const s = await positionsPort().lawsForSession();
     const w = await call(BEN, 'PATCH', '/me/interaction', { verbosity: 'detailed' });
@@ -1152,7 +1151,7 @@ async function walkNewMachinery({ call, code, vote, voteAll, check, section, sta
     await check(`Strictness: ${from} to ${key} is one vote, and its locks bite`, `one sitting; passed; ${key} in force; exploratory wandering ${wander}`, async () => {
       const r = await call(FOUNDER_ID, 'POST', '/government/board/presets', { preset: key });
       const id = itemIdOf(r);
-      const v = await vote(FOUNDER_ID, id);
+      const v = { json: { outcome: decidedOf(r).outcome } }; // the only member's filing is their one yes
       const p = await presetNow();
       const w = await call(BEN, 'PATCH', '/me/wandering', { wandering: 3 });
       const ws = `${w.status}${w.status === 200 ? '' : ` ${code(w)}`}`;
@@ -1162,7 +1161,7 @@ async function walkNewMachinery({ call, code, vote, voteAll, check, section, sta
   await check('Every preset law is repealed by one more vote, so the book ends empty', 'passed; 0 in force; no preset', async () => {
     const ids = ((await lawsInForce()).laws || []).map((l) => l.id);
     const r = await call(FOUNDER_ID, 'POST', '/government/board/laws', { repeal: ids });
-    const v = await vote(FOUNDER_ID, itemIdOf(r));
+    const v = { json: { outcome: decidedOf(r).outcome } }; // the only member's filing is their one yes
     const book = await lawsInForce();
     const p = await presetNow();
     return { got: `${v.json && v.json.outcome}; ${book.in_force} in force; ${p.current ? `${p.current} in force` : 'no preset'}`, pass: book.in_force === 0 && p.current == null };

package/scripts/bongos/provision-render-common.js

@@ -0,0 +1,48 @@
+'use strict';
+// provision-render-common.js — the pieces every Render runner leg shares: the client for a
+// lent key, the one app_host writer, clearing the key, and an owner-readable reason
+// (task 1005290; first written in provision-render.js by task 1004183).
+//
+// WHY ITS OWN FILE. The standup leg (provision-render.js), the sandbox leg
+// (provision-render-sandbox.js) and the promote leg (provision-render-promote.js) all
+// need these. Kept in the standup file, the sandbox leg reaching back for them made a
+// require cycle (the standup file requires the sandbox file), which the fitness ratchet
+// rightly refuses. Here, every leg depends on this file and on nothing of each other's.
+
+const { RenderApi } = require('./render-api.js');
+
+// A key waiting longer than this was lent for a run that never came. It is refused and
+// cleared rather than spent late.
+const KEY_TTL_MS = 30 * 60 * 1000;
+
+function renderApiFor(deps, token, ownerId) {
+  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
+  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
+}
+
+// Merge `patch` into the row's app_host. The runner is the only writer while an intent
+// runs, and the web tier only writes it when enqueuing, which the open-intent index
+// serialises — so a merge needs no read-modify-write.
+async function recordAppHost(db, instId, patch) {
+  await db.query(
+    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
+    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
+}
+
+async function clearBorrowedKey(db, intentId) {
+  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
+}
+
+// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
+// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
+// so an answer from Render is re-said as a sentence with Render's own reason kept whole
+// (task 1004464). Anything else is already the leg's own words.
+function plainReason(e) {
+  const msg = e && e.message ? e.message : String(e);
+  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
+  if (said) return `Render would not set up the app: ${said}`;
+  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
+  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
+}
+
+module.exports = { KEY_TTL_MS, renderApiFor, recordAppHost, clearBorrowedKey, plainReason };