@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/plan/executor.js

@@ -1,19 +1,25 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { URL } from 'node:url';
+import { EdgeApiError } from '@wtfalch/edge';
 import { coolifyImageFor } from '../bootstrap/versions.js';
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { resolveCallsSfuUrls } from '../calls-sfu.js';
-import { APP_ENTRY_KEY, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, filesCollectionEnvName, heldEnvRef, isMainEntry, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
+import { APPS_DOMAIN, APP_ENTRY_KEY, FULL_COMMIT_SHA, ORG_POSTGRES_SERVER_SCOPE_KEY, ORG_SERVICE_SCHEMAS, appsOn, companyGithubFor, filesCollectionEnvName, heldEnvRef, isLiveEntry, isMainEntry, kosmosOn, mainEntry, ownerMailboxRecorded, ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { adoptedKeysUnreadable, parseAdoptSnapshot } from './adopt.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_DEPLOYED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_CALLS_APPLIED_SCOPE_KEY, CHAT_CALLS_TOKEN_SCOPE_KEY, CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, DESKTOP_AUTH_PORT, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatCallsApplied, chatHasUpstreams, chatIntrospectionAppName, desiredAgoraEnv, desktopAuthInternalName, entryClientIdScopeKey, } from './agora.js';
-import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, } from './blue-green-apply.js';
-import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, splitServers, } from './blue-green.js';
+import { APPS_DATABASE_ADMIN_URL_ENV, applyAppsDbRoute, retireAppsDbRoute, } from './apps-db-route.js';
+import { APPS_ZONES_APPLIED_SCOPE_KEY, applyAppsZones, retireAppsZones } from './apps-zones.js';
+import { applyBlueGreenConnectors, applyBlueGreenServer, applyBlueGreenWeights, applyWorkspaceServer, } from './blue-green-apply.js';
+import { actionsKeyName, bgKey, blueGreenSubjects, colorAppName, healthTokenName, liveAppNameFor, mintActionsKey, mintPinKey, pinKeyName, splitServers, } from './blue-green.js';
 import { BouleOwnersError, httpBouleOwners } from './boule-owners-http.js';
-import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
-import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { BOULE_ARCHON_CREDENTIAL_ENV, BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, BOULE_BRIDGE_SECRET_ENV, BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_CUSTOMERS_CREDENTIAL_ENV, BOULE_CUSTOMERS_ORG_ENV, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, BOULE_OWNER_SEED_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_SECRETS_RESTARTED_SCOPE_KEY, BOULE_TEST_CUSTOMERS_ORG_ENV, CUSTOMERS_DIRECTORY_USER_SCOPE_KEY, CUSTOMERS_ROOM_METADATA_KEY, CUSTOMERS_ROOM_SCOPE_KEY, CUSTOMERS_SIGN_IN_METADATA_KEY, CUSTOMERS_SIGN_IN_SCOPE_KEY, CUSTOMERS_SIGN_UP_SCOPE_KEY, archonCredentialRenewDue, bouleArchonCredentialRef, bouleEnvDrift, bouleHostnameFor, bouleMailWanted, bouleOwnerRefusedScopeKey, bouleOwnerSeededScopeKey, bouleOwnerSeeds, customersDirectoryRef, customersOrgIdOf, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
+import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, entryMcp, entryMcpProjectScopeKey, mcpCallbackUri, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
+import { AUTH_REGISTRAR_KEY_ENV, AUTH_REGISTRAR_URL_ENV, REGISTRAR_APPLIED_SCOPE_KEY, REGISTRAR_DELIVERED_SCOPE_KEY, REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, REGISTRAR_MINTED_SCOPE_KEY, REGISTRAR_REMOVAL_HELD_SCOPE_KEY, appliedRegistrarOrganization, ensureRegistrarKey, registrarAppliedValue, registrarRef, registrarWanted, wantedRegistrar, writeRegistrar, } from './broker-registrar.js';
+import { BROKER_WORKSPACES_DATABASE_SCOPE_KEY, canHoldWorkspacesDatabase, ensureBrokerWorkspacesDatabase, } from './broker-workspaces-database.js';
 import { recordBuiltCommit } from './build-record.js';
-import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
+import { CallError, withTimeout as withLabelledTimeout } from './call-timeout.js';
+import { MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsSynapseHomeserverYaml, masDockerfile, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
 import { CHAT_MAS_PORT, CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOCKERFILE, CHAT_SYNAPSE_PORT, assertChatServerName, chatInternalNames, chatMasConfigYaml, chatRekeyedInternalNames, chatServerName, chatServiceEnvs, chatSynapseHomeserverYaml, chatUpstreams, } from './chat-matrix.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { BACKUP_POSTGRES_DATABASES_SCOPE_KEY, BACKUP_SCOPE_PREFIX, COMPANY_BACKUP_DATABASE_NAMES, backupScopeKey, } from './company-backups.js';
@@ -23,7 +29,7 @@ import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FI
 import { waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { DESKTOP_AUTH_APP_SCOPE_KEY, DESKTOP_AUTH_DEPLOYED_SCOPE_KEY, DESKTOP_AUTH_DOCKERFILE, DESKTOP_AUTH_HOME, DESKTOP_AUTH_ORIGIN_SCOPE_KEY, DESKTOP_AUTH_READY_PATH, DESKTOP_AUTH_READY_SCOPE_KEY, DESKTOP_AUTH_REDIRECT_SCOPE_KEY, DESKTOP_AUTH_REVISION_SCOPE_KEY, desktopAuthCallbackUri, desktopAuthEnv, desktopAuthInputs, desktopAuthRedirectUnsupported, desktopAuthRevision, } from './desktop-auth.js';
 import { signInCallbackAppliedValue, signInRedirectUris, unionRedirectUris, zitadelAppDesktopCallbackAppliedScopeKey, } from './desktop-callback.js';
-import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, } from './destinations.js';
+import { PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, onPlatformNetwork, placed, placedByScope, placedOnPlatform, } from './destinations.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
 import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
 import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
@@ -31,29 +37,40 @@ import { createEdgeRateLimits, } from './edge-ratelimits.js';
 import { createEdgeTunnels } from './edge-tunnels.js';
 import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
-import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { applyEntryAudit } from './entry-audit.js';
+import { CUSTOMER_GRANTS_CREDENTIAL_ENV, CUSTOMER_GRANTS_ENV, CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, customerGrantsEntries, customerGrantsJson, customerGrantsMintedScopeKey, customerGrantsRef, customerGrantsToDrop, ensureCustomerGrantsCredential, wantedCustomerGrants, } from './entry-customer-grants.js';
+import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, EDGE_SLUG_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, bouleEdgeKeyWanted, edgeKeyAppRecordKey, edgeKeyDomain, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { entryJobsAppliedScopeKey, entryJobsRefs, entryJobsUndeliveredScopeKey, entryJobsWantMarker, } from './entry-jobs.js';
+import { ensureRepoKey, removeRepoKey } from './entry-repo-key-apply.js';
+import { BROKER_WORKSPACES_DATABASE_ENV, ensureWorkspacesKey, heldWorkspacesDatabase, heldWorkspacesKey, workspacesDatabaseRef, workspacesKeyHash, workspacesKeyRef, } from './entry-workspaces.js';
 import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
+import { GITHUB_SOURCE_INSTALLATION_SCOPE_KEY, GITHUB_SOURCE_TIMEOUT_MS, ensureGithubSource, githubSourceResourceKey, } from './github-source.js';
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
-import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
+import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, workspaceHost, } from './hostnames.js';
+import { KEYS_REGISTRAR_DELIVERY_ATTEMPTS, KEYS_REGISTRAR_KEY_DAYS, KEYS_REGISTRAR_KEY_ENV, KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, KEYS_REGISTRAR_URL_ENV, } from './keys-registrar.js';
+import { KOSMOS_CLIENT_ID_SCOPE_KEY, KOSMOS_DATABASE_SCOPE_KEY, KOSMOS_DEPLOYED_SCOPE_KEY, desiredKosmosEnv, kosmosEnvDrift, kosmosHostnameFor, } from './kosmos.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { machineBypassScopeKey } from './machine-paths.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
 import { applyAccessTokenLifetime, applyMcpAccess, applyMcpProject } from './mcp.js';
 import { NETWORK_APPLIED_SCOPE_KEY } from './network-move.js';
+import { provisionOrgAppsAdmin, retireOrgAppsAdmin, } from './org-apps-admin.js';
 import { ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, migrateHomeOf, migrateOrgPostgresHome, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { orgPostgresSecretRef, provisionOrgPostgresDatabases, provisionOrgPostgresServer, serviceEndpoint, serviceOnServer, serviceUrls, } from './org-postgres.js';
 import { OWN_AUTH_APPLIED_GIT_REF_SCOPE_KEY, OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, } from './own-diff.js';
 import { NO_DOMAIN_ZONE, ownHostnames } from './own-hostnames.js';
+import { provisionJobsRoute } from './own-jobs-route.js';
 import { LIMITS, limited } from './own-limits.js';
-import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, scopeFromOrg, } from './own-services.js';
+import { OWN_FILES_R2_SCOPE_KEY, OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, OWN_SERVICES_APPLIED_SCOPE_KEY, OwnServicesBlockedError, orgNetwork, orgTarget, platformTarget, scopeFromOrg, } from './own-services.js';
 import { ownSfuUrls, provisionSfuApp } from './own-sfu.js';
-import { PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
+import { JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, } from './platform-diff.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, orgDeclaresMcp, resolveAppEnv, serviceDbEnvAppliedScopeKey, zitadelAppIdTokenUserinfoAppliedScopeKey, } from './platform-diff.js';
-import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
+import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, PLATFORM_AUTH_LOGIN_SCOPE_KEY, PLATFORM_AUTH_PROJECT, PLATFORM_MAIL_SERVER_SCOPE_KEY, defaultStalwartForInstance, filesDepsInvalid, filesShareDomains, provisionAuthStack, provisionDatabaseBackup, provisionFilesHost, provisionJobsHost, provisionMailServer, resolveOwnFilesKeys, } from './platform-providers.js';
 import { companyAppPostLogoutUris, postLogoutAppliedValue, zitadelAppPostLogoutAppliedScopeKey, } from './post-logout-uris.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
+import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, ENTRY_CONTAINER_LABELS, appLabelsAppliedScopeKey, builtinRoutes, entryAppsHostnames, entryLabelHash, entryLabelSpec, entryOikosHostnames, entryProxyLabels, entryRoutes, entryRoutesMarker, ownsAppsZoneName, ownsOikosName, routesWithoutToken, sameLabelSets, } from './proxy-labels.js';
 import { createReleaseHost } from './release-host.js';
 import { TUNNEL_HTTP_INGRESS_SCOPE_KEY, applyRemoteDatabase, mergeTcpIngress, recordedTcpRoutes, } from './remote-database.js';
 import { editSignInBindings } from './sign-in-bindings.js';
@@ -64,6 +81,9 @@ import { stageGateKey, stageHostname, } from './stage-guards.js';
 import { WORKER_APP_DB_SCOPE_KEYS, provisionWorkerAppDb, workerAppDbCaPem, workerAppDbOwnerUrl, } from './worker-app-db.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, applyWorkerApp, heldBrokerKey, teardownWorkerApp, withCallTimeout, } from './worker-app.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
+import { TEST_CUSTOMERS_SIGN_IN_SCOPE_KEY, TEST_CUSTOMERS_SIGN_UP_SCOPE_KEY, testCustomersOrgName, workspaceAuthEntryOf, workspaceClientHosts, workspaceClientKey, } from './workspace-client.js';
+import { liveClientIds, wantedWorkspaceBrokerEntry, workspaceAuthEnv, workspaceSignInMarker, } from './workspace-sign-in.js';
+import { gatePeopleScopeKey, isServerWorkspace, peopleHash, readWorkspaceCommit, withWorkspaceWorkers, workspaceGateKey, workspaceStructureHash, workspaceSubject, wsKey, } from './workspace.js';
 /**
  * The real {@link StepExecutor} (#20 "provision Company Factory end to
  * end"): makes each {@link StepAction} `diff.ts` plans true against a real
@@ -116,9 +136,24 @@ export function adaptZitadelListApps(client) {
 }
 /** An outside call for Boule's credentials that has not answered in this long fails the step; the next apply repairs it. */
 const BOULE_CREDENTIAL_TIMEOUT_MS = 60_000;
+/** One read of the broker's env. */
+const BROKER_ENV_READ_TIMEOUT_MS = 15_000;
+const HELD_KEY_READ_TIMEOUT_MS = 15_000;
 const BOULE_CREDENTIAL_ATTEMPTS = 3;
 /** The ZITADEL machine user that reads one company's customers organisation. */
 const CUSTOMERS_DIRECTORY_USER_NAME = 'foundry-customers-directory';
+const LIVE_CUSTOMERS = {
+    step: 'zitadel:customers',
+    name: (slug) => `${slug} customers`,
+    signUpKey: CUSTOMERS_SIGN_UP_SCOPE_KEY,
+    signInKey: CUSTOMERS_SIGN_IN_SCOPE_KEY,
+};
+const TEST_CUSTOMERS = {
+    step: 'zitadel:customers-test',
+    name: testCustomersOrgName,
+    signUpKey: TEST_CUSTOMERS_SIGN_UP_SCOPE_KEY,
+    signInKey: TEST_CUSTOMERS_SIGN_IN_SCOPE_KEY,
+};
 // ---------------------------------------------------------------------------
 // Errors
 // ---------------------------------------------------------------------------
@@ -358,6 +393,15 @@ export const BOULE_REPO = 'wtfalch/boule';
 export const BOULE_APP_DOCKERFILE = '/Dockerfile';
 /** Boule's own `EXPOSE 3000` (its doc comment just above) -- the port its health check (#543) probes. */
 export const BOULE_PORT = 3000;
+/**
+ * foundry#949: kosmos (https://github.com/wtfalch/kosmos), bootstrapped from the same `wtfalch/package-template`
+ * service shape Boule is, with its own Dockerfile at the repository root, serving on 3000 (`EXPOSE 3000`) and
+ * running its migrations through `apps/host/scripts/migrate.mjs` before it serves, the same shape Boule's
+ * `migrate-and-start.sh` follows.
+ */
+export const KOSMOS_REPO = 'wtfalch/kosmos';
+export const KOSMOS_APP_DOCKERFILE = '/Dockerfile';
+export const KOSMOS_PORT = 3000;
 /**
  * Every app foundry deploys keeps its own logs across a redeploy, so a
  * database outage does not also erase the only other copy of the evidence
@@ -623,6 +667,14 @@ const CALLS_SYNAPSE_SCOPE_KEY = 'coolify_calls_synapse';
 const CALLS_MAS_SCOPE_KEY = 'coolify_calls_mas';
 const CALLS_SYNAPSE_DB_SCOPE_KEY = 'coolify_calls_synapse_database';
 const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
+/** #430: the calls service's own Matrix/MAS env vars, from before calls#93 (transit-only). Removed from every org's calls service, never written again. */
+const CALLS_MATRIX_ENV_KEYS = [
+    'MAS_URL',
+    'MAS_HOMESERVER',
+    'MAS_CLIENT_ID',
+    'MAS_CLIENT_SECRET',
+    'SYNAPSE_URL',
+];
 /**
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
@@ -859,6 +911,10 @@ async function withTimeout(work, ms) {
         clearTimeout(timer);
     }
 }
+/** How long one call to the jobs scheduler or the held keys, made for an entry's project, may take. */
+const JOBS_PROJECT_CALL_TIMEOUT_MS = 30_000;
+/** How many times an entry's project credentials are tried against the held keys. */
+const JOBS_PROJECT_HOLD_ATTEMPTS = 3;
 /** How long one Lettermint call of an own company's sign-in mint may take. */
 const LETTERMINT_TIMEOUT_MS = 60_000;
 const OWN_SERVICES_PORT_ABSENT = 'this org runs its own services and the host has no ownServices port for it';
@@ -889,7 +945,11 @@ function limitProfileOf(action) {
         case 'coolify:app':
         case 'coolify:database':
             return LIMITS.companyApp;
+        case 'coolify:github-source':
+            return undefined;
         case 'coolify:broker-entry':
+        case 'coolify:workspace-broker-entry':
+        case 'coolify:workspaces-database':
             return LIMITS.brokerEntry;
         case 'cms:site':
             return LIMITS.cms;
@@ -905,8 +965,16 @@ function limitProfileOf(action) {
         case 'coolify:boule':
         case 'coolify:boule-broker-entry':
             return LIMITS.boule;
+        case 'coolify:kosmos':
+            return LIMITS.kosmos;
+        case 'coolify:broker-registrar':
+            return LIMITS.brokerEntry;
+        case 'coolify:keys-registrar':
+            return LIMITS.boule;
         case 'coolify:bluegreen':
         case 'coolify:bluegreen-lb':
+        case 'coolify:workspace':
+        case 'coolify:promote':
             return LIMITS.companyApp;
         case 'cloudflare:tunnel':
         case 'coolify:bluegreen-connector':
@@ -1087,6 +1155,58 @@ export class FoundryStepExecutor {
             throw e;
         }
     }
+    /**
+     * Where the workspaces database of the broker this org's entries are written to already is: in the broker's
+     * `WORKSPACES_DATABASE_URL` (`inEnv`) or as a URL held at the org's ref (`held`). The company's own broker for an
+     * org that owns its services, the shared one otherwise. Throws when the broker is not wired or a read fails,
+     * times out, or finds a held value that is no postgres URL, so a caller never takes "unknown" for "absent".
+     */
+    async workspacesDatabaseSources(org, recordedIds) {
+        const broker = ownsServices(org)
+            ? (await this.ports.ownServices?.portsFor(org, recordedIds))?.broker
+            : this.ports.broker;
+        if (!broker)
+            throw new Error('the broker port is not wired');
+        const envs = await withLabelledTimeout('the broker env read', BROKER_ENV_READ_TIMEOUT_MS, () => broker.listEnvs());
+        if (envs.some((e) => e.key === BROKER_WORKSPACES_DATABASE_ENV && !e.is_preview && e.value)) {
+            return { inEnv: true, held: false };
+        }
+        const held = await withLabelledTimeout('the held key read', HELD_KEY_READ_TIMEOUT_MS, () => heldWorkspacesDatabase(this.ports.heldKeys, workspacesDatabaseRef(org)));
+        return { inEnv: false, held: Boolean(held) };
+    }
+    /**
+     * Whether the broker this org's entries are written to has `WORKSPACES_DATABASE_URL`, or a URL is held to give it.
+     * A read that fails or times out answers `false`, so the plan does not write an entry the broker cannot start
+     * with.
+     */
+    async brokerHasWorkspacesDatabase(org, recordedIds) {
+        try {
+            const { inEnv, held } = await this.workspacesDatabaseSources(org, recordedIds);
+            return inEnv || held;
+        }
+        catch {
+            // Not readable (blocked own services, a timeout, a failed call, a held value that is no URL): the plan reports the entry blocked.
+            return false;
+        }
+    }
+    /**
+     * Whether foundry may make the broker's workspaces database: it can hold the URL, and a read just showed that
+     * neither the broker nor the held keys have one. A read that fails answers `false`, never "make one": a database
+     * made over a broker whose own could not be read would replace it.
+     */
+    async canProvisionWorkspacesDatabase(org, recordedIds) {
+        if (!canHoldWorkspacesDatabase(this.ports.heldKeys))
+            return false;
+        if (ownsServices(org) && !this.ports.ownServices)
+            return false;
+        try {
+            const { inEnv, held } = await this.workspacesDatabaseSources(org, recordedIds);
+            return !inEnv && !held;
+        }
+        catch {
+            return false;
+        }
+    }
     /** #555: the edge-routed ports this executor was built with itself (they win over edge). */
     ownEdgePorts() {
         return {
@@ -1165,6 +1285,8 @@ export class FoundryStepExecutor {
                 return this.zitadelDesktopCallback(action, org, context);
             case 'zitadel:customers':
                 return this.zitadelCustomers(action, org, context);
+            case 'zitadel:customers-test':
+                return this.zitadelCustomers(action, org, context, TEST_CUSTOMERS);
             case 'zitadel:mcp-project':
                 return this.zitadelMcpProject(action, org, context);
             case 'zitadel:mcp-access':
@@ -1173,14 +1295,24 @@ export class FoundryStepExecutor {
                 return this.zitadelAccessTokenLifetime(context);
             case 'coolify:app':
                 return this.coolifyApp(action, org, context);
+            case 'coolify:github-source':
+                return this.coolifyGithubSource(org, context);
             case 'coolify:network':
                 return this.coolifyNetwork(action, org, context);
             case 'coolify:bluegreen':
             case 'coolify:bluegreen-lb':
             case 'coolify:bluegreen-connector':
                 return this.coolifyBlueGreen(action, org, context);
+            case 'coolify:workspace':
+                return this.coolifyWorkspace(action, org, context);
+            case 'coolify:promote':
+                return this.coolifyPromote(action, org, context);
             case 'coolify:broker-entry':
                 return this.coolifyBrokerEntry(action, org, context);
+            case 'coolify:workspace-broker-entry':
+                return this.coolifyWorkspaceBrokerEntry(action, org, context);
+            case 'coolify:workspaces-database':
+                return this.coolifyWorkspacesDatabase(org, context);
             case 'coolify:database':
                 return this.coolifyDatabase(action, org, context);
             case 'coolify:org-postgres':
@@ -1189,6 +1321,12 @@ export class FoundryStepExecutor {
                 return this.orgPostgresDatabases(action, org, context);
             case 'coolify:org-postgres-migrate':
                 return this.orgPostgresMigrate(action, org, context);
+            case 'coolify:org-apps-admin':
+                return this.orgAppsAdmin(action, org, context);
+            case 'cloudflare:apps-db-route':
+                return this.appsDbRoute(action, org, context);
+            case 'cloudflare:apps-zones':
+                return this.appsZones(action, org, context);
             case 'coolify:backup':
                 return this.coolifyBackup(action, org, context);
             case 'coolify:calls':
@@ -1202,7 +1340,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:zone':
                 return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
-                return this.cloudflareAccess(action, org);
+                return this.cloudflareAccess(action, org, context);
             case 'cloudflare:gate':
                 return this.cloudflareGate(action, org, context);
             case 'cloudflare:ratelimit':
@@ -1214,7 +1352,7 @@ export class FoundryStepExecutor {
                 if (!workers) {
                     throw new Error(`cloudflare:worker-app for ${org.slug}: this executor was built without a WorkerAppPort`);
                 }
-                return applyWorkerApp(this.workerAppDeps(workers, org, () => context.recordedIds()), org, action, context);
+                return applyWorkerApp(this.workerAppDeps(workers, org, () => context.recordedIds()), withWorkspaceWorkers(org), action, context);
             }
             case 'files:organisation':
                 return this.filesOrganisation(action, org, context);
@@ -1236,6 +1374,14 @@ export class FoundryStepExecutor {
                 return this.edgeEntryKey(action, org, context);
             case 'edge:reserved-labels':
                 return this.edgeReservedLabels(action, org, context);
+            case 'edge:slug':
+                return this.edgeSlug(action, org, context);
+            case 'jobs:project':
+                return this.jobsProject(action, org, context);
+            case 'github:deploy-key':
+                return this.githubDeployKey(action, org, context);
+            case 'audit:ledger':
+                return this.auditLedger(action, org, context);
             case 'coolify:mail':
                 return this.coolifyMail(action, org, context);
             case 'coolify:mail-copy':
@@ -1254,6 +1400,12 @@ export class FoundryStepExecutor {
                 return this.bouleOwners(org, context);
             case 'coolify:boule-broker-entry':
                 return this.bouleBrokerEntry(org, context);
+            case 'coolify:kosmos':
+                return this.coolifyKosmos(action, org, context);
+            case 'coolify:broker-registrar':
+                return this.brokerRegistrar(org, context);
+            case 'coolify:keys-registrar':
+                return this.keysRegistrar(action, org, context);
             case 'jobs:registration':
                 return this.jobsRegistration(action, org, context);
             case 'cloudflare:db-route':
@@ -1266,6 +1418,8 @@ export class FoundryStepExecutor {
                 return this.workerAppDb(org, context);
             case 'coolify:own-jobs':
                 return this.ownJobs(action, org, context);
+            case 'coolify:own-jobs-route':
+                return this.ownJobsRoute(action, org, context);
             case 'coolify:own-mail':
                 return this.ownMail(action, org, context);
             case 'coolify:own-sfu':
@@ -1288,7 +1442,10 @@ export class FoundryStepExecutor {
      * app carries any policy but foundry's, since that policy could let others
      * in.
      */
-    async cloudflareAccess(action, org) {
+    async cloudflareAccess(action, org, context) {
+        const machine = action.desired.machineBypass;
+        if (machine)
+            return this.cloudflareMachineBypass(action, org, context);
         const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
         const owned = action.desired.ownedBypass;
         if (!rule && owned && appStepKey(org, owned) === action.key) {
@@ -1310,6 +1467,41 @@ export class FoundryStepExecutor {
             policy: await this.accessPolicyFor(org, rule),
         });
     }
+    /**
+     * F11 (`plan/machine-paths.ts`): one path-scoped Access application (`<host><path>`) with foundry's bypass
+     * policy, so a machine caller is not stopped by the host's gate; or its removal. The stem of the step key
+     * (`mp-<hash>`) names it; the recorded `host/path` is kept only to word the removal.
+     */
+    async cloudflareMachineBypass(action, org, context) {
+        const stem = action.key.slice(org.id.length + 1);
+        const desired = action.desired;
+        if (desired.machineBypass === 'delete') {
+            const id = context.recordedIds()[`cloudflare:access:${action.key}`];
+            if (id) {
+                try {
+                    await this.accessPort().deleteAccessApp(id);
+                }
+                catch (error) {
+                    if (!isEdgeNotFound(error))
+                        throw error;
+                }
+            }
+            forgetScopeId(context, `cloudflare:access:${action.key}`);
+            forgetScopeId(context, machineBypassScopeKey(stem));
+            return {};
+        }
+        if (!desired.domain) {
+            throw new Error(`cloudflare:access for ${org.slug}: machine bypass '${stem}' names no host and path`);
+        }
+        const result = await this.cloudflareAccessApp(org, {
+            appName: `foundry:${org.id}:${desired.domain}`,
+            domain: desired.domain,
+            policyName: ACCESS_RULE_POLICY_NAMES.bypass,
+            policy: await this.accessPolicyFor(org, { kind: 'bypass', hostname: desired.domain }),
+        });
+        context.recordScopeId(machineBypassScopeKey(stem), desired.domain);
+        return result;
+    }
     /**
      * `plan/diff.ts`'s `planGates`: makes, changes or deletes one declared
      * gate through edge. A create needs the platform's recorded Access provider,
@@ -1326,13 +1518,30 @@ export class FoundryStepExecutor {
         const recorded = context.recordedIds();
         const gateId = recorded[gateIdRecordKey(org.id, gateKey)];
         const hostnamesKey = gateHostnamesScopeKey(gateKey);
+        const peopleKey = gatePeopleScopeKey(gateKey);
         if (desired.mode === 'delete') {
             if (gateId)
                 await this.accessPort().deleteGate(gateId);
             if (context.forgetId) {
                 context.forgetId(gateIdRecordKey(org.id, gateKey));
                 context.forgetId(hostnamesKey);
+                context.forgetId(peopleKey);
+            }
+            return {};
+        }
+        if (desired.mode === 'people') {
+            const emails = desired.emails ?? [];
+            if (!gateId)
+                throw new Error(`${at}: no gate is recorded, so there is no one to change`);
+            if (emails.length === 0) {
+                throw new Error(`${at}: a gate nobody can pass is a mistake, and the list is empty`);
             }
+            const access = this.accessPort();
+            if (!access.setGatePeople) {
+                throw new Error(`${at}: this host's Access port cannot change who passes a gate`);
+            }
+            await access.setGatePeople(gateId, emails);
+            context.recordScopeId(peopleKey, peopleHash(emails));
             return {};
         }
         const hostnames = desired.hostnames ?? [];
@@ -1346,6 +1555,7 @@ export class FoundryStepExecutor {
                 // The gate is gone at edge: forget it, so the next plan creates it again.
                 context.forgetId?.(gateIdRecordKey(org.id, gateKey));
                 context.forgetId?.(hostnamesKey);
+                context.forgetId?.(peopleKey);
                 return {};
             }
             context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
@@ -1358,7 +1568,7 @@ export class FoundryStepExecutor {
         if (!claimValue) {
             throw new Error(`${at}: ${org.slug} has no sign-in organisation recorded yet`);
         }
-        const emails = org.owners.map((owner) => owner.email);
+        const emails = desired.emails ?? org.owners.map((owner) => owner.email);
         if (emails.length === 0) {
             throw new Error(`${at}: ${org.slug} declares no owner with an email, and a gate nobody can pass is a mistake`);
         }
@@ -1373,6 +1583,8 @@ export class FoundryStepExecutor {
             emails,
         });
         context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
+        if (desired.emails)
+            context.recordScopeId(peopleKey, peopleHash(desired.emails));
         return { resourceId: created.id };
     }
     /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
@@ -1535,6 +1747,7 @@ export class FoundryStepExecutor {
                             return db.internal_db_url;
                         },
                         secret: (value) => void this.handledSecrets.add(value),
+                        log: (line) => console.info(redactSecrets(line, [...this.handledSecrets])),
                     },
                 }
                 : {}),
@@ -2488,13 +2701,13 @@ export class FoundryStepExecutor {
      * every issuer org, which is named by a slug and a slug has no spaces. Every call here is idempotent, so
      * a re-run after a crash finishes the job.
      */
-    async zitadelCustomers(action, org, context) {
+    async zitadelCustomers(action, org, context, variant = LIVE_CUSTOMERS) {
         const zitadelOrgId = context.recordedIds().zitadel_org;
         if (!zitadelOrgId) {
-            throw new Error(`zitadel:customers for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+            throw new Error(`${variant.step} for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
         }
         const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
-        const { org: customers } = await this.ports.zitadel.findOrCreateOrg(`${org.slug} customers`);
+        const { org: customers } = await this.ports.zitadel.findOrCreateOrg(variant.name(org.slug));
         // Self-registration follows `customers.signUp` (off by default). The marker is written last, so a
         // run that failed before here is planned again.
         const signUp = action.desired.signUp === true;
@@ -2504,11 +2717,14 @@ export class FoundryStepExecutor {
             await this.ports.zitadel.closeSelfRegistration(customers.id);
         await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
         // The sign-in and room metadata come before every marker: a failed write leaves both markers behind, so the next plan repeats the step.
-        const signIn = await this.writeCustomersSignInMetadata(org, customers.id, action, context);
-        const room = await this.writeCustomersRoomMetadata(org, customers.id, action, context);
-        context.recordScopeId(CUSTOMERS_SIGN_UP_SCOPE_KEY, signUp ? '1' : '0');
+        const signIn = await this.writeCustomersSignInMetadata(org, customers.id, action, context, variant);
+        // The sign-in window text is the live customers organisation's; the test customers planner plans none.
+        const room = variant === LIVE_CUSTOMERS
+            ? await this.writeCustomersRoomMetadata(org, customers.id, action, context)
+            : null;
+        context.recordScopeId(variant.signUpKey, signUp ? '1' : '0');
         if (signIn)
-            context.recordScopeId(CUSTOMERS_SIGN_IN_SCOPE_KEY, signIn);
+            context.recordScopeId(variant.signInKey, signIn);
         if (room !== null)
             context.recordScopeId(CUSTOMERS_ROOM_SCOPE_KEY, room);
         return { resourceId: customers.id };
@@ -2550,13 +2766,13 @@ export class FoundryStepExecutor {
      * only when the recorded marker differs, so a step for another change touches
      * nothing here. Returns the marker value to record, or null for no change.
      */
-    async writeCustomersSignInMetadata(org, customersOrgId, action, context) {
+    async writeCustomersSignInMetadata(org, customersOrgId, action, context, variant = LIVE_CUSTOMERS) {
         const want = action.desired.signIn;
         if (want === undefined)
             return null;
         const { setOrgMetadata, removeOrgMetadata } = this.ports.zitadel;
         if (!setOrgMetadata || !removeOrgMetadata) {
-            throw new Error(`zitadel:customers for ${org.slug}: the ZITADEL client cannot set organisation metadata`);
+            throw new Error(`${variant.step} for ${org.slug}: the ZITADEL client cannot set organisation metadata`);
         }
         try {
             if (want === 'email-code') {
@@ -2564,13 +2780,13 @@ export class FoundryStepExecutor {
                 return 'email-code';
             }
             // Nothing to remove when it was never written.
-            if (context.recordedIds()[CUSTOMERS_SIGN_IN_SCOPE_KEY] !== 'email-code')
+            if (context.recordedIds()[variant.signInKey] !== 'email-code')
                 return null;
             await removeOrgMetadata.call(this.ports.zitadel, customersOrgId, CUSTOMERS_SIGN_IN_METADATA_KEY);
             return 'password';
         }
         catch {
-            throw new Error(`zitadel:customers for ${org.slug}: writing the sign-in metadata of organisation ${customersOrgId} failed`);
+            throw new Error(`${variant.step} for ${org.slug}: writing the sign-in metadata of organisation ${customersOrgId} failed`);
         }
     }
     async zitadelApp(action, org, context) {
@@ -2584,16 +2800,21 @@ export class FoundryStepExecutor {
         const isCmsClient = action.key === 'cms' && org.site.enabled;
         const isAgoraClient = action.key === 'agora';
         const isBouleClient = action.key === 'boule';
+        const isKosmosClient = action.key === 'kosmos' && kosmosOn(org);
         const authEntry = org.hosting.entries.find((e) => e.key === action.key && e.uses?.auth);
+        // A workspace's own client `<key>-work`, signing in at the workspace host.
+        const workspaceEntry = authEntry ? undefined : workspaceAuthEntryOf(org, action.key);
         const clientIdScopeKey = isCmsClient
             ? CMS_CLIENT_ID_SCOPE_KEY
             : isAgoraClient
                 ? AGORA_CLIENT_ID_SCOPE_KEY
                 : isBouleClient
                     ? BOULE_CLIENT_ID_SCOPE_KEY
-                    : authEntry
-                        ? entryClientIdScopeKey(action.key)
-                        : APP_CLIENT_ID_SCOPE_KEY;
+                    : isKosmosClient
+                        ? KOSMOS_CLIENT_ID_SCOPE_KEY
+                        : authEntry || workspaceEntry
+                            ? entryClientIdScopeKey(action.key)
+                            : APP_CLIENT_ID_SCOPE_KEY;
         const priorAppId = recorded[`zitadel:app:${action.key}`];
         // Only a step the planner flagged as destroying (`recreate`, set with
         // `destroys: true` so plan-apply asks for the typed confirmation) may
@@ -2936,6 +3157,8 @@ export class FoundryStepExecutor {
             coolify: this.ports.coolify,
             healthToken: async () => (await this.ports.heldKeys?.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
             secret: (value) => void this.handledSecrets.add(value),
+            pinRef: sharedSecretRef(org.id, pinKeyName(subject.id)),
+            ...(this.ports.heldKeys ? { heldKeys: this.ports.heldKeys } : {}),
             primaryUuid,
             primaryBlueAppId,
             runtime: this.ports.runtime ?? {},
@@ -3035,6 +3258,16 @@ export class FoundryStepExecutor {
                 this.handledSecrets.add(token);
                 return token;
             },
+            pinKey: () => mintPinKey({
+                id: subject.id,
+                ref: sharedSecretRef(org.id, pinKeyName(subject.id)),
+                recorded,
+                record: (k, v) => context.recordScopeId(k, v),
+                persist: () => context.persistScopeIds(),
+                heldKeys: this.ports.heldKeys ?? { resolve: async () => null },
+                generate: () => randomBytes(32).toString('hex'),
+                secret: (value) => void this.handledSecrets.add(value),
+            }),
             actionsKey: async () => {
                 const heldKeys = this.ports.heldKeys;
                 if (typeof heldKeys?.put !== 'function') {
@@ -3057,6 +3290,7 @@ export class FoundryStepExecutor {
                 return key;
             },
             secret: (value) => void this.handledSecrets.add(value),
+            githubAppUuid: (repo) => this.githubAppUuidFor(org, repo, recorded()),
             runtime,
             sleep: runtime.sleep ?? defaultSleep,
             label: `${action.system}:${action.kind}:${subject.id}`,
@@ -3074,6 +3308,296 @@ export class FoundryStepExecutor {
         }
         return undefined;
     }
+    /**
+     * `coolify:workspace` (`plan/workspace.ts`): a server entry's private workspace on the primary server. It is
+     * the blue/green stage (the stage app, its own empty database, the stage mail sink and the stage guards) at
+     * the workspace host, with the Access gate `planGates` made first. Nothing here makes a color, a balancer or
+     * a public name. The live app, when the entry is live, is only read for the names stage must not share.
+     */
+    async coolifyWorkspace(action, org, context) {
+        const recorded = () => context.recordedIds();
+        const key = String(action.desired.entry ?? '');
+        const entry = org.hosting.entries.find((e) => e.key === key && isServerWorkspace(e) && e.repo !== null);
+        if (!entry) {
+            throw new Error(`coolify:workspace for ${org.slug}: no server workspace '${key}'`);
+        }
+        const serverUuid = String(action.desired.server ?? '');
+        const primaryUuid = String(action.desired.primary ?? '');
+        const servers = await this.resolveServers(org, context);
+        if (!servers.servers.some((s) => s.uuid === serverUuid) ||
+            servers.primary.uuid !== primaryUuid) {
+            throw new Error(`coolify:workspace for ${org.slug}: Coolify server ${serverUuid} is not the usable, recorded primary`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const subject = workspaceSubject(org, entry);
+        const host = workspaceHost(org.slug, entry.key);
+        const gateId = recorded()[gateIdRecordKey(org.id, workspaceGateKey(entry.key))];
+        const guards = this.ports.stageProbes ? { probes: this.ports.stageProbes } : {};
+        if (gateId)
+            guards.gate = { hostname: host, create: async () => ({ id: gateId }) };
+        const runtime = this.ports.runtime ?? {};
+        const authIssuer = action.desired.authIssuer ?? null;
+        const signIn = await this.workspaceStageSignIn(org, entry, authIssuer, context);
+        await applyWorkspaceServer({
+            coolify: this.ports.coolify,
+            recorded,
+            record: (k, v) => context.recordScopeId(k, v),
+            persist: () => context.persistScopeIds(),
+            projectUuid,
+            environment,
+            secret: (value) => void this.handledSecrets.add(value),
+            githubAppUuid: (repo) => this.githubAppUuidFor(org, repo, recorded()),
+            runtime,
+            sleep: runtime.sleep ?? defaultSleep,
+            label: `${action.system}:${action.kind}:${entry.key}`,
+            // The live app, when there is one: stage's names are checked against its env and nothing is copied from it.
+            primaryBlueAppId: isLiveEntry(entry) ? (recorded()[subject.blueAppKey] ?? null) : null,
+            logDir: LOG_DIR,
+            isRunning: isRunningOrStarting,
+            stageGuards: guards,
+            stageSink: { slug: org.slug },
+            stageAppUrl: `https://${host}`,
+            ...(signIn ? { signIn } : {}),
+        }, subject, serverUuid);
+        // Only a stage that took the values has applied them; otherwise the next plan tries again.
+        if (signIn && recorded()[bgKey.stageState(entry.key)] === 'ok') {
+            const marker = workspaceSignInMarker(org, entry, recorded(), authIssuer);
+            if (marker)
+                context.recordScopeId(wsKey.signIn(entry.key), marker);
+        }
+        context.recordScopeId(wsKey.applied(entry.key), workspaceStructureHash(org, entry));
+        await context.persistScopeIds();
+        return undefined;
+    }
+    /**
+     * The stage's own sign-in, for a workspace of an entry with `uses.auth`: the recorded organisation, client and
+     * issuer, its own workspaces key (made and held first, once) and what it must never hold, which is what the
+     * live app holds. A key is registered for redaction before it goes anywhere. Errors name the entry and the ref,
+     * never a value; every held-key read has a timeout.
+     */
+    async workspaceStageSignIn(org, entry, authIssuer, context) {
+        const auth = entry.uses?.auth;
+        if (!auth)
+            return undefined;
+        const at = `coolify:workspace for ${org.slug}`;
+        const recorded = context.recordedIds();
+        const authEnv = workspaceAuthEnv(org, entry, recorded, authIssuer);
+        if (!authEnv) {
+            throw new Error(`${at}: the sign-in organisation, client or issuer of entry '${entry.key}' is not recorded yet`);
+        }
+        const env = Object.entries(authEnv).map(([key, value]) => ({ key, value }));
+        const held = this.ports.heldKeys;
+        const heldKeys = held && {
+            resolve: (ref) => withLabelledTimeout('held key read', HELD_KEY_READ_TIMEOUT_MS, () => held.resolve(ref)),
+            ...(typeof held.put === 'function'
+                ? {
+                    put: (ref, value) => withLabelledTimeout('held key write', HELD_KEY_READ_TIMEOUT_MS, () => held.put(ref, value)),
+                }
+                : {}),
+        };
+        if (auth.workspaces) {
+            const workspacesKey = await ensureWorkspacesKey({
+                orgId: org.id,
+                slug: org.slug,
+                entryKey: workspaceClientKey(entry.key),
+                heldKeys,
+                recorded: () => context.recordedIds(),
+                record: (key, value) => context.recordScopeId(key, value),
+                persist: () => context.persistScopeIds(),
+                secret: (value) => void this.handledSecrets.add(value),
+            });
+            env.push({ key: 'WORKSPACES_API_KEY', value: workspacesKey });
+        }
+        const workspacesKeys = [];
+        for (const live of org.hosting.entries.filter((e) => e.uses?.auth?.workspaces)) {
+            const value = await heldKeys?.resolve(workspacesKeyRef(org.id, live.key));
+            if (value) {
+                this.handledSecrets.add(value);
+                workspacesKeys.push(value);
+            }
+        }
+        const liveMcp = org.hosting.entries.filter((live) => live.uses?.auth?.mcp);
+        return {
+            env,
+            customers: auth.users === 'customers',
+            redirectUri: `https://${workspaceClientHosts(org, entry)[0]}/auth/callback`,
+            live: {
+                ...(recorded[`zitadel:customers:${org.id}`]
+                    ? { customersOrgId: recorded[`zitadel:customers:${org.id}`] }
+                    : {}),
+                clientIds: liveClientIds(org, recorded),
+                workspacesKeys,
+                mcpAudiences: liveMcp.flatMap((m) => recorded[entryMcpProjectScopeKey(m.key)] ?? []),
+                mcpResources: liveMcp.flatMap((m) => entryMcp(org, m, recorded)?.resource ?? []),
+            },
+        };
+    }
+    /**
+     * `coolify:workspace-broker-entry` (`plan/workspace-sign-in.ts`): the broker entry `<slug>-<key>-work` of a
+     * workspace with sign-in, written with the stage app's own `AUTH_APP_KEY` and the hash of its own workspaces
+     * key. It never reads or writes the live entry. Records what it wrote, never a key.
+     */
+    async coolifyWorkspaceBrokerEntry(action, org, context) {
+        const at = `coolify:workspace-broker-entry for ${org.slug}`;
+        const broker = this.ports.broker;
+        if (!broker)
+            throw new Error(`${at}: the broker port is not wired`);
+        const recorded = context.recordedIds();
+        const entry = org.hosting.entries.find((e) => appStepKey(org, e.key) === action.key && isServerWorkspace(e) && e.uses?.auth);
+        if (!entry?.uses?.auth)
+            throw new Error(`${at}: no workspace with sign-in for ${action.key}`);
+        const wanted = wantedWorkspaceBrokerEntry(org, entry, recorded);
+        if ('missing' in wanted) {
+            throw new Error(`${at}: ${wanted.missing.map((m) => m.what).join(', ')} not recorded yet`);
+        }
+        const stagePrefix = `bg.${entry.key}.app.`;
+        const stageId = Object.entries(recorded).find(([key, id]) => id && key.startsWith(stagePrefix) && key.endsWith('.stage'))?.[1];
+        if (!stageId)
+            throw new Error(`${at}: the workspace's app is not recorded yet`);
+        const appKey = (await this.ports.coolify.listEnvs(stageId)).find((e) => e.key === 'AUTH_APP_KEY' && !e.is_preview)?.value;
+        if (!appKey || appKey.length < 32) {
+            throw new Error(`${at}: the workspace's app ${stageId} has no AUTH_APP_KEY yet`);
+        }
+        this.handledSecrets.add(appKey);
+        const clientKey = workspaceClientKey(entry.key);
+        await this.writeAppBrokerEntry(org, broker, clientKey, wanted.want, appKey, context, wanted.want.workspaces ? await this.workspacesInputs(org, clientKey) : {});
+        return {};
+    }
+    /**
+     * `coolify:workspaces-database` (`plan/broker-workspaces-database.ts`): the broker's workspaces database, made
+     * beside the broker (the platform's project and network, or the company's own for an org that owns its services)
+     * and held at `workspacesDatabaseRef(org)`. Reads the broker and the held keys again first and makes nothing when
+     * either has a URL, so a database is never made over one. Records nothing: the held URL is the record, and a
+     * database made but not held is found by name on the next apply. The database stays when the org is removed, as
+     * the held keys do.
+     */
+    async coolifyWorkspacesDatabase(org, context) {
+        const at = `coolify:workspaces-database for ${org.slug}`;
+        const sources = await this.workspacesDatabaseSources(org, context.recordedIds()).catch(() => {
+            throw new Error(`${at}: the broker's env or the held URL could not be read; nothing was made`);
+        });
+        if (sources.inEnv || sources.held)
+            return undefined;
+        const own = ownsServices(org);
+        const target = own ? orgTarget(org) : platformTarget();
+        let coolify;
+        let projectUuid;
+        if (own) {
+            const ownPorts = this.ports.ownServices;
+            if (!ownPorts)
+                throw new Error(OWN_SERVICES_PORT_ABSENT);
+            coolify = limited(this.placedForCompany(ownPorts.provision.auth.coolify, org, context), LIMITS.ownAuth);
+            projectUuid = () => this.ensureCoolifyProject(org, context);
+        }
+        else {
+            coolify = placedOnPlatform(this.ports.coolify);
+            projectUuid = async () => (await this.ports.coolify.findProjectByName(PLATFORM_AUTH_PROJECT))?.uuid ?? null;
+        }
+        const known = context.recordedIds()[BROKER_WORKSPACES_DATABASE_SCOPE_KEY];
+        await ensureBrokerWorkspacesDatabase({
+            target,
+            coolify,
+            projectUuid,
+            heldKeys: this.ports.heldKeys,
+            ...(known ? { knownUuid: known } : {}),
+            recordUuid: async (uuid) => {
+                context.recordScopeId(BROKER_WORKSPACES_DATABASE_SCOPE_KEY, uuid);
+                await context.persistScopeIds();
+            },
+            secret: (value) => void this.handledSecrets.add(value),
+        });
+        return undefined;
+    }
+    /**
+     * `coolify:promote`: moves a live workspace entry's app to `HostingEntry.liveCommit`. Patches `git_commit_sha`,
+     * deploys and waits for the deployment, then records `ws.<key>.livecommit`. A failure after the patch leaves the
+     * app configured for the new commit with the old container still running and no marker, so the next apply
+     * patches and deploys again.
+     */
+    async coolifyPromote(action, org, context) {
+        const key = String(action.desired.entry ?? '');
+        const entry = org.hosting.entries.find((e) => e.key === key && isServerWorkspace(e));
+        const commit = entry?.liveCommit;
+        if (!entry || commit === undefined || !FULL_COMMIT_SHA.test(commit)) {
+            throw new Error(`coolify:promote for ${org.slug}: entry '${key}' has no valid liveCommit`);
+        }
+        const appId = context.recordedIds()[`coolify:app:${appStepKey(org, key)}`];
+        if (!appId) {
+            throw new Error(`coolify:promote for ${org.slug}: the live app for '${key}' is not recorded`);
+        }
+        await this.ports.coolify.updateApplication(appId, { git_commit_sha: commit });
+        const runtime = this.ports.runtime ?? {};
+        const built = await waitForNewDeployment(this.ports.coolify, appId, { kind: 'deployment-only' }, runtime, runtime.sleep ?? defaultSleep, `coolify:promote:${key}`, `${org.slug}'s ${key} app stays at its previous deploy`);
+        await recordBuiltCommit(this.ports.coolify, { appId, deploymentUuid: built.deploymentUuid, name: key }, (k, v) => context.recordScopeId(k, v));
+        context.recordScopeId(wsKey.liveCommit(key), commit);
+        await context.persistScopeIds();
+        return undefined;
+    }
+    /**
+     * The commit a workspace entry's live app is made from: the newest finished deployment of its workspace's stage
+     * app, else the commit recorded when the workspace was last applied. Recorded as `ws.<key>.commit`. Throws,
+     * before any app is made, when there is none.
+     */
+    async workspaceCommit(org, entry, serverUuid, context) {
+        const stageId = context.recordedIds()[bgKey.app(entry.key, serverUuid, 'stage')];
+        const commit = (stageId ? await readWorkspaceCommit(this.ports.coolify, stageId) : null) ??
+            context.recordedIds()[wsKey.commit(entry.key)] ??
+            null;
+        if (!commit) {
+            throw new Error(`coolify:app for ${org.slug}: workspace '${entry.key}' has not deployed a commit, so there is nothing to put live`);
+        }
+        context.recordScopeId(wsKey.commit(entry.key), commit);
+        await context.persistScopeIds();
+        return commit;
+    }
+    /**
+     * The Coolify GitHub source an app of `repo` is created through: the company's own (`coolify:github-source`,
+     * recorded by that step) when `repo` is under the company's GitHub account, else the platform's.
+     */
+    async githubAppUuidFor(org, repo, recorded) {
+        if (!companyGithubFor(org.hosting, repo)) {
+            return (await this.ports.coolify.requireGithubApp()).uuid;
+        }
+        const uuid = recorded[githubSourceResourceKey(org.id)];
+        if (!uuid) {
+            throw new Error(`coolify:app for ${org.slug}: repo ${repo} is under the company's GitHub account but its GitHub source is not recorded yet`);
+        }
+        return uuid;
+    }
+    /** The company's Coolify GitHub source (`plan/github-source.ts`): made from the platform GitHub App's held keys and the company's installation id. */
+    async coolifyGithubSource(org, context) {
+        const github = org.hosting.github;
+        if (!github)
+            throw new Error(`coolify:github-source for ${org.slug}: no hosting.github declared`);
+        const heldKeys = this.ports.heldKeys;
+        if (!heldKeys) {
+            throw new Error(`coolify:github-source for ${org.slug}: the executor was built without heldKeys`);
+        }
+        const { uuid } = await ensureGithubSource({
+            coolify: this.ports.coolify,
+            heldKeys,
+            secret: (value) => void this.handledSecrets.add(value),
+            label: `coolify:github-source for ${org.slug}`,
+            slug: org.slug,
+            github,
+        });
+        context.recordScopeId(GITHUB_SOURCE_INSTALLATION_SCOPE_KEY, String(github.installationId));
+        await context.persistScopeIds();
+        return { resourceId: uuid };
+    }
+    /** True when no Coolify GitHub source has this uuid. A failed read counts as not gone. */
+    async githubSourceGone(uuid) {
+        try {
+            const sources = await withLabelledTimeout('coolify:github-source: listing sources', GITHUB_SOURCE_TIMEOUT_MS, () => this.ports.coolify.raw('GET', '/github-apps'));
+            return (Array.isArray(sources) && !sources.some((s) => s?.uuid === uuid));
+        }
+        catch (error) {
+            if (error instanceof CallError)
+                return false;
+            throw error;
+        }
+    }
     /**
      * Stage's guards (`plan/stage-guards.ts`): the probe port the host supplied, and the Access gate over the stage
      * host. The gate is offered only when everything it needs is in hand (a domain, the platform's Access provider,
@@ -3201,6 +3725,8 @@ export class FoundryStepExecutor {
         // (the marker is recorded only after the redeploy), e.g. a first deploy
         // that failed: starting it builds nothing. A parked app has its marker.
         let neverDeployed = false;
+        // A workspace entry's live app is made from the commit its workspace runs.
+        let pinnedCommit = null;
         if (existing) {
             appId = existing.uuid;
             // Found by name (rather than just created) is started back up if not
@@ -3219,14 +3745,18 @@ export class FoundryStepExecutor {
         }
         else {
             const server = await this.resolveServer(org, context);
-            const githubApp = await this.ports.coolify.requireGithubApp();
+            const githubAppUuid = await this.githubAppUuidFor(org, appRepo, context.recordedIds());
+            if (isServerWorkspace(entry)) {
+                pinnedCommit =
+                    entry.liveCommit ?? (await this.workspaceCommit(org, entry, server.uuid, context));
+            }
             const created = await this.ports.coolify.createGithubAppApplication({
                 is_preview_deployments_enabled: false,
                 project_uuid: projectUuid,
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                github_app_uuid: githubApp.uuid,
+                github_app_uuid: githubAppUuid,
                 git_repository: appRepo,
                 git_branch: entry.branch,
                 build_pack: entry.buildPack,
@@ -3261,6 +3791,8 @@ export class FoundryStepExecutor {
         // step for it). A created app has them off from the create.
         if (previewsOn(live))
             patch.is_preview_deployments_enabled = false;
+        if (pinnedCommit)
+            patch.git_commit_sha = pinnedCommit;
         // #543: the health-check quartet too, every run -- the same reason
         // Archon's own doc comment gives (without one, Coolify's rolling update
         // has nothing to wait on and stops the old container immediately). The
@@ -3391,6 +3923,9 @@ export class FoundryStepExecutor {
         context.recordScopeId(settingsKey, JSON.stringify({ ...want, port: want.port ?? have.port }));
         context.recordScopeId(domainsKey, JSON.stringify(wantDomains));
         context.recordScopeId(labelsKey, wantLabelsHash);
+        if (pinnedCommit && pinnedCommit === entry.liveCommit) {
+            context.recordScopeId(wsKey.liveCommit(entry.key), pinnedCommit);
+        }
         context.recordScopeId(appEnvAppliedScopeKey(entry.key), appEnv.applied);
         if (entry.uses?.auth) {
             context.recordScopeId(entryAuthEnvAppliedScopeKey(entry.key), appEnv.authApplied);
@@ -3404,7 +3939,8 @@ export class FoundryStepExecutor {
         // actually resolved a mail domain for this org.
         // One Lettermint project, `<slug>-app`, belongs to the `app` entry; a
         // second entry sharing the name would delete the first's live token.
-        if (isMainEntry(entry)) {
+        // An entry that declares `uses.mail` shares that project's token and sender address.
+        if (isMainEntry(entry) || entry.uses?.mail) {
             await this.ensureAppLettermintMail(appId, org, context, 
             // Deployed or started above on every path, a created app included
             // (#566), so it has read its env before the mail env is written.
@@ -3416,7 +3952,7 @@ export class FoundryStepExecutor {
             // step planned before this field existed; `ensureAppLettermintMail`
             // refuses rather than silently falling back once it knows there is
             // a recorded mail domain to reason about.
-            'platformApex' in action.desired, action.desired.platformApex ?? null, action.desired.platformLettermintProjectId ?? null);
+            'platformApex' in action.desired, action.desired.platformApex ?? null, action.desired.platformLettermintProjectId ?? null, isMainEntry(entry) ? 'app' : 'entry');
         }
         return { resourceId: appId };
     }
@@ -3537,6 +4073,150 @@ export class FoundryStepExecutor {
         await provisionOrgPostgresDatabases(scopeFromOrg(context, {}), this.orgPostgresDeps(org, context), org, homes);
         return {};
     }
+    /** F4 (#925): Boule's app and the calls on its env that the apps database steps make. */
+    appsBoule(org, context) {
+        const appId = context.recordedIds()[`coolify:boule:${org.id}`];
+        if (!appId)
+            return null;
+        const coolify = this.ports.coolify;
+        return {
+            upsertEnvs: async (rows) => void (await coolify.bulkUpsertEnvs(appId, rows)),
+            deleteEnvs: async (names) => {
+                let rows;
+                try {
+                    rows = await coolify.listEnvs(appId);
+                }
+                catch (error) {
+                    if (isNotFoundError(error))
+                        return;
+                    throw error;
+                }
+                for (const name of names) {
+                    const row = rows.find((e) => e.key === name && !e.is_preview);
+                    if (!row?.uuid)
+                        continue;
+                    try {
+                        await coolify.deleteEnv(appId, row.uuid);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                }
+            },
+            restart: async () => void (await coolify.restart(appId)),
+        };
+    }
+    /**
+     * F4 (#925) `coolify:org-apps-admin`: with `org.boule.apps` on, the `<slug>_apps_admin` role on the
+     * company's Postgres server (`plan/org-apps-admin.ts`); its URL is held and written to Boule's env as
+     * `APPS_DATABASE_ADMIN_URL`, then Boule restarts. Apps off: the retire form (no login, env row gone,
+     * nothing dropped).
+     */
+    async orgAppsAdmin(action, org, context) {
+        const at = `coolify:org-apps-admin for ${org.slug}`;
+        const base = this.orgPostgresDeps(org, context);
+        const boule = this.appsBoule(org, context);
+        const { deliverSecret: _held, ...shared } = base;
+        if (action.desired.mode === 'retire') {
+            await retireOrgAppsAdmin(scopeFromOrg(context, {}), {
+                ...shared,
+                clearHeldUrl: async (ref) => {
+                    // The deliver sink has no delete; the held-key store blanks a value (an empty one reads as not held).
+                    if (typeof this.ports.heldKeys?.put !== 'function') {
+                        console.info(`${at}: the held URL ${ref} was not blanked, the executor's held keys cannot put; blank it by hand`);
+                        return;
+                    }
+                    await this.ports.heldKeys.put(ref, '');
+                },
+                removeBouleEnv: async () => {
+                    await boule?.deleteEnvs([APPS_DATABASE_ADMIN_URL_ENV]);
+                    if (boule)
+                        await boule.restart();
+                },
+            }, org);
+            return {};
+        }
+        if (!appsOn(org))
+            throw new Error(`${at}: the company's Boule runs no apps (org.boule.apps)`);
+        if (!boule)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        const deps = {
+            ...shared,
+            deliverSecret: async (ref, url) => {
+                await this.ports.deliverSecret(ref, url);
+                await boule.upsertEnvs([{ key: APPS_DATABASE_ADMIN_URL_ENV, value: url, literal: true }]);
+                await boule.restart();
+            },
+        };
+        await provisionOrgAppsAdmin(scopeFromOrg(context, {}), deps, org);
+        return {};
+    }
+    /**
+     * F4 (#925) `cloudflare:apps-db-route`: the tunnel route Hyperdrive reaches the company's Postgres server
+     * by, and the `APPS_DATABASE_*` env on Boule (`plan/apps-db-route.ts`). Retire takes both away; the
+     * databases stay.
+     */
+    async appsDbRoute(action, org, context) {
+        const at = `cloudflare:apps-db-route for ${org.slug}`;
+        const heldKeys = this.ports.heldKeys;
+        if (!heldKeys)
+            throw new Error(`${at}: this executor was built without held keys`);
+        const retire = action.desired.mode === 'retire';
+        const boule = this.appsBoule(org, context);
+        if (!boule && !retire)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        const deps = {
+            database: {
+                tunnels: this.tunnelPort(),
+                access: this.accessPort(),
+                dns: this.dnsPort(),
+                zones: this.zonePort(),
+            },
+            heldKeys,
+            secret: (value) => void this.handledSecrets.add(value),
+            upstreamHost: async (serverId) => {
+                const server = await getDatabaseStarted(this.ports.coolify, serverId);
+                if (!server.internal_db_url || !URL.canParse(server.internal_db_url))
+                    return '';
+                this.handledSecrets.add(server.internal_db_url);
+                return new URL(server.internal_db_url).hostname;
+            },
+            boule: boule ?? {
+                upsertEnvs: async () => undefined,
+                deleteEnvs: async () => undefined,
+                restart: async () => undefined,
+            },
+        };
+        if (retire)
+            await retireAppsDbRoute(deps, org, context);
+        else
+            await applyAppsDbRoute(deps, org, context);
+        return {};
+    }
+    /**
+     * FZ `cloudflare:apps-zones`: the company slug and the zone ids Boule's managed backend names edge routes
+     * by (`plan/apps-zones.ts`). Retire takes the rows away again.
+     */
+    async appsZones(action, org, context) {
+        const at = `cloudflare:apps-zones for ${org.slug}`;
+        const retire = action.desired.mode === 'retire';
+        const boule = this.appsBoule(org, context);
+        if (retire) {
+            if (boule)
+                await retireAppsZones({ boule }, org, context);
+            else {
+                console.info(`${at}: Boule is not recorded, so no env rows were removed; marker cleared`);
+                context.recordScopeId(APPS_ZONES_APPLIED_SCOPE_KEY, '');
+                await context.persistScopeIds();
+            }
+            return {};
+        }
+        if (!boule)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        await applyAppsZones({ zones: this.zonePort(), boule }, org, context);
+        return {};
+    }
     /**
      * `coolify:org-postgres-migrate` (#444): one home's data from its old Coolify database to the
      * company's server. Refuses before any port call unless the staging confirmation is recorded.
@@ -3592,6 +4272,8 @@ export class FoundryStepExecutor {
             }
             case 'boule':
                 return { appIds: await byName(`${org.slug}-boule`), template: true };
+            case 'kosmos':
+                return { appIds: await byName(`${org.slug}-kosmos`), template: true };
             case 'chat_service':
                 return { appIds: await byName(chat.service), template: true };
             case 'calls_service':
@@ -3845,6 +4527,19 @@ export class FoundryStepExecutor {
             const appKey = await this.ensureAuthAppKey(appId);
             if (appKey)
                 envs.push({ key: 'AUTH_APP_KEY', value: appKey });
+            if (entry.uses.auth.workspaces) {
+                const workspacesKey = await ensureWorkspacesKey({
+                    orgId: org.id,
+                    slug: org.slug,
+                    entryKey: entry.key,
+                    heldKeys: this.ports.heldKeys,
+                    recorded: () => context.recordedIds(),
+                    record: (key, value) => context.recordScopeId(key, value),
+                    persist: () => context.persistScopeIds(),
+                    secret: (value) => void this.handledSecrets.add(value),
+                });
+                envs.push({ key: 'WORKSPACES_API_KEY', value: workspacesKey });
+            }
         }
         else {
             const zitadelOrgId = recorded.zitadel_org;
@@ -3901,6 +4596,8 @@ export class FoundryStepExecutor {
             heldEnvs.push({ key: name, value: await this.readHeldEnv(org, entry.key, name) });
         }
         envs.push(...heldEnvs);
+        // F13: the entry's customer-grants credential, or its removal when the flag went.
+        await this.customerGrantsAppEnv(appId, org, entry, context, envs);
         // A held value has no version the plan can read, so the live env decides whether it changed.
         let heldChanged = false;
         if (heldEnvs.length > 0) {
@@ -4039,9 +4736,24 @@ export class FoundryStepExecutor {
         if (!appKey || appKey.length < 32) {
             throw new Error(`coolify:broker-entry for ${org.slug}: app ${appId} has no AUTH_APP_KEY yet`);
         }
-        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appKey, context);
+        await this.writeAppBrokerEntry(org, broker, entry.key, wanted.want, appKey, context, wanted.want.workspaces ? await this.workspacesInputs(org, entry.key) : {});
         return {};
     }
+    /**
+     * What the broker entry needs beyond its want when it declares workspaces: the hash of the held key (the key
+     * itself is registered for redaction and goes no further) and the operator's held database connection string.
+     */
+    async workspacesInputs(org, entryKey) {
+        const key = await heldWorkspacesKey(this.ports.heldKeys, org, entryKey);
+        this.handledSecrets.add(key);
+        const database = await heldWorkspacesDatabase(this.ports.heldKeys, workspacesDatabaseRef(org));
+        if (database)
+            this.handledSecrets.add(database);
+        return {
+            workspacesKeyHash: workspacesKeyHash(key),
+            ...(database ? { workspacesDatabaseUrl: database } : {}),
+        };
+    }
     /**
      * #161: the org's Boule broker entry, `<slug>-boule`, written the way a
      * hosting entry's is: with the `AUTH_APP_KEY` `coolifyBoule` put in the
@@ -4114,12 +4826,13 @@ export class FoundryStepExecutor {
         return {};
     }
     /** The shared tail of both broker-entry steps: read the app's key, write the entry, record what was written. */
-    async writeAppBrokerEntry(_org, broker, entryKey, want, appKey, context) {
+    async writeAppBrokerEntry(_org, broker, entryKey, want, appKey, context, workspaces = {}) {
         const previousRaw = context.recordedIds()[brokerEntryAppliedScopeKey(entryKey)];
         const result = await writeBrokerEntry(broker, {
             want,
             appKey,
             previous: previousRaw ? JSON.parse(previousRaw) : null,
+            ...workspaces,
         });
         context.recordScopeId(brokerEntryWarningsScopeKey(entryKey), JSON.stringify(result.invalidForeign));
         // Last: a run that failed above plans the step again.
@@ -4220,7 +4933,7 @@ export class FoundryStepExecutor {
      * mail domain was never even recorded for this org, the same as before
      * this field existed (review round 2, finding 3).
      */
-    async ensureAppLettermintMail(appId, org, context, running, hasPlatformApexField, platformApex, platformLettermintProjectId) {
+    async ensureAppLettermintMail(appId, org, context, running, hasPlatformApexField, platformApex, platformLettermintProjectId, role = 'app') {
         const mailDomain = context.recordedIds()[MAIL_DOMAIN_SCOPE_KEY];
         if (!mailDomain)
             return;
@@ -4273,7 +4986,7 @@ export class FoundryStepExecutor {
             org,
             context,
             mailDomain,
-            self: { role: 'app', id: appId, restart: running },
+            self: { role, id: appId, restart: running },
             mailFrom: `${org.mail.noReplyLocalPart ?? 'no-reply'}@${mailDomain}`,
             platformApex,
             platformLettermintProjectId,
@@ -4307,12 +5020,26 @@ export class FoundryStepExecutor {
         const { org, context, mailDomain, self, mailFrom } = args;
         const appName = `${org.slug}-app`;
         const recorded = context.recordedIds();
-        const appId = self.role === 'app'
+        const mainId = self.role === 'app'
             ? self.id
             : recorded[`coolify:app:${appStepKey(org, mainEntry(org.hosting)?.key)}`];
         const bouleId = self.role === 'boule' ? self.id : recorded[`coolify:boule:${org.id}`];
-        const peerListEnvs = (id) => !id || id === self.id
-            ? Promise.resolve(null)
+        // The hosted app first, Boule second, then the other entries that send mail (`uses.mail`): an earlier token wins a disagreement.
+        const ids = [];
+        const add = (id) => {
+            if (id && !ids.includes(id))
+                ids.push(id);
+        };
+        add(mainId);
+        add(bouleId);
+        for (const entry of org.hosting.entries) {
+            if (entry.uses?.mail && !isMainEntry(entry)) {
+                add(recorded[`coolify:app:${appStepKey(org, entry.key)}`]);
+            }
+        }
+        add(self.id);
+        const envsOf = (id) => id === self.id
+            ? this.ports.coolify.listEnvs(id)
             : // A recorded peer that Coolify no longer has is not a consumer: not
                 // read, written or restarted (same 404 rule as the retire step).
                 this.ports.coolify
@@ -4322,21 +5049,17 @@ export class FoundryStepExecutor {
                         throw error;
                     return null;
                 });
-        const [projects, selfEnvs, appEnvs, bouleEnvs] = await Promise.all([
+        const [projects, envLists] = await Promise.all([
             this.ports.lettermint.listProjects(),
-            this.ports.coolify.listEnvs(self.id),
-            self.role === 'app' ? Promise.resolve(null) : peerListEnvs(appId),
-            self.role === 'boule' ? Promise.resolve(null) : peerListEnvs(bouleId),
+            Promise.all(ids.map(envsOf)),
         ]);
         const tokenOf = (envs) => envs.find((e) => e.key === 'LETTERMINT_API_TOKEN' && !e.is_preview)?.value || undefined;
-        // The hosted app first, Boule second: the app's token wins a disagreement.
         const consumers = [];
-        const appSlot = self.role === 'app' ? selfEnvs : appEnvs;
-        const bouleSlot = self.role === 'boule' ? selfEnvs : bouleEnvs;
-        if (appSlot && appId)
-            consumers.push({ id: appId, token: tokenOf(appSlot) });
-        if (bouleSlot && bouleId)
-            consumers.push({ id: bouleId, token: tokenOf(bouleSlot) });
+        ids.forEach((id, at) => {
+            const envs = envLists[at];
+            if (envs)
+                consumers.push({ id, token: tokenOf(envs) });
+        });
         const existingToken = consumers.find((c) => c.token)?.token;
         const ours = projects.filter((p) => p.name === appName);
         const held = ours.length === 1 ? ours[0] : undefined;
@@ -5834,16 +6557,18 @@ export class FoundryStepExecutor {
     // ---- calls service (#145, part 2 of #128) -------------------------------
     /**
      * `plan/diff.ts`'s `planCallsService`: the org's own calls service --
-     * `wtfalch/calls`'s `packages/service`, wired to the calls Matrix stack
-     * {@link coolifyCalls} provisions and the shared LiveKit SFU (#122/#127).
-     * Static config checks run first, before any Coolify call (#128's own
-     * carried-over PR 344 review fix, restated in #145's own issue body): the
-     * calls Matrix stack must already be recorded, its MAS app must already
-     * carry its client id/secret, and the shared SFU's LiveKit credentials must
-     * already be resolvable -- none of the three is minted or guessed here.
-     * Park stops the app only, the same park-not-delete rule
-     * {@link coolifyCalls}/{@link coolifyApp} already follow (#7 corrections
-     * 1); its own database is never touched from that branch.
+     * `wtfalch/calls`'s `packages/service`, wired to the shared LiveKit SFU
+     * (#122/#127). #430: calls run transit-only (calls#93's
+     * `CALLS_ENCRYPTION=transit`), so this no longer waits on or wires a
+     * per-org Matrix stack at all -- an org whose stack is already live from
+     * before this keeps running it, unused, until a human removes it
+     * separately. Static config checks run first, before any Coolify call
+     * (#128's own carried-over PR 344 review fix, restated in #145's own
+     * issue body): the shared SFU's LiveKit credentials must already be
+     * resolvable -- not minted or guessed here. Park stops the app only, the
+     * same park-not-delete rule {@link coolifyCalls}/{@link coolifyApp}
+     * already follow (#7 corrections 1); its own database is never touched
+     * from that branch.
      */
     async coolifyCallsService(action, org, context) {
         if (action.desired.enabled === false) {
@@ -5854,18 +6579,8 @@ export class FoundryStepExecutor {
             await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
             return { resourceId: appId };
         }
-        // Refused before anything is created, like the missing-stack refusal below.
+        // Refused before anything is created, like the missing-SFU refusal below.
         const sfuUrls = resolveCallsSfuUrls(this.ports.callsSfuUrls);
-        const recorded = context.recordedIds();
-        const synapseId = recorded[CALLS_SYNAPSE_SCOPE_KEY];
-        const masId = recorded[CALLS_MAS_SCOPE_KEY];
-        if (!synapseId || !masId) {
-            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack has not been provisioned yet -- coolify:calls must run first`);
-        }
-        const masCredentials = await this.readCallsMasClientCredentials(masId);
-        if (!masCredentials) {
-            throw new Error(`coolify:calls-service for ${org.slug}: the calls Matrix stack's MAS client credentials are not on the MAS app yet -- retry this apply once coolify:calls has minted them`);
-        }
         const sfu = await this.ports.callsSfu.resolveCredentials(org.slug);
         if (!sfu) {
             throw new Error(`coolify:calls-service for ${org.slug}: the shared calls SFU has no LiveKit credentials for this org yet -- see https://github.com/wtfalch/foundry/issues/152`);
@@ -5873,8 +6588,6 @@ export class FoundryStepExecutor {
         const projectUuid = await this.ensureCoolifyProject(org, context);
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         const name = callsServiceInternalName(org);
-        const synapseHost = `${org.slug}-calls-synapse`;
-        const masHost = `${org.slug}-calls-mas`;
         const dbName = `${name}-db`;
         const serviceHome = await this.ensureHomeDatabase(org, context, 'calls_service', CALLS_SERVICE_DB_SCOPE_KEY, () => this.ensureCallsDatabase(org, context, projectUuid, environment, dbName, dbName.replace(/-/g, '_'), CALLS_SERVICE_DB_SCOPE_KEY));
         if (!(await this.homeOwnerUrl(serviceHome))) {
@@ -5916,17 +6629,25 @@ export class FoundryStepExecutor {
         });
         // Every app foundry deploys keeps its own logs (#75), reused as-is here.
         await this.ensureLogVolume(app.appId, org, app.existed);
+        // #430: an org whose Matrix stack is still live from before this keeps
+        // the Synapse/MAS apps running, unused, until a human removes them
+        // separately -- but its calls service's own env drops their vars on its
+        // next apply, the same as a brand new org that never got them.
+        for (const key of CALLS_MATRIX_ENV_KEYS) {
+            const env = (await this.ports.coolify.listEnvs(app.appId)).find((e) => e.key === key && !e.is_preview);
+            if (env?.uuid)
+                await this.ports.coolify.deleteEnv(app.appId, env.uuid);
+        }
         const bindingSecret = await this.ensureCallsBindingSecret(app.appId);
         const envs = [
             { key: 'LIVEKIT_URL', value: sfuUrls.privateUrl },
             { key: 'LIVEKIT_PUBLIC_URL', value: sfuUrls.publicUrl },
             { key: 'LIVEKIT_API_KEY', value: sfu.apiKey },
             { key: 'LIVEKIT_API_SECRET', value: sfu.apiSecret },
-            { key: 'MAS_URL', value: `http://${masHost}:8080/` },
-            { key: 'MAS_HOMESERVER', value: callsServerName(org.slug) },
-            { key: 'MAS_CLIENT_ID', value: masCredentials.clientId },
-            { key: 'MAS_CLIENT_SECRET', value: masCredentials.clientSecret },
-            { key: 'SYNAPSE_URL', value: `http://${synapseHost}:8008` },
+            // #430 (calls#93): calls are transit-only, so the service never needs
+            // a Matrix/MAS provider -- MAS_URL, MAS_HOMESERVER, MAS_CLIENT_ID,
+            // MAS_CLIENT_SECRET and SYNAPSE_URL are never written.
+            { key: 'CALLS_ENCRYPTION', value: 'transit' },
             { key: 'CALLS_ORIGIN', value: `https://${agoraHostnameFor(org)}` },
             { key: 'CALLS_HOST_ADAPTER', value: 'production' },
             // Deliberately kept as it was, not widened: the calls service refuses to
@@ -6052,6 +6773,9 @@ export class FoundryStepExecutor {
             throw new Error(`${at}: token ${tokenId} is recorded but chat-service no longer holds a usable one; remove the recorded keys ${CHAT_CALLS_TOKEN_SCOPE_KEY} and ${CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
         const token = usable ?? randomBytes(32).toString('hex');
+        // Registered before either write, so a Coolify error body echoing the upsert is scrubbed
+        // from the run record the same way the write loop's own dropped-error fallback intends.
+        this.handledSecrets.add(token);
         if (!tokenId) {
             tokenId = randomBytes(8).toString('hex');
             context.recordScopeId(CHAT_CALLS_TOKEN_UNDELIVERED_SCOPE_KEY, tokenId);
@@ -6156,22 +6880,6 @@ export class FoundryStepExecutor {
             appId: client.appId,
         };
     }
-    /**
-     * Reads back the calls Matrix stack's MAS client id/secret from the MAS
-     * app's own envs ({@link CALLS_SECRET_ENV_KEYS}) -- never mints: minting
-     * either is {@link ensureCallsMatrixSecrets}'s own job, and a missing value
-     * here means that stack has not finished provisioning yet, not something
-     * this step can fix on its own.
-     */
-    async readCallsMasClientCredentials(masAppId) {
-        const envs = await this.ports.coolify.listEnvs(masAppId);
-        const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
-        const clientId = read(CALLS_SECRET_ENV_KEYS.masClientId);
-        const clientSecret = read(CALLS_SECRET_ENV_KEYS.masClientSecret);
-        if (!clientId || !clientSecret)
-            return null;
-        return { clientId, clientSecret };
-    }
     /**
      * `null` once the calls service app already has a `CALLS_BINDING_SECRET` --
      * never rotated, the same rule {@link ensureAuthCookieSecret} follows for
@@ -6558,6 +7266,7 @@ export class FoundryStepExecutor {
         const credentialWants = {
             archonCredential: action.desired.archonCredential === true,
             customersDirectory: action.desired.customersDirectory === true,
+            registrar: action.desired.registrar === true,
         };
         const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl, mailWanted, credentialWants);
         if (missing.length > 0) {
@@ -6646,11 +7355,34 @@ export class FoundryStepExecutor {
             archonPushedAt = archon.pushedAt;
             credentialEnvs.push({ key: BOULE_ARCHON_CREDENTIAL_ENV, value: archon.value });
         }
+        let directoryCredential = null;
         if (credentialWants.customersDirectory) {
-            const directory = await this.ensureCustomersDirectoryCredential(org, context);
-            if (directory)
-                credentialEnvs.push({ key: BOULE_CUSTOMERS_CREDENTIAL_ENV, value: directory });
-        }
+            directoryCredential = await this.ensureCustomersDirectoryCredential(org, context);
+            if (directoryCredential) {
+                credentialEnvs.push({ key: BOULE_CUSTOMERS_CREDENTIAL_ENV, value: directoryCredential });
+            }
+        }
+        // F13: Boule's customer-grants entry, written with the rest and compared with the live value, so Boule
+        // restarts only when the JSON itself changes.
+        const grants = await this.customerGrantsForBoule(app.appId, org, context, action.desired.customerGrants === true, directoryCredential, liveRows);
+        // Pushed with the credentials: the loop below registers the JSON for redaction and compares it with the live value.
+        if (grants.value !== null)
+            credentialEnvs.push({ key: CUSTOMER_GRANTS_ENV, value: grants.value });
+        if (grants.removed)
+            envChanged = true;
+        // T3: the company's registrar key at the broker, the same held value the registrar step writes there.
+        let registrarMint = null;
+        // Only with the broker's address beside it: a key Boule cannot use is a key held for nothing.
+        if (credentialWants.registrar && issuer) {
+            const registrar = await this.registrarKey(org, context);
+            registrarMint = registrar.mint;
+            credentialEnvs.push({ key: AUTH_REGISTRAR_KEY_ENV, value: registrar.key });
+        }
+        if (await this.dropRegistrarEnv(app.appId, org, context, liveRows))
+            envChanged = true;
+        // A key Boule was given but has not run with yet (a restart that failed, or a key made again).
+        const registrarUnstarted = registrarMint !== null &&
+            context.recordedIds()[REGISTRAR_DELIVERED_SCOPE_KEY] !== registrarMint;
         for (const credential of credentialEnvs) {
             this.handledSecrets.add(credential.value);
             envs.push(credential);
@@ -6664,6 +7396,11 @@ export class FoundryStepExecutor {
                 context.recordScopeId(BOULE_ARCHON_PUSHED_AT_SCOPE_KEY, archonPushedAt);
                 await context.persistScopeIds();
             }
+            if (grants.value !== null) {
+                context.recordScopeId(CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, '1');
+                await context.persistScopeIds();
+            }
+            await this.forgetDroppedCustomerGrants(org, context);
         }
         catch (error) {
             const minted = [
@@ -6671,6 +7408,7 @@ export class FoundryStepExecutor {
                 bridgeSecret,
                 ownerSeedSecret,
                 ...credentialEnvs.map((credential) => credential.value),
+                ...grants.secrets,
             ].filter((v) => v !== null);
             if (minted.length === 0)
                 throw error;
@@ -6709,6 +7447,7 @@ export class FoundryStepExecutor {
                 bridgeSecret !== null ||
                 ownerSeedSecret !== null ||
                 secretsNotRestarted ||
+                registrarUnstarted ||
                 dbPush.changed ||
                 mail.changed)) {
             // A restart inside the mail rule already came after every env write above.
@@ -6718,20 +7457,115 @@ export class FoundryStepExecutor {
         if (action.desired.platformOwner === true) {
             context.recordScopeId(BOULE_SECRETS_RESTARTED_SCOPE_KEY, '1');
         }
+        // After the restart or deploy, so a key Boule never ran with is planned (and restarted) again.
+        if (registrarMint !== null)
+            context.recordScopeId(REGISTRAR_DELIVERED_SCOPE_KEY, registrarMint);
         // Last: the login-host step points the sign-in at this app's own address only once the env is running.
         this.recordSignInEnvLive(context, 'boule', bouleHostnameFor(org), env);
         return { resourceId: app.appId };
     }
+    // ---- kosmos (foundry#949) --------------------------------------------------
     /**
-     * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
-     * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is
-     * written again unchanged. The secret is held first; the caller records `pushedAt` only after the env write
-     * succeeded, so a failed hold or a failed push is mended by the next apply minting again. Errors name no secret.
+     * `plan/diff.ts`'s `planKosmos`: provisions the org's own kosmos
+     * (https://github.com/wtfalch/kosmos) as one more Coolify application, from
+     * that repo's root Dockerfile ({@link KOSMOS_REPO}), with a database of its
+     * own, and pushes its sign-in env. The same shape as {@link coolifyBoule},
+     * trimmed: kosmos is opt-in (`kosmosOn(org)` guards every caller, so this is
+     * never reached while it is off), has no mail, no owner seeding and no
+     * Archon credential.
+     *
+     * The sign-in env comes from `plan/kosmos.ts`'s `desiredKosmosEnv`, the same
+     * function the plan compares the live app against; it never writes a
+     * partial set. The database is `<slug>-kosmos-db`, split the same way
+     * Boule's is: the superuser URL as `DATABASE_URL_OWNER` and a `<dbName>_rt`
+     * role's URL as `DATABASE_URL`, both through `pushDatabaseUrl`.
+     *
+     * #504 (same reason {@link coolifyBoule}'s own comment gives): a brand new
+     * app is never restarted, but it is deployed once ({@link KOSMOS_DEPLOYED_SCOPE_KEY}).
      */
-    async ensureBouleArchonCredential(org, context) {
-        const at = `coolify:boule for ${org.slug}`;
-        const mint = this.ports.mintBouleArchonCredential;
-        const heldKeys = this.ports.heldKeys;
+    async coolifyKosmos(action, org, context) {
+        // Park stops the app only; its database is never touched (#7 corrections 1).
+        if (action.desired.enabled === false) {
+            const appId = context.recordedIds()[`coolify:kosmos:${action.key}`];
+            if (!appId) {
+                throw new Error(`coolify:kosmos for ${org.slug}: no live app recorded, nothing to park`);
+            }
+            await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
+            return { resourceId: appId };
+        }
+        const issuer = action.desired.issuer ?? null;
+        const { env, missing } = desiredKosmosEnv(org, context.recordedIds(), issuer);
+        if (missing.length > 0) {
+            throw new Error(`kosmos for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
+        }
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const name = `${org.slug}-kosmos`;
+        const dbName = `${org.slug}-kosmos-db`.replace(/-/g, '_');
+        // #444: on the company's server there is no Coolify database to make, like Boule's.
+        const kosmosServer = this.homeOnServer(org, context, 'kosmos')
+            ? await this.serverHome(org, context, 'kosmos')
+            : null;
+        const dbId = kosmosServer
+            ? ''
+            : await this.ensureCallsDatabase(org, context, projectUuid, environment, `${org.slug}-kosmos-db`, dbName, KOSMOS_DATABASE_SCOPE_KEY);
+        if (!kosmosServer)
+            context.recordScopeId(KOSMOS_DATABASE_SCOPE_KEY, dbId);
+        const server = await this.resolveServer(org, context);
+        const githubApp = await this.ports.coolify.requireGithubApp();
+        const app = await this.findOrCreateCallsApp(name, environment.id, () => this.ports.coolify.createGithubAppApplication({
+            is_preview_deployments_enabled: false,
+            project_uuid: projectUuid,
+            server_uuid: server.uuid,
+            environment_name: environment.name,
+            environment_uuid: environment.uuid,
+            github_app_uuid: githubApp.uuid,
+            git_repository: KOSMOS_REPO,
+            git_branch: 'main',
+            build_pack: 'dockerfile',
+            name,
+            domains: coolifyTunnelDomains([kosmosHostnameFor(org)]),
+            dockerfile_location: KOSMOS_APP_DOCKERFILE,
+        }));
+        // Every app foundry deploys keeps its own logs (#75), reused as-is here.
+        await this.ensureLogVolume(app.appId, org, app.existed);
+        await this.ports.coolify.updateApplication(app.appId, {
+            ...healthCheckSettings('/api/health', KOSMOS_PORT),
+            ...(await this.routedLabels(name, kosmosHostnameFor(org), KOSMOS_PORT)),
+        });
+        const liveRows = (await this.ports.coolify.listEnvs(app.appId)).filter((e) => !e.is_preview);
+        const liveEnv = Object.fromEntries(liveRows.map((e) => [e.key, e.value]));
+        const envChanged = kosmosEnvDrift(env, liveEnv).length > 0;
+        const envs = Object.entries(env).map(([key, value]) => ({ key, value }));
+        const cookieSecret = await this.ensureAuthCookieSecret(app.appId);
+        if (cookieSecret)
+            envs.push({ key: 'AUTH_COOKIE_SECRET', value: cookieSecret });
+        await this.ports.coolify.bulkUpsertEnvs(app.appId, envs);
+        const dbPush = await this.pushDatabaseUrl(app.appId, dbId, dbName, kosmosServer ?? undefined);
+        if (!dbPush.pushed) {
+            throw new Error(`kosmos for ${org.slug}: its database has no internal_db_url yet -- retry this apply once Coolify reports one`);
+        }
+        if (!context.recordedIds()[KOSMOS_DEPLOYED_SCOPE_KEY]) {
+            const runtime = this.ports.runtime ?? {};
+            const built = await waitForNewDeployment(this.ports.coolify, app.appId, publicHealthCheck(org, context.recordedIds(), kosmosHostnameFor(org), '/api/health'), runtime, runtime.sleep ?? defaultSleep, 'coolify:kosmos', `${org.slug}'s kosmos stays at its previous deploy`);
+            await recordBuiltCommit(this.ports.coolify, { appId: app.appId, deploymentUuid: built.deploymentUuid, name: 'kosmos' }, (key, value) => context.recordScopeId(key, value));
+            context.recordScopeId(KOSMOS_DEPLOYED_SCOPE_KEY, '1');
+        }
+        else if (app.existed && (envChanged || cookieSecret !== null || dbPush.changed)) {
+            await this.ports.coolify.restart(app.appId);
+        }
+        return { resourceId: app.appId };
+    }
+    /**
+     * C3: the Archon credential of an org's Boule. Archon's mint rotates on every call, so it is called only
+     * when none was pushed or the recorded push time (no secret) is 335 days old. Otherwise the held value is
+     * written again unchanged. The secret is held first; the caller records `pushedAt` only after the env write
+     * succeeded, so a failed hold or a failed push is mended by the next apply minting again. Errors name no secret.
+     */
+    async ensureBouleArchonCredential(org, context) {
+        const at = `coolify:boule for ${org.slug}`;
+        const mint = this.ports.mintBouleArchonCredential;
+        const heldKeys = this.ports.heldKeys;
         if (!mint)
             throw new Error(`${at}: this executor was built without mintBouleArchonCredential`);
         if (!heldKeys?.put) {
@@ -6786,6 +7620,261 @@ export class FoundryStepExecutor {
         }
         return minted.token;
     }
+    /** The held keys with a timeout on every call: a hung store stops the step with a plain line. */
+    timedHeldKeys() {
+        const held = this.ports.heldKeys;
+        if (!held)
+            return undefined;
+        return {
+            resolve: (ref) => withLabelledTimeout('held key read', HELD_KEY_READ_TIMEOUT_MS, () => held.resolve(ref)),
+            ...(typeof held.put === 'function'
+                ? {
+                    put: (ref, value) => withLabelledTimeout('held key write', HELD_KEY_READ_TIMEOUT_MS, () => held.put(ref, value)),
+                }
+                : {}),
+        };
+    }
+    /** T3: the company's registrar key, held at `foundry:registrar:<org id>`; either step may make it. */
+    registrarKey(org, context) {
+        return ensureRegistrarKey({
+            orgId: org.id,
+            slug: org.slug,
+            heldKeys: this.timedHeldKeys(),
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+            log: (line) => console.info(`coolify: ${line}`),
+        });
+    }
+    /**
+     * T3, customers off: takes away the registrar env foundry gave Boule. The registrar step removes the record
+     * at the broker and forgets the key. Returns true when Boule's env changed.
+     */
+    async dropRegistrarEnv(appId, org, context, liveRows) {
+        if (registrarWanted(org) || !context.recordedIds()[REGISTRAR_DELIVERED_SCOPE_KEY])
+            return false;
+        // In step with the record: while the broker may still take the key, Boule keeps it.
+        const kept = !this.ports.broker
+            ? 'the host has not wired the broker port, so the record cannot be taken away'
+            : context.recordedIds()[REGISTRAR_REMOVAL_HELD_SCOPE_KEY]
+                ? 'the last removal at the broker wrote nothing'
+                : null;
+        if (kept) {
+            console.info(`coolify:boule for ${org.slug}: Boule keeps its registrar env: ${kept}`);
+            return false;
+        }
+        let changed = false;
+        for (const row of liveRows) {
+            if (row.key !== AUTH_REGISTRAR_KEY_ENV && row.key !== AUTH_REGISTRAR_URL_ENV)
+                continue;
+            if (!row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+                changed = true;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        context.recordScopeId(REGISTRAR_DELIVERED_SCOPE_KEY, '');
+        return changed;
+    }
+    /**
+     * T3: the company's record in the broker's `AUTH_REGISTRARS` (`plan/broker-registrar.ts`): its key (made
+     * and held first if the Boule step has not), its sign-in organisation, customers organisations and login
+     * host. With customers off it takes the record away, then forgets the key. The applied marker is recorded
+     * last and never holds the key; every error is redacted of it.
+     */
+    async brokerRegistrar(org, context) {
+        const at = `coolify:broker-registrar for ${org.slug}`;
+        const broker = this.ports.broker;
+        if (!broker)
+            throw new Error(`${at}: the broker port is not wired`);
+        const recorded = context.recordedIds();
+        const previousOrganizationId = appliedRegistrarOrganization(recorded);
+        if (!registrarWanted(org)) {
+            const keys = [];
+            const heldKeys = this.timedHeldKeys();
+            let removal;
+            try {
+                // The held key finds the record whatever organisation it names, also after a crash before the
+                // applied marker; the recorded sign-in organisation does too.
+                const ownKey = recorded[REGISTRAR_MINTED_SCOPE_KEY]
+                    ? ((await heldKeys?.resolve(registrarRef(org.id))) ?? null)
+                    : null;
+                if (ownKey) {
+                    keys.push(ownKey);
+                    this.handledSecrets.add(ownKey);
+                }
+                removal = await writeRegistrar(broker, {
+                    slug: org.slug,
+                    record: null,
+                    previousOrganizationId,
+                    ownOrganizationIds: [recorded[ZITADEL_ORG_SCOPE_KEY] ?? ''],
+                    ownKey,
+                    secret: (value) => {
+                        keys.push(value);
+                        this.handledSecrets.add(value);
+                    },
+                    log: (line) => console.info(redactSecrets(line, keys)),
+                });
+            }
+            catch (error) {
+                throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), keys));
+            }
+            if (removal.removalHeld) {
+                // The record stays at the broker, so the key stays held; the plan says why.
+                console.info(`${at}: the record is not taken away and the key is kept: ${removal.removalHeld}`);
+                context.recordScopeId(REGISTRAR_REMOVAL_HELD_SCOPE_KEY, removal.removalHeld);
+                return {};
+            }
+            context.recordScopeId(REGISTRAR_REMOVAL_HELD_SCOPE_KEY, '');
+            context.recordScopeId(REGISTRAR_APPLIED_SCOPE_KEY, '');
+            context.recordScopeId(REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, '');
+            await context.persistScopeIds();
+            // Last: the broker no longer takes the key, so forgetting it leaves nothing that needs it.
+            if (recorded[REGISTRAR_MINTED_SCOPE_KEY]) {
+                if (!heldKeys?.put) {
+                    throw new Error(`${at}: the held keys cannot forget the registrar key (ref ${registrarRef(org.id)})`);
+                }
+                await heldKeys.put(registrarRef(org.id), '');
+                context.recordScopeId(REGISTRAR_MINTED_SCOPE_KEY, '');
+            }
+            return {};
+        }
+        const wanted = wantedRegistrar(org, recorded);
+        if ('missing' in wanted) {
+            throw new Error(`${at}: ${wanted.missing.map((m) => m.what).join(', ')} not recorded yet`);
+        }
+        const { key, mint } = await this.registrarKey(org, context);
+        // Every company's key the broker's env holds, so none can leave in an error.
+        const keys = [key];
+        let result;
+        try {
+            result = await writeRegistrar(broker, {
+                slug: org.slug,
+                record: { ...wanted.want, key },
+                previousOrganizationId,
+                secret: (value) => {
+                    keys.push(value);
+                    this.handledSecrets.add(value);
+                },
+                log: (line) => console.info(redactSecrets(line, keys)),
+            });
+        }
+        catch (error) {
+            throw new Error(redactSecrets(error instanceof Error ? error.message : String(error), keys));
+        }
+        context.recordScopeId(REGISTRAR_DEPLOY_WAITS_SCOPE_KEY, result.waits.join(', '));
+        // Last: a run that failed above plans the step again.
+        context.recordScopeId(REGISTRAR_APPLIED_SCOPE_KEY, registrarAppliedValue(wanted.want, mint));
+        return {};
+    }
+    customerGrantsCredential(org, entryKey, context) {
+        return ensureCustomerGrantsCredential({
+            orgId: org.id,
+            slug: org.slug,
+            entryKey,
+            heldKeys: this.timedHeldKeys(),
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+        });
+    }
+    /**
+     * F13, app side: an entry with `uses.customerGrants` gets `CUSTOMER_GRANTS_CREDENTIAL` (made and held first,
+     * once). An entry that had one and no longer declares the flag loses the env and the held value; each part is
+     * repeated safely, so a run that died halfway is finished by the next.
+     */
+    async customerGrantsAppEnv(appId, org, entry, context, envs) {
+        if (entry.uses?.customerGrants) {
+            envs.push({
+                key: CUSTOMER_GRANTS_CREDENTIAL_ENV,
+                value: await this.customerGrantsCredential(org, entry.key, context),
+            });
+            return;
+        }
+        // Either marker says the app may still hold the env: the held value may already be forgotten by Boule's step.
+        const recorded = context.recordedIds();
+        const minted = Boolean(recorded[customerGrantsMintedScopeKey(entry.key)]);
+        const applied = (recorded[appEnvAppliedScopeKey(entry.key)] ?? '').includes(`"${CUSTOMER_GRANTS_CREDENTIAL_ENV}"`);
+        if (!minted && !applied)
+            return;
+        const at = `coolify:app for ${org.slug}`;
+        for (const row of await this.ports.coolify.listEnvs(appId)) {
+            if (row.key !== CUSTOMER_GRANTS_CREDENTIAL_ENV || row.is_preview || !row.uuid)
+                continue;
+            try {
+                await this.ports.coolify.deleteEnv(appId, row.uuid);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        if (minted)
+            await this.forgetCustomerGrantsCredential(org, entry.key, context, at);
+    }
+    /** Forgets one entry's held credential and clears its marker. Held first, marker last, so a failed forget is repeated. */
+    async forgetCustomerGrantsCredential(org, entryKey, context, at) {
+        const heldKeys = this.timedHeldKeys();
+        if (typeof heldKeys?.put !== 'function') {
+            throw new Error(`${at}: the held keys cannot forget the customer grants credential of entry '${entryKey}' (ref ${customerGrantsRef(org.id, entryKey)})`);
+        }
+        await heldKeys.put(customerGrantsRef(org.id, entryKey), '');
+        context.recordScopeId(customerGrantsMintedScopeKey(entryKey), '');
+        await context.persistScopeIds();
+    }
+    /** F13: the held credentials of entries that no longer declare the flag, forgotten after Boule stopped listing them. */
+    async forgetDroppedCustomerGrants(org, context) {
+        for (const key of customerGrantsToDrop(org, context.recordedIds())) {
+            await this.forgetCustomerGrantsCredential(org, key, context, `coolify:boule for ${org.slug}`);
+        }
+    }
+    /**
+     * F13, Boule side: the `CUSTOMER_GRANTS` value for the flagged entries (each credential made and held if it
+     * is not yet), or `value: null`. With no flagged entry left and a value foundry wrote, the env row is
+     * removed (`removed`). A flagged entry that cannot be listed yet changes nothing. Never a hand-set value
+     * it did not write.
+     */
+    async customerGrantsForBoule(appId, org, context, planned, directoryCredential, liveRows) {
+        const none = { value: null, removed: false, secrets: [] };
+        const at = `coolify:boule for ${org.slug}`;
+        if (!planned) {
+            if (customerGrantsEntries(org).length > 0)
+                return none;
+            if (!context.recordedIds()[CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY])
+                return none;
+            for (const row of liveRows) {
+                if (row.key !== CUSTOMER_GRANTS_ENV || !row.uuid)
+                    continue;
+                try {
+                    await this.ports.coolify.deleteEnv(appId, row.uuid);
+                }
+                catch (error) {
+                    if (!isNotFoundError(error))
+                        throw error;
+                }
+            }
+            context.recordScopeId(CUSTOMER_GRANTS_WRITTEN_SCOPE_KEY, '');
+            await context.persistScopeIds();
+            return { ...none, removed: liveRows.some((row) => row.key === CUSTOMER_GRANTS_ENV) };
+        }
+        const wanted = wantedCustomerGrants(org, context.recordedIds(), { live: true });
+        if (!wanted.shape || !directoryCredential) {
+            throw new Error(`${at}: the plan carries customer grants this run cannot build (${wanted.notes.join('; ') || 'no directory credential'}); plan this org's Boule again`);
+        }
+        const credentials = {};
+        for (const key of Object.keys(wanted.shape.apps)) {
+            credentials[key] = await this.customerGrantsCredential(org, key, context);
+        }
+        const value = customerGrantsJson(wanted.shape, directoryCredential, credentials);
+        return { value, removed: false, secrets: [...Object.values(credentials), value] };
+    }
     /** `put`, tried up to {@link BOULE_CREDENTIAL_ATTEMPTS} times; true once one attempt succeeds. The cause is dropped. */
     async holdWithRetry(ref, value, put, label) {
         for (let attempt = 1; attempt <= BOULE_CREDENTIAL_ATTEMPTS; attempt++) {
@@ -6817,7 +7906,9 @@ export class FoundryStepExecutor {
         }
         let changed = false;
         for (const row of liveRows) {
-            if (row.key !== BOULE_CUSTOMERS_ORG_ENV && row.key !== BOULE_CUSTOMERS_CREDENTIAL_ENV)
+            if (row.key !== BOULE_CUSTOMERS_ORG_ENV &&
+                row.key !== BOULE_TEST_CUSTOMERS_ORG_ENV &&
+                row.key !== BOULE_CUSTOMERS_CREDENTIAL_ENV)
                 continue;
             if (!row.uuid)
                 continue;
@@ -7020,6 +8111,30 @@ export class FoundryStepExecutor {
             project: { ensure: () => this.ensureCoolifyProject(org, context) },
         });
     }
+    /**
+     * `plan/own-diff.ts`'s `planOwnJobsRoute`: the org's scheduler on `jobs.<domain>`, through the company's own
+     * edge-routed DNS and tunnel ports, dialling the address `coolify:own-jobs` recorded.
+     */
+    async ownJobsRoute(action, org, context) {
+        const own = this.ports.ownServices;
+        if (!own)
+            throw new Error(OWN_SERVICES_PORT_ABSENT);
+        const internalUrl = context.recordedIds()[JOBS_INTERNAL_URL_SCOPE_KEY];
+        if (!internalUrl) {
+            throw new Error(`own step coolify:own-jobs-route for ${org.slug}: the jobs scheduler has not recorded its address yet; apply its step first`);
+        }
+        const scope = scopeFromOrg(context, {});
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        return provisionJobsRoute(scope, {
+            coolify: limited(this.placedForCompany(own.provision.sfu.coolify, org, context), LIMITS.connector),
+            network: orgNetwork({ dns: this.dnsPort(), tunnels: this.tunnelPort(), zones: this.zonePort() }, scope, `${org.slug}:jobs-route`),
+        }, orgTarget(org), {
+            hostname: action.desired.hostname,
+            apex: ownHostnames(org).zone,
+            internalUrl,
+            projectUuid,
+        });
+    }
     /**
      * `plan/own-diff.ts`'s `planOwnFiles`: the org's own files host in the
      * org's own project, trusting the company's issuer `https://auth.<domain>`.
@@ -7426,6 +8541,168 @@ export class FoundryStepExecutor {
             ...(context.serverIpv4 ? { serverIpv4: context.serverIpv4 } : {}),
         });
     }
+    /**
+     * `plan/entry-jobs.ts`'s `planEntryJobs`: registers one entry as its own project in the platform's jobs
+     * scheduler, holds the credentials the scheduler shows once, then writes `JOBS_SCHEDULER_URL`,
+     * `JOBS_SIGNING_SECRET` and `JOBS_SYNC_KEY` to the entry's env and restarts the app.
+     *
+     * The project's id is recorded as undelivered and persisted before the credentials are held, and cleared
+     * only once both are, so a failure in between never registers a second project: `planEntryJobs` blocks
+     * on it. Credentials already held are never registered again, which is also how a failed env write is
+     * retried. Errors name the project and the refs, never a credential.
+     */
+    async jobsProject(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `jobs:project for ${org.slug} entry '${entryKey}'`;
+        const want = action.desired;
+        if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.jobs)) {
+            throw new Error(`${at}: the entry no longer declares uses.jobs`);
+        }
+        const appId = context.recordedIds()[`coolify:app:${appStepKey(org, entryKey)}`];
+        if (!appId)
+            throw new Error(`${at}: the entry's app is not recorded yet`);
+        const held = this.ports.heldKeys;
+        const put = held?.put?.bind(held);
+        if (!held || !put)
+            throw new Error(`${at}: the held keys cannot hold the project's credentials`);
+        const refs = entryJobsRefs(org.id, entryKey);
+        const read = async (ref) => {
+            try {
+                const value = await withTimeout(held.resolve(ref), JOBS_PROJECT_CALL_TIMEOUT_MS);
+                return value || null;
+            }
+            catch {
+                throw new Error(`${at}: the held key ${ref} could not be read`);
+            }
+        };
+        let signingSecret = await read(refs.signingSecret);
+        let syncKey = await read(refs.syncKey);
+        if (Boolean(signingSecret) !== Boolean(syncKey)) {
+            throw new Error(`${at}: only one of the project's credentials is held (${refs.signingSecret}, ${refs.syncKey}); the scheduler shows them once, so deregister project ${want.name} and hold neither`);
+        }
+        if (signingSecret)
+            this.handledSecrets.add(signingSecret);
+        if (syncKey)
+            this.handledSecrets.add(syncKey);
+        if (!signingSecret || !syncKey) {
+            const scheduler = await this.jobsPort(org);
+            let registered;
+            try {
+                registered = await withTimeout(scheduler.registerProject({ name: want.name, baseUrl: want.baseUrl }), JOBS_PROJECT_CALL_TIMEOUT_MS);
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : 'no detail';
+                throw new Error(`${at}: the scheduler refused or did not answer the registration (${detail})`);
+            }
+            if (registered.secret)
+                this.handledSecrets.add(registered.secret);
+            if (registered.syncKey)
+                this.handledSecrets.add(registered.syncKey);
+            context.recordScopeId(entryJobsUndeliveredScopeKey(entryKey), registered.id);
+            await context.persistScopeIds();
+            if (!registered.secret || !registered.syncKey) {
+                throw new Error(`${at}: project ${registered.id} is registered but the scheduler returned ${registered.secret || registered.syncKey ? 'only one of' : 'neither of'} its credentials, which it shows once; deregister it (DELETE /admin/projects/${want.name}) and remove the recorded key ${entryJobsUndeliveredScopeKey(entryKey)}`);
+            }
+            for (const [ref, value] of [
+                [refs.signingSecret, registered.secret],
+                [refs.syncKey, registered.syncKey],
+            ]) {
+                let stored = false;
+                for (let attempt = 1; attempt <= JOBS_PROJECT_HOLD_ATTEMPTS && !stored; attempt++) {
+                    try {
+                        await withTimeout(put(ref, value), JOBS_PROJECT_CALL_TIMEOUT_MS);
+                        stored = true;
+                    }
+                    catch {
+                        // Retried; the error is dropped in case it echoes the credential.
+                    }
+                }
+                if (!stored) {
+                    throw new Error(`${at}: project ${registered.id} is registered but the credential for ${ref} could not be held after ${JOBS_PROJECT_HOLD_ATTEMPTS} attempts; deregister it (DELETE /admin/projects/${want.name}) and remove the recorded key ${entryJobsUndeliveredScopeKey(entryKey)}`);
+                }
+            }
+            signingSecret = registered.secret;
+            syncKey = registered.syncKey;
+            forgetScopeId(context, entryJobsUndeliveredScopeKey(entryKey));
+            await context.persistScopeIds();
+        }
+        try {
+            await withTimeout(this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: 'JOBS_SCHEDULER_URL', value: want.schedulerUrl, literal: true },
+                { key: 'JOBS_SIGNING_SECRET', value: signingSecret, literal: true },
+                { key: 'JOBS_SYNC_KEY', value: syncKey, literal: true },
+            ]), JOBS_PROJECT_CALL_TIMEOUT_MS);
+            await withTimeout(this.ports.coolify.restart(appId), JOBS_PROJECT_CALL_TIMEOUT_MS);
+        }
+        catch {
+            // The error is dropped in case Coolify echoes the request body.
+            throw new Error(`${at}: the project's credentials are held but could not be written to the app's env; the next apply writes them again`);
+        }
+        context.recordScopeId(entryJobsAppliedScopeKey(entryKey), entryJobsWantMarker(want));
+        return { resourceId: want.name };
+    }
+    /** `plan/entry-audit.ts`: makes the platform signer if none exists and registers one entry's ledger for sealing. */
+    async auditLedger(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `audit:ledger for ${org.slug} entry '${entryKey}'`;
+        if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.audit === true)) {
+            throw new Error(`${at}: the entry no longer declares uses.audit`);
+        }
+        const held = this.timedHeldKeys();
+        if (typeof held?.put !== 'function') {
+            throw new Error(`${at}: the held keys cannot hold the platform signer's key`);
+        }
+        return applyEntryAudit({
+            heldKeys: { resolve: held.resolve, put: held.put },
+            org: { id: org.id, slug: org.slug },
+            entryKey,
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+        });
+    }
+    /** F12, `plan/entry-repo-key.ts`: makes or removes one entry's deploy key. See `entry-repo-key-apply.ts`. */
+    async githubDeployKey(action, org, context) {
+        const entryKey = action.key.slice(org.id.length + 1);
+        const at = `github:deploy-key for ${org.slug} entry '${entryKey}'`;
+        const desired = action.desired;
+        const github = this.ports.githubDeployKeys;
+        if (!github)
+            throw new Error(`${at}: the host gave no GitHub deploy-key client`);
+        const held = this.timedHeldKeys();
+        if (typeof held?.put !== 'function') {
+            throw new Error(`${at}: the held keys cannot hold the key's private half`);
+        }
+        const deps = {
+            github,
+            heldKeys: { resolve: held.resolve, put: held.put },
+            coolify: this.ports.coolify,
+            org: { id: org.id, slug: org.slug },
+            entryKey,
+            appId: context.recordedIds()[`coolify:app:${appStepKey(org, entryKey)}`],
+            recorded: () => context.recordedIds(),
+            record: (key, value) => context.recordScopeId(key, value),
+            persist: () => context.persistScopeIds(),
+            secret: (value) => void this.handledSecrets.add(value),
+            installationFor: (repo) => companyGithubFor(org.hosting, repo)?.installationId,
+        };
+        if (desired.remove) {
+            await removeRepoKey(deps, desired.repo);
+            return {};
+        }
+        if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.repo)) {
+            throw new Error(`${at}: the entry no longer declares uses.repo`);
+        }
+        await ensureRepoKey(deps, {
+            repo: desired.repo,
+            access: desired.access === 'write' ? 'write' : 'read',
+            ...(companyGithubFor(org.hosting, desired.repo)
+                ? { installationId: companyGithubFor(org.hosting, desired.repo)?.installationId }
+                : {}),
+        });
+        return {};
+    }
     async jobsRegistration(action, org, context) {
         const scheduler = await this.jobsPort(org);
         const name = action.desired.name;
@@ -7695,6 +8972,7 @@ export class FoundryStepExecutor {
             }
         }
         await this.publishOikosEntryRecords(org, tunnel.id, previousIds, context);
+        await this.publishAppsEntryRecords(org, tunnel.id, previousIds, context);
         return { resourceId: tunnel.id };
     }
     /**
@@ -7708,19 +8986,41 @@ export class FoundryStepExecutor {
      * halfway is planned again.
      */
     async publishOikosEntryRecords(org, tunnelId, previousIds, context) {
-        const wanted = entryOikosHostnames(org);
-        const recorded = context.recordedIds()[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+        await this.publishPlatformZoneEntryRecords(org, tunnelId, previousIds, context, {
+            zoneName: NO_DOMAIN_ZONE,
+            wanted: entryOikosHostnames(org, context.recordedIds()),
+            scopeKey: CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY,
+            owns: (name) => ownsOikosName(org, name),
+        });
+    }
+    /**
+     * The entry names a company has in the platform's `companyincluded.app` zone: its apps' `hostedName`
+     * addresses. Written the same way as {@link publishOikosEntryRecords}. Which company may hold a name is
+     * the host's check (Archon), so the step owns any single-label name under the zone.
+     */
+    async publishAppsEntryRecords(org, tunnelId, previousIds, context) {
+        await this.publishPlatformZoneEntryRecords(org, tunnelId, previousIds, context, {
+            zoneName: APPS_DOMAIN,
+            wanted: entryAppsHostnames(org, context.recordedIds()),
+            scopeKey: CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY,
+            owns: (name) => ownsAppsZoneName(org, name),
+            organisationId: org.id,
+        });
+    }
+    async publishPlatformZoneEntryRecords(org, tunnelId, previousIds, context, zoneSpec) {
+        const { zoneName, wanted, scopeKey, owns, organisationId } = zoneSpec;
+        const recorded = context.recordedIds()[scopeKey];
         const previous = recorded ? recorded.split(',') : [];
         if (wanted.length === 0 && previous.length === 0)
             return;
         for (const name of wanted) {
-            if (!ownsOikosName(org, name)) {
-                throw new Error(`cloudflare:tunnel for ${org.slug}: ${name} is not a name this company may write in the ${NO_DOMAIN_ZONE} zone`);
+            if (!owns(name)) {
+                throw new Error(`cloudflare:tunnel for ${org.slug}: ${name} is not a name this company may write in the ${zoneName} zone`);
             }
         }
-        const zone = await this.zonePort().findZoneByApex(NO_DOMAIN_ZONE);
+        const zone = await this.zonePort().findZoneByApex(zoneName);
         if (!zone) {
-            throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${NO_DOMAIN_ZONE} to point its entry names at`);
+            throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${zoneName} to point its entry names at`);
         }
         const dns = this.dnsPort();
         const dnsTarget = `${tunnelId}.cfargotunnel.com`;
@@ -7728,7 +9028,7 @@ export class FoundryStepExecutor {
             dnsTarget,
             ...[...previousIds].map((id) => `${id}.cfargotunnel.com`),
         ]);
-        const [shared] = await dns.findDnsRecord(zone.name, `*.${NO_DOMAIN_ZONE}`, 'CNAME');
+        const [shared] = await dns.findDnsRecord(zone.name, `*.${zoneName}`, 'CNAME');
         const writes = [];
         const conflicts = [];
         for (const name of wanted) {
@@ -7739,7 +9039,13 @@ export class FoundryStepExecutor {
                 continue;
             }
             const [cname] = await dns.findDnsRecord(zone.name, name, 'CNAME');
-            const record = { type: 'CNAME', name, content: dnsTarget, proxied: true };
+            const record = {
+                type: 'CNAME',
+                name,
+                content: dnsTarget,
+                proxied: true,
+                ...(organisationId === undefined ? {} : { organisationId }),
+            };
             if (!cname)
                 writes.push(() => dns.createDnsRecord(zone.name, record));
             else if (cname.content === dnsTarget)
@@ -7756,14 +9062,14 @@ export class FoundryStepExecutor {
         for (const write of writes)
             await write();
         for (const name of previous.filter((n) => !wanted.includes(n))) {
-            if (!ownsOikosName(org, name))
+            if (!owns(name))
                 continue;
             for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
                 if (ownTargets.has(record.content))
                     await dns.deleteDnsRecord(zone.name, record.id);
             }
         }
-        context.recordScopeId(CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, wanted.join(','));
+        context.recordScopeId(scopeKey, wanted.join(','));
     }
     /**
      * #236: when this tunnel's DNS was last published under a domain that
@@ -8814,8 +10120,9 @@ export class FoundryStepExecutor {
             return {};
         }
         if (entryKey === BOULE_EDGE_ENTRY_KEY) {
-            if (!org.domain)
-                throw new Error(`${at}: Boule's edge key needs org.domain`);
+            if (!bouleEdgeKeyWanted(org)) {
+                throw new Error(`${at}: Boule's edge key needs org.domain or org.boule.apps`);
+            }
         }
         else if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.edge)) {
             throw new Error(`${at}: the entry no longer declares uses.edge`);
@@ -8823,7 +10130,7 @@ export class FoundryStepExecutor {
         const appId = context.recordedIds()[edgeKeyAppRecordKey(org, entryKey)];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
-        if (!org.domain) {
+        if (entryKey !== BOULE_EDGE_ENTRY_KEY && !org.domain) {
             throw new Error(`${at}: edge needs org.domain, and validateEntryEdge already refuses it without one`);
         }
         // A key left over from a previous mint whose delivery never succeeded
@@ -8846,7 +10153,7 @@ export class FoundryStepExecutor {
         }
         const minted = await edge.mintKey({
             organisationId: org.id,
-            domain: org.domain,
+            domain: edgeKeyDomain(org),
             name: desired.name,
             expiresDays: EDGE_ENTRY_KEY_DAYS,
         });
@@ -8874,6 +10181,150 @@ export class FoundryStepExecutor {
         // Names the key id only; the underlying error is dropped in case it echoes the secret.
         throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
     }
+    /**
+     * F7 (#928): the company's signed-records registrar key (`plan/keys-registrar.ts`). Mint: a leftover
+     * undelivered key is revoked first; the new key's id is recorded and persisted before it is written to
+     * Boule's env (3 tries, then the error names the id only and the next apply revokes and mints again).
+     * `url` rewrites the address only. Retire revokes and takes both env rows away. Never holds the key.
+     */
+    async keysRegistrar(action, org, context) {
+        const at = `coolify:keys-registrar for ${org.slug}`;
+        const keys = this.ports.keysRegistrar;
+        if (!keys)
+            throw new Error(`${at}: this executor was built without a KeysRegistrarPort`);
+        const desired = action.desired;
+        const recorded = context.recordedIds();
+        const appId = recorded[`coolify:boule:${org.id}`];
+        const revoke = async (id) => {
+            try {
+                await keys.revokeCompanyKey(org.id, id);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        };
+        const tolerate = async (call, gone) => {
+            try {
+                return await call();
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+                return gone;
+            }
+        };
+        if (desired.mode === 'retire') {
+            for (const id of new Set([recorded[KEYS_REGISTRAR_SCOPE_KEY], recorded[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY]].filter((id) => Boolean(id)))) {
+                await revoke(id);
+            }
+            if (recorded[KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY]) {
+                // A mint whose answer was lost may have left a key no id points at.
+                await keys.revokeAllCompanyKeys(org.id);
+            }
+            if (appId) {
+                const rows = await tolerate(() => this.ports.coolify.listEnvs(appId), []);
+                for (const name of [KEYS_REGISTRAR_URL_ENV, KEYS_REGISTRAR_KEY_ENV]) {
+                    const row = rows.find((e) => e.key === name && !e.is_preview);
+                    if (row?.uuid) {
+                        const uuid = row.uuid;
+                        await tolerate(() => this.ports.coolify.deleteEnv(appId, uuid), undefined);
+                    }
+                }
+            }
+            for (const scope of [
+                KEYS_REGISTRAR_SCOPE_KEY,
+                KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY,
+                KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY,
+                KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY,
+                KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY,
+            ]) {
+                context.recordScopeId(scope, '');
+            }
+            return {};
+        }
+        if (!appsOn(org))
+            throw new Error(`${at}: the company's Boule runs no apps (org.boule.apps)`);
+        if (!appId)
+            throw new Error(`${at}: Boule is not recorded yet`);
+        if (!desired.keysUrl)
+            throw new Error(`${at}: the plan gave no keys service address`);
+        if (desired.mode === 'url') {
+            await this.ports.coolify.bulkUpsertEnvs(appId, [
+                { key: KEYS_REGISTRAR_URL_ENV, value: desired.keysUrl, literal: true },
+            ]);
+            await this.ports.coolify.restart(appId);
+            context.recordScopeId(KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, desired.keysUrl);
+            return {};
+        }
+        if (recorded[KEYS_REGISTRAR_SCOPE_KEY])
+            return {};
+        const stale = recorded[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY];
+        if (stale) {
+            await revoke(stale);
+            context.recordScopeId(KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, '');
+            await context.persistScopeIds();
+        }
+        if (recorded[KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY]) {
+            // The last mint's answer never reached us, so a key may exist whose id was never recorded. Revoke all
+            // of the company's registrar keys first (none is delivered: the delivered id is not recorded here).
+            const revoked = await keys.revokeAllCompanyKeys(org.id);
+            console.info(`${at}: revoked ${revoked} registrar key(s) left by a mint whose answer was lost, before minting again`);
+        }
+        context.recordScopeId(KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, new Date(context.now?.() ?? Date.now()).toISOString());
+        await context.persistScopeIds();
+        const minted = await keys.mintCompanyKey({
+            organisationId: org.id,
+            name: desired.name ?? `${org.slug}-registrar`,
+            expiresDays: KEYS_REGISTRAR_KEY_DAYS,
+        });
+        this.handledSecrets.add(minted.secret);
+        context.recordScopeId(KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, minted.id);
+        context.recordScopeId(KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, '');
+        await context.persistScopeIds();
+        const rows = [
+            { key: KEYS_REGISTRAR_URL_ENV, value: desired.keysUrl, literal: true },
+            { key: KEYS_REGISTRAR_KEY_ENV, value: minted.secret, literal: true },
+        ];
+        let lastError;
+        for (let attempt = 1; attempt <= KEYS_REGISTRAR_DELIVERY_ATTEMPTS; attempt++) {
+            try {
+                await this.ports.coolify.bulkUpsertEnvs(appId, rows);
+                await this.ports.coolify.restart(appId);
+                context.recordScopeId(KEYS_REGISTRAR_SCOPE_KEY, minted.id);
+                context.recordScopeId(KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, '');
+                context.recordScopeId(KEYS_REGISTRAR_MINTED_AT_SCOPE_KEY, new Date(context.now?.() ?? Date.now()).toISOString());
+                context.recordScopeId(KEYS_REGISTRAR_URL_APPLIED_SCOPE_KEY, desired.keysUrl);
+                return {};
+            }
+            catch (e) {
+                lastError = e;
+            }
+        }
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to Boule's env after ${KEYS_REGISTRAR_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a new one`);
+    }
+    /**
+     * F3: `plan/entry-edge-key.ts`'s `planEdgeSlug` -- records the org's slug in edge. A slug another company
+     * holds (edge's `409`) is a plain line naming the clash, not the raw provider error.
+     */
+    async edgeSlug(action, org, context) {
+        const edge = this.ports.edge;
+        if (!edge) {
+            throw new Error(`edge:slug for ${org.slug}: this executor was built without an EdgePort`);
+        }
+        const slug = action.desired.slug;
+        try {
+            await edge.setOrganisationSlug(org.id, slug);
+        }
+        catch (e) {
+            if (e instanceof EdgeApiError && e.code === 'conflict') {
+                throw new Error(`edge:slug for ${org.slug} is blocked: edge says another company already holds the slug '${slug}', so its platform hostnames cannot be accepted; change the slug`);
+            }
+            throw e;
+        }
+        context.recordScopeId(EDGE_SLUG_APPLIED_SCOPE_KEY, slug);
+        return {};
+    }
     /**
      * F7 (#317): `plan/entry-edge-key.ts`'s `planEdgeReservedLabels` --
      * tells the edge service every label this org's own entries already
@@ -9299,6 +10750,28 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
+                    const appsNames = (recordedIds[CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY] ?? '')
+                        .split(',')
+                        .filter((name) => name !== '' && name.endsWith(`.${APPS_DOMAIN}`));
+                    if (appsNames.length > 0) {
+                        try {
+                            const zone = await this.zonePort().findZoneByApex(APPS_DOMAIN);
+                            if (zone) {
+                                const dns = this.dnsPort();
+                                for (const name of appsNames) {
+                                    for (const record of await dns.findDnsRecord(zone.name, name, 'CNAME')) {
+                                        if (dnsTargets.has(record.content)) {
+                                            await dns.deleteDnsRecord(zone.name, record.id);
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        catch (error) {
+                            if (!isNotFoundError(error))
+                                throw error;
+                        }
+                    }
                     await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }
@@ -9377,6 +10850,16 @@ export class FoundryStepExecutor {
                 case 'coolify:bg-app':
                     await this.ports.coolify.deleteApplication(target.id);
                     return;
+                case 'coolify:github-source':
+                    try {
+                        await withLabelledTimeout(`coolify:github-source for ${org.slug}: deleting the source`, GITHUB_SOURCE_TIMEOUT_MS, () => this.ports.coolify.raw('DELETE', `/github-apps/${target.id}`));
+                    }
+                    catch (error) {
+                        // withTimeout hides the cause; a source already gone counts as deleted.
+                        if (!(await this.githubSourceGone(target.id)))
+                            throw error;
+                    }
+                    return;
                 case 'cloudflare:bg-access':
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
@@ -9384,16 +10867,31 @@ export class FoundryStepExecutor {
                     await this.accessPort().removeServiceToken(target.id);
                     return;
                 case 'cloudflare:bg-dns': {
-                    // `target.id` is the recorded route ({ hostname, service }); its name lives in the org's zone.
-                    const hostname = JSON.parse(target.id).hostname;
-                    const zone = org.domain ? await this.zonePort().findZoneByApex(org.domain) : undefined;
-                    if (typeof hostname !== 'string' || !zone)
+                    // `target.id` is the recorded route ({ hostname, service }). The zone comes from the hostname
+                    // (`<label>-hd.<zone apex>`, one label deep), as the apps-off retire finds it: a company on
+                    // oikos.host has no `org.domain`, and the apps database's record lives in the platform zone.
+                    let hostname;
+                    try {
+                        hostname = JSON.parse(target.id).hostname;
+                    }
+                    catch {
+                        hostname = undefined;
+                    }
+                    if (typeof hostname !== 'string' || !hostname.includes('.'))
+                        return;
+                    const zone = await this.zonePort().findZoneByApex(hostname.slice(hostname.indexOf('.') + 1));
+                    if (!zone)
                         return;
                     const dns = this.dnsPort();
+                    // Only this company's own tunnel's record is deleted; a record that points anywhere else is not ours.
+                    const ownTunnel = recordedIds[`cloudflare:tunnel:${org.id}`];
                     for (const record of await dns.findDnsRecord(zone.name, hostname, 'CNAME')) {
-                        if (record.content.endsWith('.cfargotunnel.com')) {
+                        if (ownTunnel && record.content === `${ownTunnel}.cfargotunnel.com`) {
                             await dns.deleteDnsRecord(zone.name, record.id);
                         }
+                        else {
+                            console.info(`cloudflare:bg-dns for ${org.slug}: left the DNS record ${hostname} alone, it does not point at this company's tunnel`);
+                        }
                     }
                     return;
                 }
@@ -9415,6 +10913,26 @@ export class FoundryStepExecutor {
                 case 'coolify:database':
                     await this.ports.coolify.deleteDatabase(target.id);
                     return;
+                case 'coolify:keys-registrar': {
+                    // F7: the company's registrar key at the keys service (live or never delivered).
+                    const keys = this.ports.keysRegistrar;
+                    if (!keys) {
+                        throw new Error(`coolify:keys-registrar for ${org.slug}: this executor was built without a KeysRegistrarPort; cannot revoke key ${target.id}`);
+                    }
+                    if (target.key === 'all') {
+                        // Every registrar key of the company, including one no recorded id points at.
+                        await keys.revokeAllCompanyKeys(org.id);
+                        return;
+                    }
+                    try {
+                        await keys.revokeCompanyKey(org.id, target.id);
+                    }
+                    catch (error) {
+                        if (!isNotFoundError(error))
+                            throw error;
+                    }
+                    return;
+                }
                 case 'coolify:own-files-r2': {
                     // An own files bucket's storage key; a 404 is caught below as already gone.
                     const r2Keys = this.ports.ownServices?.provision.files.r2Keys;
@@ -9450,6 +10968,7 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'zitadel:customers':
+                case 'zitadel:customers-test':
                 case 'zitadel:org':
                     await this.ports.zitadel.deleteOrg(target.id);
                     return;