@wtfalch/foundry 0.60.0 → 0.62.0

package/dist/plan/plan-apply.js

@@ -1,4 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
+import { runAuditSealTick } from '../audit/tick.js';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { sfuSlotPorts } from '../calls-sfu.js';
 import { ORG_SERVICE_SCHEMAS, heldEnvRef, ownsServices, validateHosting } from '../org.js';
@@ -8,6 +9,7 @@ import { StaleLeaseError, } from '../store.js';
 import { entryHasDatabase } from '../worker-app-config.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
+import { APPS_DB_ENTRY_KEY } from './apps-db-route.js';
 import { NetworkMoveBackupMissingError, OrgPostgresMigrationBackupMissingError, SigninDbMoveBackupMissingError, UpgradeBackupMissingError, platformDatabasesForService, requireFreshBackupForOrgPostgresMigration, requireFreshBackupForSigninMove, requireFreshBackupsForMove, requireFreshBackupsForUpgrades, } from './backup-gate.js';
 import { ARCHON_REPO, PRIMARY_SERVER_SCOPE_KEY, archonSubject, blueGreenSubjects, declaresBlueGreen, lbOrigin, } from './blue-green.js';
 import { readLiveBuilds } from './build-record.js';
@@ -15,22 +17,27 @@ import { LEGACY_BACKUP_NAMES } from './company-backups.js';
 import { unconfirmedUpgrades } from './confirm-upgrade.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
-import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, bouleEdgeKeyWanted, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
+import { probeRepoKeys, repoKeyProbeTargets, repoKeysInPlay, } from './entry-repo-key.js';
+import { PLATFORM_GITHUB_APP_REFS } from './held-key-refs.js';
+import { KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY, KEYS_REGISTRAR_SCOPE_KEY, KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY, } from './keys-registrar.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { hostingNames } from './locked-hostnames.js';
 import { agoraIssuerHostFor, loginHostServesAgora, readLoginHostDiscovery, } from './login-host.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_BASE, OWN_MAIL_SMTP_PORT_MAX, OWN_MAIL_SMTP_PORT_SCOPE_KEY, PLATFORM_MAIL_RELAY_ROUTES_SCOPE_KEY, isOwnMailSmtpPort, mailRelayFingerprint, } from './mail-relay.js';
+import { ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY } from './org-apps-admin.js';
 import { findNameClashes, nameClashMessage } from './org-names.js';
 import { InvalidMigrationConfirmationError, ORG_POSTGRES_MIGRATION_CONFIRMED_SCOPE_KEY, OrgPostgresMigrationNotConfirmedError, invalidMigrationConfirmation, migrateHomeOf, parseMigrationConfirmation, } from './org-postgres-migrate.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_FILES_R2_UNDELIVERED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
-import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
+import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesForOwn, agoraHostValuesFromPlatform, dnsBlockedReason, heldOwnKeyRefs, heldPlatformKeyRefs, orgPlatformReadinessFor, orgPlatformReadinessFrom, ownerChatFrom, ownerFilesFrom, ownerJobsPublicUrl, ownerSignInFrom, platformOwnerUserIdFrom, serviceGitRefsOf, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_BACKUP_S3_STORAGE_SCOPE_KEY, } from './platform-providers.js';
-import { CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
+import { privatePageGateKey } from './private-pages.js';
+import { CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY, CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY, CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY, } from './proxy-labels.js';
 import { runSubjectRelease } from './release-host.js';
-import { remoteDatabaseFactsFrom } from './remote-database.js';
+import { remoteDatabaseFactsFrom, remoteDatabaseKeys } from './remote-database.js';
 import { liveWorkerApps, workerAppTraceScopeKeys } from './worker-app.js';
 import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
@@ -129,7 +136,10 @@ const HOSTNAME_STEPS = new Set([
     'coolify:bluegreen',
     'coolify:bluegreen-lb',
     'coolify:bluegreen-connector',
+    'coolify:workspace',
+    'coolify:promote',
     'coolify:broker-entry',
+    'coolify:workspace-broker-entry',
     'coolify:database',
     'cloudflare:tunnel',
     'cloudflare:access',
@@ -173,6 +183,7 @@ export class FoundryPlanApply {
     edgeWorkers;
     workerApps;
     workerAppKeysUrl;
+    keysRegistrarUrl;
     workerAppDatabase;
     workerAppRegistryAccountId;
     ownerInviteMail;
@@ -189,7 +200,11 @@ export class FoundryPlanApply {
     platformDeps;
     runner;
     releaseStore;
+    githubDeployKeys;
+    auditSealing;
     constructor(options) {
+        this.githubDeployKeys = options.githubDeployKeys;
+        this.auditSealing = options.auditSealing;
         this.store = options.store;
         this.readers = options.readers;
         this.executor = options.executor;
@@ -211,6 +226,7 @@ export class FoundryPlanApply {
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.workerApps = options.workerApps ?? false;
         this.workerAppKeysUrl = options.workerAppKeysUrl;
+        this.keysRegistrarUrl = options.keysRegistrarUrl;
         this.workerAppDatabase = options.workerAppDatabase ?? false;
         this.workerAppRegistryAccountId = options.workerAppRegistryAccountId;
         this.ownerInviteMail = options.ownerInviteMail ?? false;
@@ -796,6 +812,7 @@ export class FoundryPlanApply {
                             // The tunnel is gone, so what was written into it is too.
                             delete serviceIds[CLOUDFLARE_TUNNEL_ENTRY_ROUTES_SCOPE_KEY];
                             delete serviceIds[CLOUDFLARE_TUNNEL_OIKOS_HOSTNAMES_SCOPE_KEY];
+                            delete serviceIds[CLOUDFLARE_TUNNEL_APPS_HOSTNAMES_SCOPE_KEY];
                         }
                         if (target.system === 'cloudflare' && target.kind === 'worker') {
                             // #318: its partial-deploy traces too, or a retry after a later
@@ -1249,6 +1266,37 @@ export class FoundryPlanApply {
         }
         return results;
     }
+    /**
+     * The recurring audit sealing run (foundry#929): seals every ledger registered by an `audit:ledger` step with the
+     * platform signer and has the timestamp authority stamp the new checkpoints. Foundry has no scheduler, so the host
+     * calls this every `AUDIT_SEAL_EVERY_MINUTES` (15). One ledger failing never stops the others; each result and a
+     * log line say what happened and why when nothing did. It writes nothing to the org's records.
+     */
+    async runAuditSealTick() {
+        const orgs = await this.store.list();
+        const options = this.auditSealing;
+        if (!options) {
+            if (orgs.some((org) => org.hosting.enabled && org.hosting.entries.some((e) => e.uses?.audit === true))) {
+                console.info('audit sealing: the host gave no auditSealing options, so no ledger is sealed');
+            }
+            return [];
+        }
+        const recorded = new Map();
+        return runAuditSealTick({
+            ...options,
+            orgs,
+            now: this.now,
+            recorded: async (org) => {
+                const cached = recorded.get(org.id);
+                if (cached)
+                    return cached;
+                const ids = (await this.store.getAppliedState(org.id))?.serviceIds ?? {};
+                recorded.set(org.id, ids);
+                return ids;
+            },
+            allowed: (org) => this.authz.canApply(this.actor, org.id),
+        });
+    }
     async runOrgReleaseTick(id) {
         const empty = { orgId: id, steps: [], unmanaged: [] };
         if (!(await this.authz.canApply(this.actor, id))) {
@@ -1317,6 +1365,12 @@ export class FoundryPlanApply {
         const stageSinkDown = sinkId && recorded.stage_sink_applied && declaresBlueGreen(org) && this.executor.stageSinkDown
             ? await this.executor.stageSinkDown(sinkId).catch(() => false)
             : false;
+        const brokerWorkspacesDatabase = org.hosting.entries.some((e) => e.uses?.auth?.workspaces)
+            ? ((await this.executor.brokerHasWorkspacesDatabase?.(org, recorded)) ?? false)
+            : false;
+        const provisionWorkspacesDatabase = !brokerWorkspacesDatabase && org.hosting.entries.some((e) => e.uses?.auth?.workspaces)
+            ? ((await this.executor.canProvisionWorkspacesDatabase?.(org, recorded)) ?? false)
+            : false;
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             loginHostClientOrganizations: this.loginHostClientOrganizations,
@@ -1326,12 +1380,15 @@ export class FoundryPlanApply {
             zitadelRedirectUris: this.zitadelRedirectUris,
             zitadelMcp: this.zitadelMcp,
             zitadelOrgMetadata: this.zitadelOrgMetadata,
+            brokerWorkspacesDatabase,
+            provisionWorkspacesDatabase,
             broker: ownsServices(org) && this.hostOwnServices && this.executor.ownBrokerPort
                 ? await this.executor.ownBrokerPort(org, recorded)
                 : this.broker,
             edgeWorkers: this.edgeWorkers,
             workerApps: this.workerApps,
             workerAppKeysUrl: this.workerAppKeysUrl,
+            keysRegistrarUrl: this.keysRegistrarUrl,
             workerAppDatabase: this.workerAppDatabase,
             workerAppRegistryAccountId: this.workerAppRegistryAccountId,
             ownerInviteMail: this.ownerInviteMail,
@@ -1462,6 +1519,10 @@ export class FoundryPlanApply {
         const base = {
             ...(await this.sharedPlatformReadiness()),
             heldEnv: await this.heldEnvReadiness(org),
+            ...(org.hosting.github ? { githubAppKeys: await this.githubAppKeysReadiness() } : {}),
+            ...(repoKeysInPlay(org, orgRecordedIds)
+                ? { repoKeys: await this.repoKeysReadiness(org, orgRecordedIds) }
+                : {}),
         };
         const platform = await this.platformDeps?.store.get();
         // The auth release gates the shared-host organisation check and the cookie domain of every company.
@@ -1474,6 +1535,37 @@ export class FoundryPlanApply {
         const readiness = orgPlatformReadinessFor(org, base, orgRecordedIds, held ? await heldOwnKeyRefs(held, org) : new Set());
         return withRefs(readiness);
     }
+    /** F12: asks GitHub about the repo of each entry with a deploy key to make, check or remove. Never throws; a failure is a plain line. */
+    async repoKeysReadiness(org, recorded) {
+        const port = this.githubDeployKeys;
+        if (!port)
+            return { store: false, probes: {} };
+        const probes = {};
+        for (const { entryKey, target } of repoKeyProbeTargets(org, recorded)) {
+            probes[entryKey] = await probeRepoKeys(port, target);
+        }
+        return { store: true, probes };
+    }
+    /** Which refs of the platform GitHub App hold no value now. A resolver that throws counts as not held; only refs are kept. */
+    async githubAppKeysReadiness() {
+        const heldKeys = this.platformDeps?.heldKeys;
+        if (!heldKeys)
+            return { store: false, missing: [] };
+        const missing = [];
+        for (const ref of Object.values(PLATFORM_GITHUB_APP_REFS)) {
+            let held;
+            try {
+                held = await heldKeys.resolve(ref);
+            }
+            catch {
+                // Not held: the plan reports the ref, and the error is dropped.
+                held = null;
+            }
+            if (!held)
+                missing.push(ref);
+        }
+        return { store: true, missing };
+    }
     /**
      * The org's `heldSecret` envs: the refs that hold a value now, which of those differ from the live
      * production env, which could not be read, and which fit no ref. A resolver that throws counts as
@@ -1614,8 +1706,10 @@ export class FoundryPlanApply {
         const ownerRecorded = ownerOrg
             ? (await this.store.getAppliedState(ownerOrg.id))?.serviceIds
             : {};
+        const jobsPublicUrl = ownerJobsPublicUrl(ownerRecorded);
         return {
             ...readiness,
+            ...(jobsPublicUrl ? { jobsPublicUrl } : {}),
             platformOwnerUserId: platformOwnerUserIdFrom(ownerOrg, ownerRecorded ?? {}),
             mailKeyHeld,
             canHoldSecrets: typeof heldKeys?.put === 'function',
@@ -1888,6 +1982,9 @@ export function stepEntryKey(step, orgId, entries = []) {
     }
     const entryOwned = (system === 'coolify' && kind === 'app') ||
         (system === 'cloudflare' && (kind === 'worker' || kind === 'worker-app' || kind === 'gate')) ||
+        (system === 'jobs' && kind === 'project') ||
+        (system === 'github' && kind === 'deploy-key') ||
+        (system === 'audit' && kind === 'ledger') ||
         (kind === 'key' && (system === 'ai' || system === 'edge' || system === 'files'));
     if (!entryOwned)
         return null;
@@ -1914,7 +2011,8 @@ function isOrgDatabasePark(step, orgId) {
 }
 /**
  * The delete of one of the org's gates that no entry declares any more. The step names only the
- * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`) and only those pass.
+ * gate, so the caller names the removed entry's gates (`entryConfirmation.gates`), or the former paths of a
+ * remaining entry's private pages (`entryConfirmation.privatePages`), and only those pass.
  */
 function isUndeclaredGateDelete(step, orgId) {
     const { system, kind, key, desired } = step.action;
@@ -1923,6 +2021,10 @@ function isUndeclaredGateDelete(step, orgId) {
         key.startsWith(`${orgId}:`) &&
         desired?.mode === 'delete');
 }
+/** Whether `gateKey` is the gate of a page the confirmed entry had (live or workspace) and has no more. */
+function isFormerPrivatePageGate(gateKey, confirmation) {
+    return (confirmation.privatePages ?? []).some((path) => ['live', 'workspace'].some((scope) => privatePageGateKey(scope, confirmation.entryKey, path) === gateKey));
+}
 /** Whether `confirmation` passes every destroying or migrating step of `steps`: all belong to its entry, and it typed the key. */
 export function entryConfirms(confirmation, steps, orgId, entries) {
     if (!confirmation ||
@@ -1936,8 +2038,9 @@ export function entryConfirms(confirmation, steps, orgId, entries) {
         (isOrgDatabasePark(planned, orgId) && !entries.some(entryHasDatabase)) ||
         (isUndeclaredGateDelete(planned, orgId) &&
             !planned.step.migrates &&
-            (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)) &&
-            !entries.some((e) => e.key === confirmation.entryKey)));
+            (entries.some((e) => e.key === confirmation.entryKey)
+                ? isFormerPrivatePageGate(planned.action.key.slice(orgId.length + 1), confirmation)
+                : (confirmation.gates ?? []).includes(planned.action.key.slice(orgId.length + 1)))));
 }
 /** `AppliedState.serviceIds`' two flat ZITADEL scope keys (`executor.ts`'s `ensureZitadelProject`/`zitadelIssuer`) -- no `:`, unlike a resource key. */
 const ZITADEL_PROJECT_SCOPE_KEY = 'zitadel_project';
@@ -1987,9 +2090,13 @@ function destroyTargets(serviceIds, orgId) {
         'cloudflare:worker-app:',
         'coolify:database:',
         'coolify:app:',
+        // The company's GitHub source, after its apps; the shared private key it uses is left alone.
+        'coolify:github-source:',
         // An own files host's storage key: the token id is the step's recorded resource id.
         'coolify:own-files-r2:',
         'zitadel:customers:',
+        // The workspaces' test customers organisation.
+        'zitadel:customers-test:',
         // F6a: an entry's ai key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'ai:key:',
         // F6b: an entry's files key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
@@ -2083,6 +2190,21 @@ function destroyTargets(serviceIds, orgId) {
             continue;
         targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
+    // F7: the signed-records registrar key, live or minted and never delivered, is revoked with the org.
+    for (const [what, scopeKey] of [
+        ['live', KEYS_REGISTRAR_SCOPE_KEY],
+        ['undelivered', KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY],
+    ]) {
+        const id = serviceIds[scopeKey];
+        if (id)
+            targets.push({ system: 'coolify', kind: 'keys-registrar', key: what, id });
+    }
+    // A mint whose answer was lost may have left a key no id points at: the company's registrar keys all go.
+    if (serviceIds[KEYS_REGISTRAR_SCOPE_KEY] ||
+        serviceIds[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY] ||
+        serviceIds[KEYS_REGISTRAR_MINT_STARTED_SCOPE_KEY]) {
+        targets.push({ system: 'coolify', kind: 'keys-registrar', key: 'all', id: orgId });
+    }
     // A storage key minted but never delivered has no main id; its token is deleted too.
     const r2Undelivered = serviceIds[OWN_FILES_R2_UNDELIVERED_SCOPE_KEY];
     if (r2Undelivered) {
@@ -2198,12 +2320,15 @@ const STEP_FIELDS = {
     'zitadel:issuer': 'issuer.usesDomain',
     'zitadel:owner': 'owners',
     'zitadel:customers': 'hosting.entries.uses.auth',
+    'zitadel:customers-test': 'hosting.entries.workspace',
     'zitadel:id-token-userinfo': 'hosting.entries.uses.auth',
     'zitadel:desktop-callback': 'hosting.entries.uses.auth',
     'zitadel:mcp-project': 'hosting.entries.uses.auth.mcp',
     'zitadel:mcp-access': 'hosting.entries.uses.auth.mcp',
     'zitadel:access-token-lifetime': 'hosting.entries.uses.auth.mcp',
     'coolify:broker-entry': 'hosting.entries.uses.auth',
+    'coolify:workspace-broker-entry': 'hosting.entries.workspace',
+    'coolify:workspaces-database': 'hosting.entries.uses.auth.workspaces',
     'coolify:mail': 'mail',
     'coolify:chat': 'chat.usesDomain',
     'coolify:own-auth': 'services.own',
@@ -2212,6 +2337,7 @@ const STEP_FIELDS = {
     'coolify:own-files': 'services.own',
     'coolify:own-files-r2': 'services.own',
     'coolify:own-jobs': 'services.own',
+    'coolify:own-jobs-route': 'services.own',
     'coolify:own-mail': 'services.own',
     'coolify:own-sfu': 'services.own',
     'coolify:calls': 'calls.enabled',
@@ -2221,9 +2347,12 @@ const STEP_FIELDS = {
     'ai:key': 'ai',
     'cms:site': 'site',
     'coolify:app': 'hosting.enabled',
+    'coolify:github-source': 'hosting.github',
     'coolify:bluegreen': 'hosting.entries.blueGreen',
     'coolify:bluegreen-lb': 'hosting.entries.blueGreen',
     'coolify:bluegreen-connector': 'hosting.entries.blueGreen',
+    'coolify:workspace': 'hosting.entries.workspace',
+    'coolify:promote': 'hosting.entries.liveCommit',
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
@@ -2232,6 +2361,10 @@ const STEP_FIELDS = {
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
     'cloudflare:worker-app': 'hosting.entries.workerApp',
+    // F4 (#925): both hang off the company's Apps switch.
+    'coolify:org-apps-admin': 'boule.apps',
+    'cloudflare:apps-db-route': 'boule.apps',
+    'cloudflare:apps-zones': 'boule.apps',
 };
 function stepField(action) {
     if (action.system === 'coolify' &&
@@ -2249,6 +2382,15 @@ function stepField(action) {
     // An entry's edge key (F7): always `<orgId>:<entry>`, edge has no org-root key.
     if (action.system === 'edge' && action.kind === 'key')
         return 'hosting.entries.uses.edge';
+    // An entry's jobs project: always `<orgId>:<entry>`.
+    if (action.system === 'jobs' && action.kind === 'project')
+        return 'hosting.entries.uses.jobs';
+    // An entry's audit ledger registration: always `<orgId>:<entry>`.
+    if (action.system === 'audit' && action.kind === 'ledger')
+        return 'hosting.entries.uses.audit';
+    // An entry's deploy key for its own repo (F12): always `<orgId>:<entry>`.
+    if (action.system === 'github' && action.kind === 'deploy-key')
+        return 'hosting.entries.uses.repo';
     // An org declares several issuer apps, each keyed by its name (#71).
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
@@ -2257,6 +2399,10 @@ function stepField(action) {
     if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.ownedBypass) {
         return 'hosting.entries.gates';
     }
+    // F11: a bypass for a machine path of a gated entry.
+    if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.machineBypass) {
+        return 'hosting.entries.uses';
+    }
     return STEP_FIELDS[`${action.system}:${action.kind}`] ?? `${action.system}.${action.kind}`;
 }
 /**
@@ -2312,10 +2458,18 @@ function failedFields(org, detail, completed, serviceIds) {
             failed.add('hosting.entries.uses.edge');
         }
     }
-    // F3: Boule's own key, wanted whenever the org has a domain.
-    if (org.domain && serviceIds[entryEdgeUndeliveredScopeKey(BOULE_EDGE_ENTRY_KEY)]) {
+    // F3: Boule's own key, wanted whenever the org has a domain or its Boule runs apps.
+    if (bouleEdgeKeyWanted(org) && serviceIds[entryEdgeUndeliveredScopeKey(BOULE_EDGE_ENTRY_KEY)]) {
         failed.add('hosting.entries.uses.edge');
     }
+    // F7: a registrar key minted and never delivered stays unresolved until a later apply revokes it.
+    if (serviceIds[KEYS_REGISTRAR_UNDELIVERED_SCOPE_KEY])
+        failed.add('boule.apps');
+    // F4 (#925): the same for an apps admin role or a route service token minted and never delivered.
+    if (serviceIds[ORG_APPS_ADMIN_UNDELIVERED_SCOPE_KEY] ||
+        serviceIds[remoteDatabaseKeys(APPS_DB_ENTRY_KEY).undelivered]) {
+        failed.add('boule.apps');
+    }
     // The same for a jobs registration whose credentials never reached the host.
     if (serviceIds[JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY] &&
         !serviceIds[`jobs:registration:${org.id}`]) {

package/dist/plan/platform-diff.d.ts

@@ -1416,8 +1416,8 @@ export declare const JOBS_SCHEDULER_KEY = "jobs";
 /**
  * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
  * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
- * Not a secret. The scheduler's public hostname has no tunnel and no DNS
- * record, so nothing on the platform can reach it there.
+ * Not a secret. Only containers on that network reach it; an entry's app uses
+ * the owner company's public origin `JOBS_PUBLIC_URL_SCOPE_KEY` (`own-jobs-route.ts`) instead.
  */
 export declare const JOBS_INTERNAL_URL_SCOPE_KEY = "jobs_internal_url";
 /**

package/dist/plan/platform-diff.js

@@ -899,6 +899,11 @@ export function resolveAppEnv(org, entry, recorded, available = { sharedSecret:
         else if (typeof declared !== 'string')
             unresolved.push([name, declared.from]);
     }
+    // F13: the entry's customer-grants credential is held and written by the app step. The marker names it,
+    // never its value, so adding or removing the flag replans the step.
+    if (entry.uses?.customerGrants && available.sharedSecret) {
+        marker.CUSTOMER_GRANTS_CREDENTIAL = 'secret:customerGrants';
+    }
     return { values, unresolved, secrets, unresolvedSecrets, heldSecrets, unresolvedHeld, marker };
 }
 /**
@@ -1720,8 +1725,8 @@ export const JOBS_SCHEDULER_KEY = 'jobs';
 /**
  * The scheduler's address on the Coolify network (`http://<custom_internal_name>:8080`),
  * the value the org steps' jobs port and Archon's `JOBS_URL` are read from.
- * Not a secret. The scheduler's public hostname has no tunnel and no DNS
- * record, so nothing on the platform can reach it there.
+ * Not a secret. Only containers on that network reach it; an entry's app uses
+ * the owner company's public origin `JOBS_PUBLIC_URL_SCOPE_KEY` (`own-jobs-route.ts`) instead.
  */
 export const JOBS_INTERNAL_URL_SCOPE_KEY = 'jobs_internal_url';
 /**

package/dist/plan/platform-org.d.ts

@@ -1,6 +1,7 @@
 import { type DeclaredOrg, type VersionPin } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import { type AgoraHostValues } from './agora.js';
+import type { RepoKeyProbe } from './entry-repo-key.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -80,6 +81,12 @@ export interface OrgPlatformReadiness {
      * gets as `AI_URL`. `null` or absent until the platform has applied the AI host.
      */
     aiUrl?: string | null;
+    /**
+     * The public origin of the jobs scheduler an entry with `uses.jobs` registers on, which it gets as
+     * `JOBS_SCHEDULER_URL`. A company on shared services reads the owner company's (`ownerJobsPublicUrl`); a
+     * company that runs its own services reads its own. `null` or absent until that route is recorded.
+     */
+    jobsPublicUrl?: string | null;
     /**
      * The shared calls SFU (#170) an org's own calls Matrix stack depends on.
      * Declared is enough here: `platform-diff.ts`'s `planSfu` plans the step
@@ -187,6 +194,24 @@ export interface OrgPlatformReadiness {
         unreadable?: readonly string[];
         invalid?: readonly string[];
     };
+    /**
+     * The platform GitHub App's held keys (`PLATFORM_GITHUB_APP_REFS`), read only for a company that declares
+     * `hosting.github`. `store` is false when the host wired no held-keys reader; `missing` are the refs that hold
+     * no value now. Refs only, never a value. Absent reads as no store.
+     */
+    githubAppKeys?: {
+        store: boolean;
+        missing: readonly string[];
+    };
+    /**
+     * F12: what GitHub said about the repo of each entry that declares `uses.repo` (or has a key to remove), by
+     * entry key. `store` is false when the host wired no GitHub deploy-key client. Lines only, never a credential.
+     * Absent for an org with neither.
+     */
+    repoKeys?: {
+        store: boolean;
+        probes: Readonly<Record<string, RepoKeyProbe>>;
+    };
     /**
      * True when the host wired no held-keys reader, so no key could be checked.
      * A missing key is then reported as "no reader given" instead of "not held".
@@ -277,6 +302,11 @@ export declare const OWN_FILES_RUNNER_SCOPE_KEY = "coolify_platform_files_runner
  * `base`. Any other org gets `base` back unchanged.
  */
 export declare function orgPlatformReadinessFor(org: DeclaredOrg, base: OrgPlatformReadiness, orgRecordedIds: Readonly<Record<string, string>>, heldRefs: ReadonlySet<string>): OrgPlatformReadiness;
+/**
+ * The public origin of the owner company's jobs scheduler, which a company on shared services registers its
+ * entries on: what the owner's `coolify:own-jobs-route` step recorded, or `undefined` before it ran.
+ */
+export declare function ownerJobsPublicUrl(ownerRecordedIds: Readonly<Record<string, string>> | undefined): string | undefined;
 /** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
 export declare function heldOwnKeyRefs(heldKeys: HeldKeyResolver, org: Pick<DeclaredOrg, 'slug'>): Promise<Set<string>>;
 /** {@link agoraHostValuesFromPlatform}'s counterpart for an own org: every value is the org's own, null until recorded. */

package/dist/plan/platform-org.js

@@ -6,6 +6,7 @@ import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_
 import { OWN_AUTH_APPLIED_HOSTNAME_SCOPE_KEY, ownAuthApplied } from './login-host.js';
 import { oikosIngressApplied } from './oikos-ingress.js';
 import { ownHostnames } from './own-hostnames.js';
+import { JOBS_PUBLIC_URL_SCOPE_KEY } from './own-jobs-route.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
@@ -223,7 +224,8 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         ai: base.missingKeys.ai,
         jobs: missing(jobsApplied, refs.jobsAdminToken),
     };
-    const { jobsUrlMissing: _shared, ...rest } = base;
+    const { jobsUrlMissing: _shared, jobsPublicUrl: _sharedRoute, ...rest } = base;
+    const ownJobsUrl = orgRecordedIds[JOBS_PUBLIC_URL_SCOPE_KEY];
     return {
         ...rest,
         authReady,
@@ -232,6 +234,7 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         filesUrl: filesApplied ? (filesUrl ?? null) : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),
+        ...(jobsApplied && ownJobsUrl ? { jobsPublicUrl: ownJobsUrl } : {}),
         callsReady: ownStepRecorded(orgRecordedIds, org, 'own-sfu'),
         // The MX name is the shared relay's, `mx.<platform apex>`: no platform mail step is needed.
         // The apex is the company's mail zone: its domain when mail runs on it, else oikos.host.
@@ -244,6 +247,14 @@ export function orgPlatformReadinessFor(org, base, orgRecordedIds, heldRefs) {
         missingKeys,
     };
 }
+/**
+ * The public origin of the owner company's jobs scheduler, which a company on shared services registers its
+ * entries on: what the owner's `coolify:own-jobs-route` step recorded, or `undefined` before it ran.
+ */
+export function ownerJobsPublicUrl(ownerRecordedIds) {
+    const url = ownerRecordedIds?.[JOBS_PUBLIC_URL_SCOPE_KEY];
+    return url?.startsWith('https://') ? url : undefined;
+}
 /** The own org's held-key refs `heldKeys` resolves right now. A resolver that throws counts as not held, and its error goes nowhere. */
 export async function heldOwnKeyRefs(heldKeys, org) {
     const held = new Set();

package/dist/plan/platform-providers.d.ts

@@ -496,6 +496,8 @@ export interface JobsHostInput {
 export declare function provisionJobsHost(scope: StepScope, deps: JobsHostDeps, target: ServiceTarget, input: JobsHostInput): Promise<{
     resourceId?: string;
 }>;
+/** The Coolify project of the platform's sign-in stack, the broker included. */
+export declare const PLATFORM_AUTH_PROJECT = "platform";
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address

package/dist/plan/platform-providers.js

@@ -5,7 +5,7 @@ import { VERSIONS, coolifyImageFor, floatingTagBlocked, pinnedRef } from '../boo
 import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ownerMailboxes, ownsServices, sharedSecretRef, } from '../org.js';
 import { applyArchonBlueGreen } from './archon-blue-green.js';
-import { ARCHON_REPO, archonSubject, healthTokenName, tunnelOriginFor, } from './blue-green.js';
+import { ARCHON_REPO, archonSubject, healthTokenName, pinKeyName, tunnelOriginFor, } from './blue-green.js';
 import { BOULE_BRIDGE_SECRET_ENV, BOULE_PEER_PASSWORD_ENV, BOULE_PEER_ROLE, bouleHostnameFor, } from './boule.js';
 import { recordBuiltCommit } from './build-record.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
@@ -215,6 +215,8 @@ export class FoundryPlatformStepExecutor {
             coolify: archon.coolify,
             healthToken: async () => (await archon.heldKeys?.resolve(sharedSecretRef(platform.ownerOrgId, healthTokenName(subject.id)))) ?? null,
             secret: (value) => archon.runtime?.onSecret?.(value),
+            pinRef: sharedSecretRef(platform.ownerOrgId, pinKeyName(subject.id)),
+            ...(archon.heldKeys ? { heldKeys: archon.heldKeys } : {}),
             primaryUuid,
             primaryBlueAppId,
             runtime: this.runtime,
@@ -1272,7 +1274,8 @@ export async function provisionJobsHost(scope, deps, target, input) {
 // ---------------------------------------------------------------------------
 // #168: the platform's own sign-in (ZITADEL)
 // ---------------------------------------------------------------------------
-const PLATFORM_AUTH_PROJECT = 'platform';
+/** The Coolify project of the platform's sign-in stack, the broker included. */
+export const PLATFORM_AUTH_PROJECT = 'platform';
 /**
  * Fixed `custom_internal_name`s (`diff.ts`'s `coolifyCalls` sets the same
  * kind of name on Synapse/MAS) so the Cloudflare tunnel below can address
@@ -3902,6 +3905,9 @@ async function waitForMailInstance(url, runtime, sleep) {
     for (;;) {
         try {
             const response = await fetchImpl(url);
+            // #760: an unread body left undici's parser paused when the socket
+            // ended, throwing an uncaught assertion in the host.
+            await response.body?.cancel();
             if (response.ok)
                 return;
         }
@@ -4027,6 +4033,8 @@ export const PLATFORM_ARCHON_PUBLIC_PATHS = [
     { name: 'org-apps', path: '/api/orgs/*/apps' },
     { name: 'org-requests', path: '/api/orgs/*/requests' },
     { name: 'github-releases', path: '/api/github/releases' },
+    { name: 'github-install-callback', path: '/api/github/install/callback' },
+    { name: 'org-github', path: '/api/orgs/*/github' },
 ];
 const PLATFORM_ARCHON_PUBLIC_POLICY_NAME = 'foundry: public path';
 const archonPublicAppName = (name) => `${PLATFORM_ARCHON_ACCESS_APP_NAME}:public:${name}`;
@@ -7030,6 +7038,9 @@ async function waitForInstance(url, runtime, sleep, label = 'platform:auth') {
             const response = await fetchImpl(url, {
                 signal: AbortSignal.timeout(runtime.readyRequestTimeoutMs ?? 10_000),
             });
+            // #760: an unread body left undici's parser paused when the socket
+            // ended, throwing an uncaught assertion in the host.
+            await response.body?.cancel();
             if (response.ok)
                 return;
         }

package/dist/plan/post-logout-uris.d.ts

@@ -16,7 +16,7 @@ export declare function zitadelAppPostLogoutAppliedScopeKey(appKey: string): str
 /**
  * The post-logout addresses company app `appKey` is created with and kept at.
  * Agora signs out locally and has no signed-out page, so it holds only its
- * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * root; every `@wtfalch/auth` app (cms, boule, kosmos, the app, entries with
  * `uses.auth`) holds both on each of its hosts.
  */
 export declare function companyAppPostLogoutUris(org: DeclaredOrg, appKey: string): string[];

package/dist/plan/post-logout-uris.js

@@ -1,6 +1,8 @@
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { appHostname, cmsStudioHostnameFor, entryHostnames } from './hostnames.js';
+import { kosmosHostnameFor } from './kosmos.js';
+import { workspaceAuthEntryOf, workspaceClientHosts } from './workspace-client.js';
 /** The page `@wtfalch/auth` apps land on after ZITADEL ends the session. */
 export const SIGNED_OUT_PATH = '/auth/signed-out';
 /** Both landing addresses of a host: its root and its signed-out page. */
@@ -26,18 +28,25 @@ export function zitadelAppPostLogoutAppliedScopeKey(appKey) {
 /**
  * The post-logout addresses company app `appKey` is created with and kept at.
  * Agora signs out locally and has no signed-out page, so it holds only its
- * root; every `@wtfalch/auth` app (cms, boule, the app, entries with
+ * root; every `@wtfalch/auth` app (cms, boule, kosmos, the app, entries with
  * `uses.auth`) holds both on each of its hosts.
  */
 export function companyAppPostLogoutUris(org, appKey) {
     const authEntry = org.hosting.entries.find((e) => e.key === appKey && e.uses?.auth);
-    const hosts = authEntry ? entryHostnames(org, authEntry) : null;
+    const workspaceEntry = authEntry ? undefined : workspaceAuthEntryOf(org, appKey);
+    const hosts = authEntry
+        ? entryHostnames(org, authEntry)
+        : workspaceEntry
+            ? workspaceClientHosts(org, workspaceEntry)
+            : null;
     if (appKey === 'agora')
         return [`https://${agoraHostnameFor(org)}/`];
     const hostname = appKey === 'cms' && org.site.enabled
         ? cmsStudioHostnameFor(org)
         : appKey === 'boule'
             ? bouleHostnameFor(org)
-            : appHostname(org);
+            : appKey === 'kosmos'
+                ? kosmosHostnameFor(org)
+                : appHostname(org);
     return postLogoutUrisFor(hosts ?? [hostname]);
 }