[jacobprall]

Docs and small code fixes from the open template feedback.

README (#41, #44)

• One-sentence intro, a note that the service is an HTTP API with no UI (/ returns 404, /healthz returns ok).
• Get running moved up, opening with a link to the Quickstart. It says where to copy API_TOKEN and links a prefilled read-only GitHub token.
• An Example answer heading over the JSON, and "What it demonstrates on Render" renamed to Built on Render.

Quickstart (#41, #42, #43, #44)

• No-UI note on the API service, where to find API_TOKEN (service Environment page), and a /healthz check.
• Scoped API key permissions for each service's RENDER_API_KEY, taken from the scoped-keys docs.
• New Add a repository section covering the whole path, including the rollout order: a config.ts change only takes effect once the cron's build of that commit is live. It also covers what a failed clone looks like.
• render.yaml, the architecture guide, and the extension guide link or note the same.

Code

• snapshot_refresh now logs commit (RENDER_GIT_COMMIT) and repositories, so a run on an old build is visible in one line (Snapshot cron did not build after a config.ts push, and the refresh log hides which build ran #43).
• A 400/422 allow-list rejection now throws SandboxMisconfiguredError, which returns the misconfigured reply instead of retrying twice as an infrastructure error. Allow-list egress is now in the public SDK and CLI docs, so this was the last task on Confirm allow-list egress works in early access, or change the default #1.

Not covered:

• Readme Feedback #44 item 1, a header video or screenshot, needs a person to record it. With no UI, a terminal recording of pnpm ask is the natural choice.
• Snapshot cron did not build after a config.ts push, and the refresh log hides which build ran #43's root cause: Render recorded no event for the push, so it needs a repro and a support check.

Fixes #1. Fixes #41. Fixes #42. Refs #43, #44.

Made with Cursor