@bongos/core 1.18.18 → 1.19.2

package/modules/governance/db.js

@@ -116,10 +116,112 @@ async function syncRankRole(client, { builderId, rank } = {}) {
   return { target: plan.target, added: [...plan.add], removed: [...plan.remove] };
 }
 
+// --- the R110 CRUD surface (roles / grants / assignments) --------------------
+//
+// The db half of the governance API routes. Deliberately DUMB writes: the
+// authority invariants (system perms non-grantable, seeded rank-roles immutable
+// through the API) are enforced in routes/governance.js against the catalog —
+// the same split governance_001 documents (permission_key is validated app-side,
+// not a FK). Grant/assign are ON CONFLICT DO NOTHING so the tab's toggle is
+// idempotent; each returns whether a row actually changed.
+
+async function listRolesWithGrants() {
+  const { rows } = await pool.query(
+    `SELECT r.role_key, r.label, r.description, r.is_system, r.seeded_rank,
+            r.created_by, r.created_at,
+            COALESCE(array_agg(rp.permission_key ORDER BY rp.permission_key)
+                     FILTER (WHERE rp.permission_key IS NOT NULL), '{}') AS permissions
+       FROM governance_roles r
+       LEFT JOIN governance_role_permissions rp ON rp.role_key = r.role_key
+      GROUP BY r.id
+      ORDER BY r.is_system DESC, r.role_key`,
+  );
+  return rows;
+}
+
+async function getRoleByKey(roleKey) {
+  const { rows } = await pool.query(
+    `SELECT role_key, label, description, is_system, seeded_rank, created_by, created_at
+       FROM governance_roles
+      WHERE role_key = $1`,
+    [roleKey],
+  );
+  return rows[0] ?? null;
+}
+
+async function createRole({ roleKey, label, description, createdBy }) {
+  const { rows } = await pool.query(
+    `INSERT INTO governance_roles (role_key, label, description, is_system, seeded_rank, created_by)
+     VALUES ($1, $2, $3, false, NULL, $4)
+     RETURNING role_key, label, description, is_system, seeded_rank, created_by, created_at`,
+    [roleKey, label, description ?? null, createdBy],
+  );
+  return rows[0];
+}
+
+async function grantRolePermission({ roleKey, permissionKey }) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO governance_role_permissions (role_key, permission_key)
+     VALUES ($1, $2)
+     ON CONFLICT (role_key, permission_key) DO NOTHING`,
+    [roleKey, permissionKey],
+  );
+  return rowCount > 0;
+}
+
+async function revokeRolePermission({ roleKey, permissionKey }) {
+  const { rowCount } = await pool.query(
+    `DELETE FROM governance_role_permissions
+      WHERE role_key = $1 AND permission_key = $2`,
+    [roleKey, permissionKey],
+  );
+  return rowCount > 0;
+}
+
+async function listAssignments() {
+  const { rows } = await pool.query(
+    `SELECT br.builder_id, b.github_login, b.display_name, b.rank,
+            br.role_key, r.label AS role_label, r.is_system, r.seeded_rank,
+            br.assigned_by, br.assigned_at
+       FROM governance_builder_roles br
+       JOIN builders b ON b.id = br.builder_id
+       JOIN governance_roles r ON r.role_key = br.role_key
+      ORDER BY br.builder_id, br.role_key`,
+  );
+  return rows;
+}
+
+async function assignRole({ builderId, roleKey, assignedBy }) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO governance_builder_roles (builder_id, role_key, assigned_by)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (builder_id, role_key) DO NOTHING`,
+    [builderId, roleKey, assignedBy],
+  );
+  return rowCount > 0;
+}
+
+async function unassignRole({ builderId, roleKey }) {
+  const { rowCount } = await pool.query(
+    `DELETE FROM governance_builder_roles
+      WHERE builder_id = $1 AND role_key = $2`,
+    [builderId, roleKey],
+  );
+  return rowCount > 0;
+}
+
 module.exports = {
   getPermissionKeysForBuilder,
   getRoleKeysForBuilder,
   getSeededRankRoles,
   getRoleAssignmentsForBuilder,
   syncRankRole,
+  listRolesWithGrants,
+  getRoleByKey,
+  createRole,
+  grantRolePermission,
+  revokeRolePermission,
+  listAssignments,
+  assignRole,
+  unassignRole,
 };

package/modules/governance/migrations/governance_006_version_create.sql

@@ -0,0 +1,38 @@
+-- governance_006_version_create.sql — grant the new `version.create` atom to the
+-- Archon rank-role (BV1.R105; task 1001847).
+--
+-- `POST /versions` was the ONE rank-gated module write route the R105 migration could
+-- not finish: no catalog atom named version CREATION. `version.close` is a different
+-- capability (the close disposition), so the route stayed on requireRank while the
+-- other 60 moved. catalog.js now carries `version.create`, floor `archon`,
+-- system:false — see the comment beside the row for why it is NOT system:true.
+--
+-- Same shape as governance_004 (a BRAND-NEW key, not a floor move): no role holds it
+-- yet. But floor `archon` is the TOP rung, so the cumulative superset RANK_ROLE_SEED
+-- builds contains it for exactly ONE role — hence a single grant block here, where 004
+-- needed two.
+--
+-- THIS MIGRATION IS LOAD-BEARING, not bookkeeping. The seed (governance_002) is
+-- run-once, so a database that has already migrated would never learn the new key:
+-- the archon rank-role would not hold `version.create`, and the freshly-migrated route
+-- would 403 every Archon — locking the instance out of creating versions. The grant
+-- has to arrive as its own migration for the change to be behaviour-identical in
+-- practice and not just on a fresh install.
+--
+-- Additive only: one new permission key granted to one role; nothing is revoked.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- One block PER ROLE, in the governance_003/004 shape: the drift guard
+-- (tests/governance_seed.mjs) scans for `SELECT '<role>', unnest(ARRAY[…])` literally,
+-- so a combined `unnest(ARRAY['metic','archon']), 'key'` form parses as zero grants
+-- and reds it.
+
+BEGIN;
+
+INSERT INTO governance_role_permissions (role_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'version.create'
+])
+ON CONFLICT (role_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/governance/migrations/governance_007_delegate_archon_ops_to_metic.sql

@@ -0,0 +1,72 @@
+-- governance_007_delegate_archon_ops_to_metic.sql — grant the Metic rank-role the
+-- twenty permissions ADR 0157 lowered archon→metic, plus the new `gate_approval.read`
+-- (task 1002584).
+--
+-- Owner decision (2026-08-05): the Archon rank is responsible for RANK and IDENTITY
+-- only. `catalog.js` moved twenty operational floors archon→metic to match, and split
+-- `gate_approval.read` out of `gate_approval.decide` so the Gate page can open to Metic
+-- while approving a held PR stays Archon.
+--
+-- The compat seed (governance_002) is RUN-ONCE, so a floor change cannot be made by
+-- editing it — every already-migrated database would keep the old grant. This is the
+-- follow-on grant migration the 002 header calls for, and it follows
+-- governance_003_task_abandon_metic.sql (the ADR 0152 worked example) exactly.
+--
+-- Additive only: `archon` already holds all twenty (the seeded roles are cumulative
+-- supersets), so lowering each floor adds exactly one grant — metic — and revokes
+-- nothing. `gate_approval.read` is genuinely new, so it is granted to BOTH metic and
+-- archon to keep archon ⊇ metic. Idempotent (ON CONFLICT DO NOTHING); forward-safe
+-- (INSERT only, no dropped or retyped state).
+--
+-- The drift guard (tests/governance_seed.mjs) reads the UNION of the seed and every
+-- later governance_* grant migration, so this file is what keeps the SQL snapshot equal
+-- to catalog.js's floor-derived RANK_ROLE_SEED.
+--
+-- NOT here, deliberately: `version.close` and the four escalation keys
+-- (`task.confirm.grade_bypass`, `gate_approval.decide`, `goal.scope.manage`,
+-- `governance.manage`) stay Archon — see ADR 0157 for why moving any one of them would
+-- make this delegation self-reversible. `dependency.cross_tier.manage` also stays: it is
+-- system:true, and granting a system key to metic violates the catalog's own invariant.
+
+BEGIN;
+
+INSERT INTO governance_role_permissions (role_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  -- admin ops (spend, adjudicate, operate) — none decides who holds authority
+  'builder.budget.set',
+  'builder.roster.read',
+  'security.report.adjudicate',
+  'provisioning.fleet.manage',
+  'box.fleet.manage',
+  'autonomy.precheck',
+  'discord.channels.manage',
+  'project.curate',
+  -- work disposition
+  'criterion.unsatisfy',
+  'version.create',
+  'override_request.decide',
+  'claim.release.any',
+  'idea.ratify',
+  'task.newcomer_restock',
+  'task.peer_votes.tally',
+  'goal.reorder',
+  -- reads
+  'session.search',
+  'memory.read.any',
+  'audit_log.read',
+  -- surfaces
+  'page.view.governance',
+  'gate_approval.read'
+])
+ON CONFLICT (role_key, permission_key) DO NOTHING;
+
+-- `gate_approval.read` is a NEW catalog key, so archon does not already hold it from
+-- governance_002. Granted here to preserve the cumulative-superset invariant
+-- (tests/governance_catalog.mjs: archon ⊇ metic ⊇ thetes ⊇ xenos).
+INSERT INTO governance_role_permissions (role_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'gate_approval.read'
+])
+ON CONFLICT (role_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/governance/routes/governance.js

@@ -14,8 +14,8 @@
 // rebuilds the GDS router, so registering here keeps the port present for the
 // route-building tests too. Registration is hasProvider-guarded so
 // re-instantiation never trips the seam's single-provider duplicate guard.
-// (Mirrors modules/economy/routes/reward.js.) The governance CRUD endpoints land
-// on this same router in R110.
+// (Mirrors modules/economy/routes/reward.js.) The R110 governance CRUD
+// endpoints live on this same router, below.
 
 const express = require('express');
 const api = require('../../../src/module-api');
@@ -52,6 +52,11 @@ const sessionScopes = require('../session-scopes');
 // session's real authority rather than the builder's.
 const governancePort = {
   resolveBuilderPermissions: resolver.resolveBuilderPermissions,
+  // The pure catalog-drop half, for the session-load fold (task 1002556): the
+  // kernel feeds it the raw grant keys its own session query carried, so a
+  // permission gate needs no second round-trip. Same answer as
+  // resolveBuilderPermissions given the same rows — DB-free by construction.
+  effectivePermissions: resolver.effectivePermissions,
   builderHasPermissions: resolver.builderHasPermissions,
   getRoleKeysForBuilder: db.getRoleKeysForBuilder,
   isSystem: catalog.isSystem,
@@ -76,14 +81,238 @@ function registerSeams() {
   if (!api.hasProvider('governance')) {
     api.registerProvider('governance', governancePort);
   }
+  // The session-load fold (task 1002556): the kernel's lookupSession embeds this
+  // fragment so the SAME round-trip carries the builder's raw grant keys, and
+  // requirePermission runs the pure effectivePermissions instead of a second
+  // query. Registered HERE — capability-named, module-agnostic on the kernel
+  // side (ADR 0083 §Decision #4) — because this module owns the governance SQL.
+  // Contract: a boot-time CONSTANT (never user input) yielding one
+  // `raw_permission_keys` column against the kernel query's alias `s`
+  // (builder_sessions). Raw keys only — the catalog-drop stays in the resolver.
+  if (!api.hasProvider('session-grants-sql')) {
+    api.registerProvider('session-grants-sql', {
+      selectFragment: `,
+            (SELECT COALESCE(array_agg(DISTINCT rp.permission_key), '{}')
+               FROM governance_builder_roles br
+               JOIN governance_role_permissions rp ON rp.role_key = br.role_key
+              WHERE br.builder_id = s.builder_id) AS raw_permission_keys`,
+    });
+  }
 }
 
+// ── the R110 CRUD surface (ADR 0151 §2 — the governance tab's server half) ────
+//
+// Every route — the three reads included — gates on the `governance.manage`
+// atom (system, floor archon): this surface EDITS the role/permission graph
+// itself, the meta-escalation the catalog flags non-grantable, and even listing
+// it exposes the full authority map. Two invariants are enforced HERE, against
+// the catalog, not in the db layer (governance_001's app-side-validation split):
+//   • a `system:true` permission is NON-GRANTABLE to a custom role (R94's wall —
+//     "The governance API (R110) rejects granting it");
+//   • the four seeded rank-roles are IMMUTABLE through this API: their grants
+//     derive from catalog floors (a change is a migration — R94) and their
+//     assignment derives from builders.rank via the R95b sync. A second writer
+//     for either would fork authority truth.
+const { validateOrRespond, LIMITS, parseId } = api;
+const ROLE_KEY_RE = /^[a-z][a-z0-9-]*$/;
+const ROLE_KEY_MAX = 64;
+
 module.exports = function buildGovernanceRouter() {
   registerSeams();
-  // No HTTP surface yet — the resolver is a pure kernel port. The empty router is
-  // only the loader's contributes.routes mount vehicle; R110 adds the roles /
-  // permissions / assignments CRUD here behind `governance.manage`.
-  return express.Router();
+  const router = express.Router();
+
+  // Param guard for :roleKey. Responds bad_role_key and returns null on a
+  // malformed slug (seeded keys like 'metic' pass shape and are refused later,
+  // by policy, with the honest code).
+  function roleKeyParam(req, res) {
+    const roleKey = req.params.roleKey;
+    if (roleKey.length > ROLE_KEY_MAX || !ROLE_KEY_RE.test(roleKey)) {
+      res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+      return null;
+    }
+    return roleKey;
+  }
+
+  // Load a role that this API may MUTATE: 404 on a missing role, refuse a seeded
+  // rank-role with the caller's `immutableCode`. Returns null after responding.
+  async function loadMutableRole(res, roleKey, immutableCode, reason) {
+    const role = await db.getRoleByKey(roleKey);
+    if (!role) {
+      res.fail('role_not_found', 404, { role_key: roleKey });
+      return null;
+    }
+    if (role.is_system) {
+      res.fail(immutableCode, 403, { role_key: roleKey, reason });
+      return null;
+    }
+    return role;
+  }
+  const GRANTS_REASON = 'a seeded rank-role\'s grants derive from catalog floors; changing one is a migration (R94), never an API write';
+  const ASSIGN_REASON = 'a seeded rank-role is assigned by rank (R95b sync); change the builder\'s rank instead';
+
+  // rank: perm governance.manage — the full role list with each role's grants.
+  router.get('/governance/roles', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    try {
+      const roles = await db.listRolesWithGrants();
+      res.json({ roles });
+    } catch (err) {
+      console.error('[gds] GET /governance/roles', err);
+      res.fail('roles_list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — the permission catalog + principals, straight
+  // from code (the catalog is CODE, not a table); no DB read. `grantable` is the
+  // flag the tab renders LOCKED from; principals are read-only by construction.
+  router.get('/governance/permissions', api.requireBuilder, api.requirePermission('governance.manage'), (req, res) => {
+    const permissions = catalog.PERMISSIONS.map((p) => ({
+      key: p.key,
+      system: p.system,
+      floor: p.floor,
+      guards: p.guards,
+      scope: p.scope,
+      resource: p.resource,
+      grantable: catalog.isGrantable(p.key),
+    }));
+    res.json({ permissions, principals: catalog.principals() });
+  });
+
+  // rank: perm governance.manage — every builder↔role assignment row.
+  router.get('/governance/assignments', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    try {
+      const assignments = await db.listAssignments();
+      res.json({ assignments });
+    } catch (err) {
+      console.error('[gds] GET /governance/assignments', err);
+      res.fail('assignments_list_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — create a CUSTOM role (is_system false, no
+  // seeded_rank — the seeded four exist only via governance_002). Grants are
+  // added one at a time via the toggle below, so creation carries none.
+  router.post('/governance/roles', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      role_key: { required: true, type: 'string', minLength: 2, maxLength: ROLE_KEY_MAX },
+      label: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
+      description: { type: 'string', maxLength: 2000 },
+    })) return;
+    const roleKey = req.body.role_key;
+    if (!ROLE_KEY_RE.test(roleKey)) {
+      return res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+    }
+    try {
+      const role = await db.createRole({
+        roleKey,
+        label: req.body.label,
+        description: req.body.description ?? null,
+        createdBy: req.builder.id,
+      });
+      res.status(201).json({ role: { ...role, permissions: [] } });
+    } catch (err) {
+      if (err && err.code === '23505') {
+        return res.fail('role_exists', 409, { role_key: roleKey });
+      }
+      console.error('[gds] POST /governance/roles', err);
+      res.fail('role_create_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — grant one OPERATIONAL permission to a custom
+  // role (the toggle's ON half). The order of refusals is the authority order:
+  // role exists → role is custom → the key exists → the key is grantable.
+  router.put('/governance/roles/:roleKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    const roleKey = roleKeyParam(req, res);
+    if (roleKey === null) return;
+    const permissionKey = req.params.permissionKey;
+    try {
+      const role = await loadMutableRole(res, roleKey, 'seeded_role_immutable', GRANTS_REASON);
+      if (role === null) return;
+      if (!catalog.byKey(permissionKey)) {
+        return res.fail('unknown_permission', 400, { permission_key: permissionKey });
+      }
+      if (!catalog.isGrantable(permissionKey)) {
+        return res.fail('permission_not_grantable', 400, {
+          permission_key: permissionKey,
+          reason: 'system (trust-boundary) permissions are non-grantable to a custom role (ADR 0151)',
+        });
+      }
+      const granted = await db.grantRolePermission({ roleKey, permissionKey });
+      res.json({ ok: true, role_key: roleKey, permission_key: permissionKey, granted });
+    } catch (err) {
+      console.error('[gds] PUT /governance/roles/:roleKey/permissions/:permissionKey', err);
+      res.fail('grant_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — revoke a grant (the toggle's OFF half).
+  // Deliberately NOT validated against the catalog: a grant whose key the
+  // catalog since retired is exactly the row an Archon most needs to remove
+  // (the resolver already drops it — this is hygiene, not authority).
+  router.delete('/governance/roles/:roleKey/permissions/:permissionKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    const roleKey = roleKeyParam(req, res);
+    if (roleKey === null) return;
+    const permissionKey = req.params.permissionKey;
+    try {
+      const role = await loadMutableRole(res, roleKey, 'seeded_role_immutable', GRANTS_REASON);
+      if (role === null) return;
+      const removed = await db.revokeRolePermission({ roleKey, permissionKey });
+      res.json({ ok: true, role_key: roleKey, permission_key: permissionKey, removed });
+    } catch (err) {
+      console.error('[gds] DELETE /governance/roles/:roleKey/permissions/:permissionKey', err);
+      res.fail('revoke_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — assign a CUSTOM role to a builder.
+  // assigned_by is ALWAYS the session builder, never input (the audit trail's
+  // "who did this" must be the authenticated actor).
+  router.post('/governance/assignments', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      builder_id: { required: true, type: 'integer', min: 1 },
+      role_key: { required: true, type: 'string', minLength: 2, maxLength: ROLE_KEY_MAX },
+    })) return;
+    const roleKey = req.body.role_key;
+    if (!ROLE_KEY_RE.test(roleKey)) {
+      return res.fail('bad_role_key', 400, { role_key: roleKey, expected: 'a kebab-case slug (^[a-z][a-z0-9-]*$)' });
+    }
+    try {
+      const role = await loadMutableRole(res, roleKey, 'seeded_role_assignment_forbidden', ASSIGN_REASON);
+      if (role === null) return;
+      const assigned = await db.assignRole({
+        builderId: req.body.builder_id,
+        roleKey,
+        assignedBy: req.builder.id,
+      });
+      res.status(assigned ? 201 : 200).json({ ok: true, builder_id: req.body.builder_id, role_key: roleKey, assigned });
+    } catch (err) {
+      if (err && err.code === '23503') {
+        return res.fail('builder_not_found', 404, { builder_id: req.body.builder_id });
+      }
+      console.error('[gds] POST /governance/assignments', err);
+      res.fail('assign_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm governance.manage — remove a custom-role assignment. Idempotent:
+  // `removed` says whether a row went away.
+  router.delete('/governance/assignments/:builderId/:roleKey', api.requireBuilder, api.requirePermission('governance.manage'), async (req, res) => {
+    const builderId = parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
+    if (builderId === null) return;
+    const roleKey = roleKeyParam(req, res);
+    if (roleKey === null) return;
+    try {
+      const role = await loadMutableRole(res, roleKey, 'seeded_role_assignment_forbidden', ASSIGN_REASON);
+      if (role === null) return;
+      const removed = await db.unassignRole({ builderId, roleKey });
+      res.json({ ok: true, builder_id: builderId, role_key: roleKey, removed });
+    } catch (err) {
+      console.error('[gds] DELETE /governance/assignments/:builderId/:roleKey', err);
+      res.fail('unassign_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
 };
 
 module.exports.governancePort = governancePort;

package/modules/grading/grader-workers/index.js

@@ -47,18 +47,27 @@ const TRANSIENT_WORKER_ERRORS = new Set([
 
 // #467: per-worker subagent timeout. The global 240s applied to EVERY worker,
 // which timed out the Read-heavy ones (Narc walks ACs + reads files — hence
-// Phase 2.0.5's 5-read workaround; Quality is next-heaviest) while the light
-// ones (Hacker, Efficiency) never needed that long. Per-worker budgets let the
-// heavy lenses breathe without globally inflating every ship's worst-case wall
-// time. A worker module may override by exporting its own MAX_TIMEOUT_MS;
-// otherwise this map (keyed by KIND) is the single tuning surface. Falls back
-// to runOpts.timeoutMs (then runSubagent's own 240s default) for any unlisted
-// worker. Tune from the calibration data (#292) once it accrues.
+// Phase 2.0.5's 5-read workaround; Quality is next-heaviest). Per-worker budgets
+// let the heavy lenses breathe without globally inflating every ship's
+// worst-case wall time. A worker module may override by exporting its own
+// MAX_TIMEOUT_MS; otherwise this map (keyed by KIND) is the single tuning
+// surface. Falls back to runOpts.timeoutMs (then runSubagent's own 240s default)
+// for any unlisted worker.
+//
+// task 1002580 — calibration data (#292): the earlier assumption that Hacker and
+// Efficiency are "light" INVERTS when the diff is itself security- or
+// performance-heavy code (a security module, a hot path). On task 1002544's
+// ~92k-char security-module diff the Hacker worker hit SUBAGENT_TIMEOUT at 240s
+// three runs straight while Narc/Quality completed at 360s — and because a
+// gating-worker timeout HARD-BLOCKS (security is non-optional), a fully-passing
+// 9/10 feature could not land. All four gating/advisory workers now share the
+// 360s heavy-tier budget. Worst-case wall time is unchanged: workers run in
+// parallel, so the panel's wall time was already max()=360s from Narc/Quality.
 const WORKER_MAX_TIMEOUT_MS = {
   narc: 360_000,       // Read-heavy: walks every acceptance criterion
   quality: 360_000,    // Read-heavy: reads changed files for cleanliness review
-  hacker: 240_000,     // lighter: focused security scan
-  efficiency: 240_000, // lighter: focused performance scan
+  hacker: 360_000,     // Read-heavy on a security diff: exploit-surface scan of every changed file
+  efficiency: 360_000, // Read-heavy on a large diff: traces perf across every changed file
 };
 
 // Resolve the timeout for a worker: explicit module override > KIND map >

package/modules/hall-ui/public/gate.js

@@ -10,7 +10,7 @@
 // Like The Watch + The Harbor, this reads /api/bongos/me to show a Sealed notice for
 // non-Archons — DEFENCE IN DEPTH only. GET /gate-approvals + POST
 // /gate-approvals/:pr/approve are ALSO archon-gated server-side (ADR 0016), and
-// the page itself is gated by server.js requireArchonPage. On 401 → web sign-in.
+// the page itself is gated by server.js requireGovernancePage. On 401 → web sign-in.
 
 (() => {
   'use strict';
@@ -217,7 +217,11 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    if (rank !== 'archon') { showSealed(); return; }
+    // ADR 0157: the Gate page sits at the `page.view.governance` floor (metic). The
+    // server's requireGovernancePage is the wall — this only decides whether to render the
+    // body or the sealed notice, so it must agree or a Metic sees "sealed" on a page
+    // they were just admitted to.
+    if (rank !== 'metic' && rank !== 'archon') { showSealed(); return; }
 
     document.getElementById('gate-sub').textContent = 'Changes touching protected build surfaces, held for your approval.';
     document.getElementById('gate-body').hidden = false;

package/modules/hall-ui/public/goals-page.js

@@ -224,7 +224,7 @@
 
   // task 1002164 — confirming a criterion is Metic+ (POST /done-when/:id/satisfy,
   // ADR 0086 §6). Client-side this only decides whether to SHOW the control; the
-  // server's requireRank('metic','archon') is the real gate.
+  // server's requirePermission('criterion.satisfy') is the real gate (BV1.R105).
   const RANK_ORDER = { archon: 4, metic: 3, thetes: 2, xenos: 1 };
   const canConfirmCriteria = () =>
     (RANK_ORDER[(state.me?.builder?.rank || '').toLowerCase()] ?? 0) >= RANK_ORDER.metic;
@@ -1091,7 +1091,11 @@
     } catch (err) {
       if (err && err.message === 'redirecting to auth') return;
       const code = err && err.data && err.data.error;
-      const reason = (code && (code.code || code)) === 'rank_forbidden'
+      // POST /done-when/:id/satisfy gates on criterion.satisfy since BV1.R105, so the
+      // denial code is now 'permission_forbidden'; 'rank_forbidden' is kept for an
+      // instance still on a pre-R105 core (the doorway is versioned, ADR 0083).
+      const denial = code && (code.code || code);
+      const reason = (denial === 'permission_forbidden' || denial === 'rank_forbidden')
         ? 'Confirming a criterion needs Metic rank or higher.'
         : `Could not confirm that criterion (${(err && err.status) || 'error'}).`;
       toast(reason);