@bongos/core 1.19.1034 → 1.19.1036

package/clients/bongos-client/index.mjs

@@ -185,6 +185,8 @@ export function createClient(opts = {}) {
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
       // GET /autonomy/runners — rank: any-builder — GET /autonomy/runners
       getAutonomyRunners: (args) => request("GET", "/autonomy/runners", { hasBody: false }, args),
+      // GET /autonomy/runs — rank: metic+archon — GET /autonomy/runs
+      getAutonomyRuns: (args) => request("GET", "/autonomy/runs", { hasBody: false }, args),
     },
     "backup": {
       // GET /backup/status — rank: metic+archon — GET /backup/status
@@ -346,6 +348,10 @@ export function createClient(opts = {}) {
       // GET /core-update — rank: archon — GET /core-update
       getCoreUpdate: (args) => request("GET", "/core-update", { hasBody: false }, args),
     },
+    "coreUpgrades": {
+      // GET /core-upgrades — rank: archon — GET /core-upgrades
+      getCoreUpgrades: (args) => request("GET", "/core-upgrades", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md

@@ -0,0 +1,84 @@
+# ADR 0339 — A project's owner upgrades it, and a hosted project hands off to the hub's door
+
+- **Status:** Accepted
+- **Date:** 2026-09-26
+- **Task:** [task 1004174](https://cloudbongos.com/builders#/task/1004174) (goal 1000090 — BONGOS-V2)
+- **Deciders:** the owner, Lars. On 2026-09-22 he said "every project has the option to upgrade its version of bongos including bongos itself", and that the control belongs in that project's own hall. On 2026-09-26 he ruled that **only a project's owner upgrades it**, adding that for him "owners and archons are the same", because he owns the platform.
+- **Amends:** [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) D5 ("Archon-gated server-side"). The deploy door gains a second audience, as stated below. D1 (the web tier only asks, the control plane acts), D3, D4 and D6 are unchanged.
+- **Related:** [ADR 0328](0328-a-hosted-projects-authority-is-its-membership-row-not-its-owner-column.md) (the owner-OR-operator gate shape this reuses), [ADR 0210](0210-scouting-graduates-on-an-instance-asserted-owner-claim.md) (the `alsoAdmits` page-gate door this reuses), [ADR 0246](0246-catalog-membership-is-a-projection-not-a-federation-side-effect.md) (a hosted project's hub client id is its slug), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) / 0111 §2 (the web tier gains no capability)
+
+## Context
+
+The deploy door is `POST` and `GET /provisioning/instances/:id/core-upgrade` on the control plane, fronted by the hub's `/deploy` page. It was gated on `core.pin.move` alone. That atom has an archon floor and `system:true`: the catalog forbids granting it to metic, and no custom rank can hold it.
+
+That produced two dead ends.
+
+1. **The owner of a hosted project below Archon could see they were behind and could never act on it.** On a hosted project the banner (task 1004045) prints "Core X is available" with no action, because that project does not run the provisioning module. The door lives on the hub, and on the hub the owner (erikwils is Xenos; willHermesLines is Metic) is refused by the atom.
+2. **A hosted project's own hall had a "Deploy" link that opened a page with nothing behind it.** The page's calls are provisioning routes, and a tenant has none.
+
+Task 1004174's own text settled where the act must happen. It stays on the control plane, because ADR 0293 D1 and ADR 0043 both turn on the web tier never gaining a shell. The hosted project hands off rather than acting.
+
+## Decision
+
+### D1 — The owner of a hosted project may move that project's core, from the hub
+
+The two per-project routes (the preview `GET` and the move `POST`) are gated by an OR, implemented in `modules/provisioning/core-upgrade-authz.js`:
+
+1. **Ownership is asked first.** The caller is admitted if the row's `owner_builder_id` is the caller and the row is a tenant shape (`co-tenant` or `cloud-host`).
+2. **Every other caller meets the unmodified `requirePermission('core.pin.move')`** and its unchanged refusal. That includes callers who are not the owner, a missing row, an unparseable id, and a database error during the ownership read.
+
+This is the shape ADR 0328 Decision 2 and ADR 0210's `requireScoutingReader` already use. The atom is still spelled in each route's middleware list, where `route-rank-check.js` and `gen-api-docs.js` read it. The consequences:
+
+- A non-owner below Archon gets exactly the 403 they always got, and learns nothing about whether the id exists.
+- The Archon path is untouched.
+- The widening can only admit.
+
+### D2 — The platform's own row stays on the atom
+
+`OWNER_SHAPES` excludes `control-plane`. Moving the platform changes the code that drives every hosted project, so only a holder of `core.pin.move` may do it. `GET /provisioning/control-plane` keeps the atom alone.
+
+For Lars this is no restriction: he is both the platform's owner and an Archon, which is his ruling that the two are the same.
+
+### D3 — A hosted project hands its owner to the hub, and gains nothing
+
+`GET /api/bongos/core-update` (core) now also answers `deploy_url`: `<hub origin>/deploy?project=<slug>`.
+
+- It is built from the two values provisioning already writes into a federated project's `web.env`: the hub origin and the hub client id, which is the slug (ADR 0246).
+- It is null on an instance with no hub, such as a self-hosted instance or the hub itself.
+- The client secret is never read for it.
+
+The hall uses that address in two places, and only where it has no door of its own (the provisioning module is off):
+
+- **The banner's "Upgrade" links there.**
+- **The rail's "Deploy" item** is dropped where the provisioning module is off, and re-pointed at that address once it is known.
+
+The hub's `/deploy?project=<slug>` page (task 1004171) was built as exactly this seam.
+
+The hub's `/deploy` page shell is gated by `requireCorePinPage`. It now declares `alsoAdmits: 'isProjectOwner'`, the door `/people` uses: it admits the shell for an owner of any live project. Which project the owner may read or move is still the routes' decision, made per request against that project's row.
+
+### D4 — The actor says which door was used, and still names the builder
+
+An owner's move is recorded as `api:owner:<id>`, and an Archon's as `api:archon:<id>`. The runner's `requestedByOf` accepts both and passes the id through as `--requested-by`, so the `core_upgrades` ledger attributes the move either way (ADR 0293 D5).
+
+## Rejected
+
+- **A tenant-side API that authenticates back to the control plane and performs the upgrade.** It is rejected in writing, as the task asked. It would be a new cross-instance authentication surface on the most privileged action in the system, and it would give a tenant's web process a path to the act ADR 0293 D1 keeps on the control plane. The hand-off costs one navigation and adds no new capability anywhere.
+- **Granting `core.pin.move` to owners.** The atom is `system:true` precisely so it cannot be handed down, and "may move core pins" is not "may move this one project's pin". Ownership is a separate axis, as ADR 0151 §3 keeps it.
+- **Letting an owner move the platform row.** The platform row is not the owner's project in the sense the ruling means. Its only owner is the Archon who holds the atom anyway.
+- **Asking the platform-identity membership ledger instead of `owner_builder_id`.** ADR 0328 Phase 2 (task 1004161) will widen project authority to members through that port. The ruling here is "owner", which the row already records, so this ADR takes the column and leaves the widening to that task.
+
+## Consequences
+
+- **erikwils (hoodify-finance) and willHermesLines (mercury) can upgrade their own projects.** They open `https://cloudbongos.com/deploy?project=<slug>` on the hub. The hub half works as soon as the platform runs a core carrying this ADR. The in-hall link reaches a hosted project only once that project runs such a core, because the banner ships inside the core. Until then the owner reaches the door by its address.
+- **An owner's upgrade restarts their own site.** The runner's health gate and auto-rollback apply unchanged.
+- **ADR 0328 Phase 1 must absorb this gate, not route around it.** When task 1004159 lands `requireProjectOwner` for the `/provisioning/instances/:id...` routes, the two core-upgrade routes should move onto it with the atom as their override. That keeps the same owner-OR-atom answer, and the platform row stays atom-only. Until then `requireOwnProjectOrPin` is the only owner gate on them. Task 1004160's `project_scope_missing` check lists `/provisioning/instances/:id` as a prefix, so it would flag these two routes. That is correct: it is the reminder to fold them in, not a sign that they are unguarded.
+- **The page shell admits any live project owner.** An owner without the atom who opens `/deploy` without `?project=` sees the sealed state, because `/provisioning/control-plane` refuses them. The page is a shell, and every datum behind it is gated per request.
+- **Proof:** `tests/core_upgrade_owner_door.mjs` covers each case:
+  - the owner below Archon, admitted;
+  - the Archon on another's project, admitted by the atom;
+  - the non-owner below Archon, refused byte-for-byte as before, whether the id exists or not;
+  - the platform row, owner or not, refused without the atom;
+  - a failing ownership read, which falls to the atom;
+  - the actor labels, and the runner's attribution parse;
+  - the page shell admitting an owner and still refusing a stranger;
+  - the `deploy_url`, and the hall's banner and rail on a hosted project and on the platform.

package/docs/adr/README.md

@@ -430,3 +430,4 @@ This keeps the decision history honest and traceable.
 | 0336 | [**A guild is a hub-side group whose members each consent twice, and its collective record is only ever the sum of what those members already show** ([task 1002299](https://cloudbongos.com/builders#/task/1002299), goal 1000110 — the R23 design spike for goal 1000045's C7/C8/C9). No platform guild existed (every "guild" in the tree is Discord's). Decisions: (1) three hub tables in `platform-identity`, in their own `guilds.js` (the 1,500-line ratchet), distinct from instance-local `goal_members`: guilds (slug, name, `visibility ∈ public|unlisted` with **no default**), members (`membership_kind ∈ owner|member`, never `role` per ADR 0174; a partial unique index holds exactly one owner; a per-member `shown_publicly`), and requests; (2) two consents to join, no self-join, through ADR 0202's connections lifecycle verbatim (silent decline, 90-day swallowed re-ask, 30-day read-time expiry); `accountActiveSql` floors the feature; an **unlisted guild 404s to everyone on the public read, members included**, and takes invites only, because a slug is guessable; (3) the public roster is `shown_publicly AND accountVisibleSql`, and widening a guild to public changes no member's flag but the flipping owner's, so consent given to a small audience is never reused for a large one; (4) **the privacy resolution — NOT ratified; superseded by [ADR 0337](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) D4.4:** it proposed that a member is counted iff shown AND `rollupVisibleSql`, read-time, `no-store`, never stored, and N and M are both lengths of lists the reader can see. The guild record is therefore always a sum of numbers already on members' own public profiles, so nothing can be subtracted out. All-or-nothing is rejected (one member blanks everyone and hiding becomes costly), as is per-member consent to count hidden numbers (it breaks "hide_stats beats everything"). The trade-off: guilds of privacy-minded builders look smaller and rank lower. A union count of all members' projects is refused because it reveals shared private projects; (5) the namespace is `/g/<slug>`, `g` is reserved in the SEO spec's project-slug list, the slug is fixed in V1, and `tests/guild_namespace_reserved.mjs` pins the two documents together; (6) a guild engages a project only through the individual door: a guild application is each member's own vouched application, labelled through ADR 0260's live applicant-profile read (no new instance field); inviting a guild fans out ordinary individual invites to its public roster at that moment, **never a guild-level pre-approval** (that would let a guild owner decide admission to someone else's project); (7) the map ranks public guilds by size and counted works shipped, read-time, with a slug tiebreak, and R29 narrows to the visual. Scope changes for R24–R37 are tabled in the ADR, including R28's dependency on the abandoned R11 and R29/R31's archived orb goals.](0336-a-guilds-record-is-the-sum-of-what-its-members-already-show.md) | platform identity / privacy / social graph |
 | 0337 | [**The hub account is the person, a hall account is their seat in one project, so anything that spans projects lives on the hub** ([task 1004255](https://cloudbongos.com/builders#/task/1004255), goal 1000110 — the owner's hub/hall re-scope, 2026-09-24/25). Extends [ADR 0141](<redacted>.md) from identity to placement: (1) a surface about the person across projects, or about more than one project, goes on the HUB (`public-landing`, `platform-identity`): people directory, community, guilds, connections, recruiting, platform-account settings; one about this project goes in the HALL (`hall-ui`); "Builders you may know" is on both; `status-ui` is the status dashboard, not the hall; (2) no authority moves, and hub actions still land as the project's own rows; (3) hall `/people` retires, ADR 0334's recruiting directory moves unchanged to the hub community page, `/roster` is the in-project directory; (4) owner calls: the hidden-builder recruiter panel is recruiter-only while public search is unchanged (amends community-tab spec D8); platform-account settings get a new hub page; **guild totals count hidden and private members by default, with a notice on the join card and a per-guild off switch (`counted_in_totals`), rounded to a 1–2–5 band, only once a guild has at least 3 of them, refreshed weekly; size stays the public roster length** (supersedes ADR 0336 D5; relaxes the privacy spec's "`hide_stats` beats everything" for guild totals only, for a member who was told), with the fake-account padding limit stated and accepted.](0337-the-hub-account-is-the-person-a-hall-account-is-their-seat-in-one-project.md) | platform identity / placement / privacy |
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
+| 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |

package/docs/api/openapi.json

@@ -105,6 +105,10 @@
       "name": "core-update",
       "description": "Endpoints under `/api/bongos/core-update`."
     },
+    {
+      "name": "core-upgrades",
+      "description": "Endpoints under `/api/bongos/core-upgrades`."
+    },
     {
       "name": "cost",
       "description": "Endpoints under `/api/bongos/cost`."
@@ -2128,6 +2132,47 @@
         ]
       }
     },
+    "/autonomy/runs": {
+      "get": {
+        "operationId": "get_autonomy_runs",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "GET /autonomy/runs",
+        "description": "The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). READ-ONLY and behind the SAME atom as the precheck above (`autonomy.precheck`, Metic+): whoever may ask the gate the question may read its past answers, and a new atom would need a migration for no change in audience. Adds no gate anywhere — pure observability over rows the precheck already writes. ?routine=<name> narrows to one routine; ?limit=1..100 (default 20), newest first.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `autonomy.precheck` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.precheck"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAutonomyRunsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/backup/status": {
       "get": {
         "operationId": "get_backup_status",
@@ -5126,6 +5171,47 @@
         ]
       }
     },
+    "/core-upgrades": {
+      "get": {
+        "operationId": "get_core_upgrades",
+        "tags": [
+          "core-upgrades"
+        ],
+        "summary": "GET /core-upgrades",
+        "description": "GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when the pin last moved, from and to which version, and whether a person or the unattended sweep moved it (task 1002669). READ-ONLY. Gated on the SAME atom as /core-update above and the deploy door, for the same first reason: it names the exact core this box has run and when, which is a vulnerability-window disclosure (ADR 0043). No new atom, so no migration. ?limit=1..100 (default 20).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/core-update.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetCoreUpgradesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/cost": {
       "post": {
         "operationId": "post_cost",
@@ -13829,7 +13915,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/control-plane",
-        "description": "GET /provisioning/control-plane — \"which row is this platform, and where does it stand?\" The deploy page's first call: the self row is created once by hand at install time, so its id is per-install and nobody's to memorise. Same atom again, so the entrance is no wider than the door it leads to.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "GET /provisioning/control-plane — \"which row is this platform, and where does it stand?\" The deploy page's first call: the self row is created once by hand at install time, so its id is per-install and nobody's to memorise. The atom ALONE here, with no owner door: this is the platform's own row (ADR 0339).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -14145,7 +14231,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/instances/:id/core-upgrade",
-        "description": "GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. GATED THE SAME AS THE POST, deliberately. Reading it discloses the instance's exact core version and how far behind it is, which is a vulnerability-window disclosure — precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview anyone could read would also let an attacker time a request against a known-stale window. The read being no cheaper than the write costs the owner nothing: they hold the atom by construction, because they are the only one who can press the button.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. GATED THE SAME AS THE POST, deliberately. Reading it discloses the instance's exact core version and how far behind it is, which is a vulnerability-window disclosure — precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview anyone could read would also let an attacker time a request against a known-stale window. The read being no cheaper than the write costs the owner nothing: whoever may press the button may read what it would do — the same two doors as the POST.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -14191,7 +14277,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/core-upgrade",
-        "description": "POST /provisioning/instances/:id/core-upgrade — move the core pin. rank: `core.pin.move` — archon floor AND system:true, so the catalog's own invariant forbids granting it to metic and no custom rank can be handed it without a deliberate, visible edit. BV1.R105 / ADR 0151 is why this is an atom and not `requireRank`: tests/government_require_permission.mjs fails the build on a new requireRank in a modules/*/routes gate. Body: { to: \"1.19.757\" } — and requiring it IS the second step of the two-step the owner asked for (ADR 0293 D4). A request that cannot fire without naming its target cannot fire from a stray click, and \"move to whatever is newest\", resolved at drain time, would be a different act from the one previewed: main moves between the preview and the confirm. What this does NOT check: whether the version is PUBLISHED, and whether the channel policy admits it. Both need the registry, and the only tool that reads it (update-channel.js `listAvailableVersions`) shells out synchronously — it would block the event loop for every other request on this process. It also lives in scripts/gds/, which a module may not require (ADR 0083). The runner enforces both, where it is a CLI and both are free. See ../core-upgrade.js.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "description": "POST /provisioning/instances/:id/core-upgrade — move the core pin. rank: `core.pin.move` — archon floor AND system:true, so the catalog's own invariant forbids granting it to metic and no custom rank can be handed it without a deliberate, visible edit. BV1.R105 / ADR 0151 is why this is an atom and not `requireRank`: tests/government_require_permission.mjs fails the build on a new requireRank in a modules/*/routes gate. OR THE PROJECT'S OWN OWNER (task 1004174, ADR 0339 — the owner's ruling that only a project's owner upgrades it). Ownership of a TENANT row is asked first; any other caller meets the unmodified `core.pin.move` gate and its unchanged refusal. The platform's own row is not an owner's to move here — it stays on the atom. Body: { to: \"1.19.757\" } — and requiring it IS the second step of the two-step the owner asked for (ADR 0293 D4). A request that cannot fire without naming its target cannot fire from a stray click, and \"move to whatever is newest\", resolved at drain time, would be a different act from the one previewed: main moves between the preview and the confirm. What this does NOT check: whether the version is PUBLISHED, and whether the channel policy admits it. Both need the registry, and the only tool that reads it (update-channel.js `listAvailableVersions`) shells out synchronously — it would block the event loop for every other request on this process. It also lives in scripts/gds/, which a module may not require (ADR 0083). The runner enforces both, where it is a CLI and both are free. See ../core-upgrade.js.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
         "x-rank": "archon",
         "x-source": "modules/provisioning/routes/core-upgrade.js",
         "x-permissions": [
@@ -20636,6 +20722,19 @@
           "none"
         ]
       },
+      "GetAutonomyRunsResponse": {
+        "type": "object",
+        "properties": {
+          "routine": {},
+          "limit": {},
+          "runs": {}
+        },
+        "required": [
+          "routine",
+          "limit",
+          "runs"
+        ]
+      },
       "GetBackupStatusResponse": {
         "type": "object",
         "properties": {
@@ -20992,11 +21091,30 @@
           "ok": {
             "type": "boolean"
           },
-          "update": {}
+          "update": {},
+          "deploy_url": {}
         },
         "required": [
           "ok",
-          "update"
+          "update",
+          "deploy_url"
+        ]
+      },
+      "GetCoreUpgradesResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "running": {},
+          "limit": {},
+          "upgrades": {}
+        },
+        "required": [
+          "ok",
+          "running",
+          "limit",
+          "upgrades"
         ]
       },
       "GetDiscordChannelsPlanResponse": {
@@ -27782,9 +27900,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 437,
-  "x-schema-count": 479,
+  "x-endpoint-count": 439,
+  "x-schema-count": 481,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 327,
+  "x-response-schemas": 329,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 437 endpoints across 74 route files.
+> **Generated from the live route files** — the route file is authoritative. 439 endpoints across 74 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -84,7 +84,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
-## `autonomy` (7)
+## `autonomy` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -95,6 +95,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id` | The runner's check-in, once per loop. |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runners` | `any-builder` | — | What the hall renders: the CALLER'S OWN runners, with the pure verdict attached so the page and any future alert cannot disagree about wh… |
+| GET | `/api/bongos/autonomy/runs` | `metic+archon` | — | The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). |
 
 ## `backup` (2)
 
@@ -224,6 +225,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/core-update` | `archon` | — |  |
 
+## `core-upgrades` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/core-upgrades` | `archon` | — | GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when the pin last moved, from and to which version, and whethe… |
+
 ## `cost` (1)
 
 | Method | Path | Rank | Body | Description |

package/docs/copy-inventory.md

@@ -594,8 +594,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:226` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:81` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/thinking.html:80` |
-| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:495` |
-| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:497` |
+| `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:500` |
+| `eba610d25523` | certain | Jump to… | `modules/hall-ui/public/shell.js:502` |
 | `bc779353aa0c` | certain | Karma — peer recognition and approvals, a separate counter from {…}. | `modules/hall-ui/public/profile.js:94` |
 | `de0e1590667f` | certain | Keep all {…} {…} — they are the values the code drops in, and the change cannot land without them. | `modules/hall-ui/public/copy-desk.js:442` |
 | `fbe40b5818a3` | certain | Key removed. | `modules/hall-ui/public/settings.js:1128` |
@@ -776,7 +776,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `261d123970e8` | certain | Open goal #{…} | `modules/hall-ui/public/roadmap.js:112` |
 | `5f3e0b179839` | certain | Open in Sessions | `modules/hall-ui/public/task.js:483` |
 | `9f55e4674ebb` | certain | Open in the copy desk | `modules/hall-ui/public/studio.js:219` |
-| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:486` |
+| `3366b115217b` | certain | Open navigation | `modules/hall-ui/public/shell.js:491` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/goals-render.js:415` |
 | `855277dff074` | certain | Open task #{…} | `modules/hall-ui/public/work.js:1124` |
 | `99c630009152` | certain | Open tasks whose declared files overlap — sequence these before two builders collide. | `modules/hall-ui/public/goals.html:125` |
@@ -984,12 +984,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:367` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:391` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:461` |
-| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:456` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:474` |
-| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:707` |
+| `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/shell.js:461` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:479` |
+| `1883ad7f07fc` | certain | Sign out | `modules/hall-ui/public/shell.js:738` |
 | `8ad669ab2565` | certain | Sign out everywhere | `modules/hall-ui/public/settings.html:171` |
 | `ecc12c1dd4de` | certain | Skill voices | `modules/hall-ui/public/settings.html:350` |
-| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:698` |
+| `87cee78ca134` | certain | Skip to content | `modules/hall-ui/public/shell.js:729` |
 | `688ca7b6e30f` | certain | Slop — reads as machine-written | `modules/hall-ui/public/copy-desk.html:90` |
 | `82df09a08476` | certain | So the Archon knows who you are | `modules/hall-ui/public/hall-render.js:294` |
 | `7da6a848cd26` | certain | Someone helped | `modules/hall-ui/public/collab.js:296` |
@@ -1016,7 +1016,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5831de503015` | certain | Studio — {{worldName}} | `modules/hall-ui/public/studio.html:10` |
 | `f79e1fb8ebd4` | certain | Suggested as you type; leave it on "no goal" and it waits for triage. | `modules/hall-ui/public/ideas.html:84` |
 | `a1482eff4ead` | certain | Suggested for you | `modules/hall-ui/public/settings-specialities.js:137` |
-| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:501` |
+| `1e40f33483eb` | certain | Switch theme | `modules/hall-ui/public/shell.js:506` |
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1335` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:139` |
@@ -1037,7 +1037,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2fc66e722e33` | certain | Tasks open once you have read the builder primer. | `modules/hall-ui/public/work.html:43` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
 | `44579eef0c8d` | certain | Tasks — {{worldName}} | `modules/hall-ui/public/work.html:6` |
-| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:500` |
+| `2f4f047dc1b4` | certain | Text size | `modules/hall-ui/public/shell.js:505` |
 | `f420429f942e` | certain | That builder no longer exists. | `modules/hall-ui/public/goals-render.js:1305` |
 | `545c59c1deb7` | certain | That is the session you are using right now. Ending it signs you out of this page. | `modules/hall-ui/public/settings-sessions.js:74` |
 | `282c3fa2d456` | certain | That is the wording it already has. Change something, or file a flag instead if you only want to mark it. | `modules/hall-ui/public/copy-desk.js:438` |
@@ -1169,7 +1169,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2c1c20785a6e` | certain | Unclear — a person would not know what to do | `modules/hall-ui/public/copy-desk.html:91` |
 | `aa445f06cc5e` | certain | Unlink failed: {…} | `modules/hall-ui/public/settings.js:856` |
 | `67fbc770b3b3` | certain | Upvote (+1) | `modules/hall-ui/public/builders.js:777` |
-| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:665` |
+| `16d7f809be8a` | certain | Use the control below to take it. | `modules/hall-ui/public/shell.js:696` |
 | `e7e2a99a2bea` | certain | Use this | `modules/hall-ui/public/settings-specialities.js:148` |
 | `e1ecd543a2ca` | certain | Using this speciality. | `modules/hall-ui/public/settings-specialities.js:199` |
 | `6200bac6bdca` | certain | View all sessions | `modules/hall-ui/public/watch.html:99` |

package/docs/copy-registry.json

@@ -192,7 +192,7 @@
         "modules/hall-ui/public/hall-render.js:367",
         "modules/hall-ui/public/hall-render.js:391",
         "modules/hall-ui/public/hall-render.js:461",
-        "modules/hall-ui/public/shell.js:456"
+        "modules/hall-ui/public/shell.js:461"
       ]
     },
     {
@@ -1581,8 +1581,8 @@
       "text": "Sign out",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/shell.js:474",
-        "modules/hall-ui/public/shell.js:707"
+        "modules/hall-ui/public/shell.js:479",
+        "modules/hall-ui/public/shell.js:738"
       ]
     },
     {
@@ -6850,7 +6850,7 @@
       "surface": "builders-hall",
       "text": "Jump to a page or record",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 495,
+      "line": 500,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6859,7 +6859,7 @@
       "surface": "builders-hall",
       "text": "Jump to…",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 497,
+      "line": 502,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8488,7 +8488,7 @@
       "surface": "builders-hall",
       "text": "Open navigation",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 486,
+      "line": 491,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10360,7 +10360,7 @@
       "surface": "builders-hall",
       "text": "Sign in with GitHub",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 456,
+      "line": 461,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10369,7 +10369,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 474,
+      "line": 479,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10378,7 +10378,7 @@
       "surface": "builders-hall",
       "text": "Sign out",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 707,
+      "line": 738,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10405,7 +10405,7 @@
       "surface": "builders-hall",
       "text": "Skip to content",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 698,
+      "line": 729,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -10648,7 +10648,7 @@
       "surface": "builders-hall",
       "text": "Switch theme",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 501,
+      "line": 506,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10837,7 +10837,7 @@
       "surface": "builders-hall",
       "text": "Text size",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 500,
+      "line": 505,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12025,7 +12025,7 @@
       "surface": "builders-hall",
       "text": "Use the control below to take it.",
       "file": "modules/hall-ui/public/shell.js",
-      "line": 665,
+      "line": 696,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2547,5 +2547,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1032 with no explicit bump. run 36214617025. (task 1002620)
   1.19.1034 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1033 with no explicit bump. run 36215757254. (task 1002620)
+  1.19.1035 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1034 with no explicit bump. run 36226356336. (task 1002620)
+  1.19.1036 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1035 with no explicit bump. run 36226955285. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/autonomy/db.js

@@ -44,6 +44,24 @@ async function lastAutonomyHead(routine) {
   return rows[0]?.head_sha || null;
 }
 
+// The recent autonomy-gate decisions, newest first — the off-box answer to "did the
+// routine fire, and what did it decide" (task 1002669). Every precheck writes a row
+// here, every SKIP included, so the table is the whole record; before this read
+// existed, finding out needed an SSH session on the host (blocker 1000106). `routine`
+// null means every routine. The (routine, created_at DESC) index serves both shapes.
+async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, routine, decision, reason, head_sha, claimable_count, enabled, created_at
+       FROM autonomy_runs
+      WHERE ($1::text IS NULL OR routine = $1)
+      ORDER BY created_at DESC, id DESC
+      LIMIT $2`,
+    [routine, limit]
+  );
+  // bigserial ids arrive as strings from node-postgres; keep them strings on purpose.
+  return rows.map((r) => ({ ...r, id: String(r.id) }));
+}
+
 // ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
 //
 // These back the one control surface the runner host cannot write to. Everything
@@ -162,6 +180,7 @@ async function readRunnerHeartbeats(builderId) {
 module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
+  readAutonomyRuns,
   recordRunnerHeartbeat,
   readRunnerHeartbeats,
   readFence,

package/modules/autonomy/routes/autonomy.js

@@ -42,6 +42,16 @@ const { validateOrRespond } = api;
 //
 // rank: archon — autonomy is an ops control surface, and a precheck records an
 // autonomy_runs row + git-fetches. Keep it archon-scoped (ADR 0016).
+// ?limit for GET /autonomy/runs: an integer 1..100, else the default 20. Clamped rather
+// than refused — a read an operator types by hand should answer, not argue.
+const RUNS_DEFAULT_LIMIT = 20;
+const RUNS_MAX_LIMIT = 100;
+function runsLimit(raw) {
+  const n = Number.parseInt(String(raw ?? ''), 10);
+  if (!Number.isFinite(n)) return RUNS_DEFAULT_LIMIT;
+  return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
+}
+
 module.exports = function buildAutonomyRouter() {
   const router = express.Router();
 
@@ -58,6 +68,24 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // The gate's past decisions — did a routine fire, and what did it decide, and why
+  // (task 1002669). READ-ONLY and behind the SAME atom as the precheck above
+  // (`autonomy.precheck`, Metic+): whoever may ask the gate the question may read its
+  // past answers, and a new atom would need a migration for no change in audience.
+  // Adds no gate anywhere — pure observability over rows the precheck already writes.
+  // ?routine=<name> narrows to one routine; ?limit=1..100 (default 20), newest first.
+  router.get('/autonomy/runs', auth.requireBuilder, auth.requirePermission('autonomy.precheck'), async (req, res) => {
+    const routine = typeof req.query.routine === 'string' && req.query.routine ? req.query.routine.slice(0, 64) : null;
+    const limit = runsLimit(req.query.limit);
+    try {
+      const runs = await db.readAutonomyRuns({ routine, limit });
+      res.json({ routine, limit, runs });
+    } catch (err) {
+      log.error('[gds] GET /autonomy/runs', err);
+      res.fail('autonomy_runs_unreadable', { status: 503, message: 'could not read the autonomy decisions' });
+    }
+  });
+
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
   // These four routes ARE the fence. Everything the unattended runner is allowed