@bongos/core 1.19.873 → 1.19.875

package/modules/hall-ui/public/deploy.js

@@ -1,25 +1,43 @@
-// deploy.js — the owner's deploy door (task 1003159, ADR 0293).
+// deploy.js — the owner's deploy door (task 1003159, ADR 0293; widened to the
+// hosted projects by task 1004046).
 //
 // WHAT THIS PAGE IS FOR. The owner, twice in a month: "I don't think I can make anything
-// live", then "this is above my paygrade." Moving this instance's core pin is gate 3 of
-// the release pipeline and the ONLY act that makes shipped work visible to users — and it
-// was reachable from exactly one place, a shell on the control-plane box holding an ssh
-// key. An agent could not close the loop either: the permission classifier blocks a
-// mutating `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold
-// was the one gate with no instrument. This page is the instrument.
+// live", then "this is above my paygrade." Moving a core pin is gate 3 of the release
+// pipeline and the ONLY act that makes shipped work visible to users — and it was
+// reachable from exactly one place, a shell on the control-plane box holding an ssh key.
+// An agent could not close the loop either: the permission classifier blocks a mutating
+// `sudo -u lars` over ssh by design. So the one gate that is the owner's to hold was the
+// one gate with no instrument. This page is the instrument.
+//
+// WHY THE PROJECTS ARE HERE AND NOT IN THEIR OWN HALLS. The obvious shape — each owner
+// pressing Upgrade in their own project's hall — is not buildable: the upgrade route and
+// the intent queue belong to the PROVISIONING module, and a hosted project does not run
+// it. Probed 2026-09-18: /api/bongos/provisioning/health answers 200 here and 404 on
+// every tenant. The control plane is the only place that can act on them, so this is
+// where the button lives. Their own halls get the banner instead (task 1004045), which
+// each instance derives for itself from the registry and needs nothing from us.
+//
+// Nothing about the ENGINE had to change for this. UPGRADE_SHAPES already admitted
+// 'co-tenant' and 'standalone' alongside 'control-plane', coreUpgradeInstance already
+// resolved each shape's own checkout and built that box's own health and version URLs,
+// and the preview route already took any instance id. Only this page was single-row.
 //
 // THE RULE THAT SHAPES EVERY LINE HERE: this page KNOWS NOTHING. Every version on it is a
 // reading the control-plane runner took on the box, carried through the server with the
 // time it was taken. Nothing is computed here, no version is compared here, and "up to
 // date" is never inferred from an absence — the server says `behind` or it does not, and
 // a missing reading renders as a missing reading. A deploy control that guesses is worse
-// than none, because it is trusted.
+// than none, because it is trusted. That rule is now load-bearing for boxes the owner has
+// never logged into, which is the harder case, not the easier one.
 //
 // TWO STEPS, NEVER ONE (ADR 0293 D4). The owner asked for the confirmation. Auto-rollback
 // already guards the bad release; this guards the wrong button. Step one shows what would
 // move; step two names the version it saw and sends that. The confirm button is built
 // FROM the previewed version, so a release that lands between the two steps cannot
-// silently change what the press does.
+// silently change what the press does. With several boxes on one page the step is held
+// PER BOX, and each button's handler CLOSES OVER the preview object it was built from —
+// so the version sent is the one that box displayed, and a repaint cannot swap it. A
+// page-wide "currently previewing" would be a wrong-box press waiting to happen.
 (() => {
   'use strict';
 
@@ -29,10 +47,9 @@
   const toast = (msg) => window.OTB.toast(msg);
   const $ = (id) => document.getElementById(id);
 
-  // The preview the server last handed us. The confirm step reads its version from HERE
-  // rather than from the DOM, so what is sent is what was previewed even if a poll
-  // repaints between the two clicks.
-  let previewed = null;
+  // instance_id -> 'preview' | 'confirm'. Held per box so opening the confirm on one does
+  // not arm it on another.
+  const steps = new Map();
 
   async function fetchJson(path) {
     const res = await api.request('GET', `${API}${path}`);
@@ -74,7 +91,7 @@
     return v ? `<span class="ov-mono">${escapeHtml(String(v))}</span>` : '<span class="ps-pill ps-pill--absent">no reading</span>';
   }
 
-  // ---- the three states this page can be in --------------------------------
+  // ---- the states ONE box can be in ----------------------------------------
 
   // Something is already running. The press is not offered at all — offering a button
   // that the server will refuse with 'intent_conflict' is a worse experience than saying
@@ -92,69 +109,108 @@
       <p class="ov-row__sub">Core <strong>${escapeHtml(String(p.recommended_version))}</strong> is published and
         this box is not on it yet.</p>
       <div class="ps-controls">
-        <button type="button" class="btn" id="dp-preview">See what would change</button>
+        <button type="button" class="btn" id="dp-preview-${escapeHtml(String(p.instance_id))}">See what would change</button>
       </div>`;
   }
 
-  // Step two. The version is written into the button's own label and into `previewed`,
-  // so the owner confirms the thing they were shown rather than "the newest", which is a
-  // different act by the time it is resolved.
-  function stepTwoHtml(p) {
+  // Step two. The version is written into the button's own label, and the handler wired
+  // to that button closes over this same preview object — so the owner confirms the thing
+  // they were shown rather than "the newest", which is a different act by the time it is
+  // resolved.
+  function stepTwoHtml(p, isSelf) {
+    const id = escapeHtml(String(p.instance_id));
     return `
-      <div class="ps-controls" id="dp-confirm-wrap">
-        <p class="ov-row__sub">This restarts the platform onto core
+      <div class="ps-controls">
+        <p class="ov-row__sub">This restarts ${isSelf ? 'the platform' : escapeHtml(String(p.slug))} onto core
           <strong>${escapeHtml(String(p.recommended_version))}</strong>. It waits for the box to answer and
           puts itself back on ${escapeHtml(String(p.served_version))} if it does not.</p>
-        <button type="button" class="btn btn--primary" id="dp-confirm">Move to ${escapeHtml(String(p.recommended_version))}</button>
-        <button type="button" class="btn" id="dp-cancel">Cancel</button>
+        <button type="button" class="btn btn--primary" id="dp-confirm-${id}">Move to ${escapeHtml(String(p.recommended_version))}</button>
+        <button type="button" class="btn" id="dp-cancel-${id}">Cancel</button>
       </div>`;
   }
 
-  function panelHtml(p, step) {
-    const rows = [
-      `<li class="ov-row"><div class="ov-row__main">
-         <span class="ov-row__title">Serving now</span>
-         <p class="ov-row__sub">${versionHtml(p.served_version)} — read from the box itself, ${escapeHtml(ago(p.observed_at))}.</p>
-         ${p.reading === 'no_answer'
-           ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
-           : ''}
-       </div></li>`,
-    ];
-    let action = '';
+  // One box's card. `isSelf` only changes the words, never what is offered: the runner
+  // treats the platform's own row and a tenant's identically, and a page that implied
+  // otherwise would be describing a rule that does not exist.
+  function boxHtml(p, isSelf) {
+    const step = steps.get(p.instance_id) || 'preview';
+    let action;
     if (p.open_intent) action = busyHtml(p);
     else if (p.reading === 'no_answer') action = '';
     else if (!p.behind) action = `<p class="ov-row__sub">Nothing newer is published that this box can take. There is nothing to deploy.</p>`;
-    else action = step === 'confirm' ? stepTwoHtml(p) : stepOneHtml(p);
-    rows.push(`<li class="ov-row"><div class="ov-row__main">
-        <span class="ov-row__title">Make it live</span>
+    else action = step === 'confirm' ? stepTwoHtml(p, isSelf) : stepOneHtml(p);
+    return `
+      <li class="ov-row" id="dp-box-${escapeHtml(String(p.instance_id))}"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(p.slug))}${isSelf ? ' — the box this platform runs on' : ''}</span>
+        <p class="ov-row__sub">Serving ${versionHtml(p.served_version)} — read from the box itself, ${escapeHtml(ago(p.observed_at))}.</p>
+        ${p.reading === 'no_answer'
+          ? `<p class="ps-invalid">The box did not answer when the control plane last looked, so this version is unknown rather than unchanged. A move is not offered while that is true.</p>`
+          : ''}
         ${action}
-      </div></li>`);
-    return `<ul class="ov-lines">${rows.join('')}</ul>
-      <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
+      </div></li>`;
+  }
+
+  // A project whose preview could not be read at all. It is LISTED rather than dropped:
+  // a box silently missing from a deploy page reads as a box that does not need
+  // deploying, which is the one wrong impression this page must never give.
+  function unreadableHtml(inst, message) {
+    return `
+      <li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">${escapeHtml(String(inst.slug))}</span>
+        <p class="ps-invalid">Could not read this project's deploy state: ${escapeHtml(message)}</p>
+      </div></li>`;
   }
 
   // ---- wiring --------------------------------------------------------------
 
-  function render(p, step) {
-    previewed = p;
-    $('dp-panel').innerHTML = panelHtml(p, step);
-    const preview = $('dp-preview');
-    if (preview) preview.addEventListener('click', () => render(p, 'confirm'));
-    const cancel = $('dp-cancel');
-    if (cancel) cancel.addEventListener('click', () => render(p, 'preview'));
-    const confirm = $('dp-confirm');
+  function wire(p) {
+    const id = String(p.instance_id);
+    const preview = $(`dp-preview-${id}`);
+    if (preview) preview.addEventListener('click', () => { steps.set(p.instance_id, 'confirm'); repaint(); });
+    const cancel = $(`dp-cancel-${id}`);
+    if (cancel) cancel.addEventListener('click', () => { steps.set(p.instance_id, 'preview'); repaint(); });
+    const confirm = $(`dp-confirm-${id}`);
     if (confirm) confirm.addEventListener('click', () => move(p));
   }
 
+  // What the page is currently showing: the self row (or null), the readable project
+  // previews, and the ones that would not read. Held so a repaint after a click does not
+  // have to re-fetch everything.
+  let view = { self: null, boxes: [], unreadable: [], notEnrolled: null };
+
+  function repaint() {
+    const items = [];
+    if (view.self) items.push(boxHtml(view.self, true));
+    else if (view.notEnrolled) {
+      // The server's own sentence names the one command that fixes it, which is why it
+      // is shown rather than a generic failure line.
+      items.push(`<li class="ov-row"><div class="ov-row__main">
+        <span class="ov-row__title">This platform</span>
+        <p class="ps-invalid">${escapeHtml(view.notEnrolled)}</p>
+      </div></li>`);
+    }
+    for (const p of view.boxes) items.push(boxHtml(p, false));
+    for (const u of view.unreadable) items.push(unreadableHtml(u.inst, u.message));
+    if (!items.length) {
+      items.push(`<li class="ov-row"><div class="ov-row__main">
+        <p class="ov-row__sub">No running box to deploy.</p>
+      </div></li>`);
+    }
+    $('dp-panel').innerHTML = `<ul class="ov-lines">${items.join('')}</ul>
+      <p class="ps-prov">reads the control plane's own observation · ADR 0293 · every move is recorded with who asked</p>`;
+    if (view.self) wire(view.self);
+    for (const p of view.boxes) wire(p);
+  }
+
   async function move(p) {
-    const btn = $('dp-confirm');
+    const btn = $(`dp-confirm-${p.instance_id}`);
     if (btn) { btn.disabled = true; btn.textContent = 'Queueing…'; }
     try {
-      // `p.recommended_version` — the version this owner was SHOWN, not whatever is
-      // newest at the moment of the click.
+      // `p.recommended_version` — the version this owner was SHOWN for THIS box, not
+      // whatever is newest at the moment of the click.
       const r = await sendJson('POST', `/provisioning/instances/${p.instance_id}/core-upgrade`, { to: p.recommended_version });
       toast(r.message || 'Queued.');
-      await load();
+      await refreshOne(p);
     } catch (e) {
       if (e && e.kind === '401') return;
       toast(e.message || 'Could not queue the move.');
@@ -162,12 +218,90 @@
     }
   }
 
+  // Re-read ONLY the box that just changed. The full load() fans out one probe per
+  // hosted project, and firing all of them to refresh one row is cache invalidation
+  // far wider than the change — it also re-probes boxes the owner never touched. A
+  // failure here falls back to the full read, because a stale row on a deploy page is
+  // the one thing worse than an extra request.
+  async function refreshOne(p) {
+    const id = String(p.instance_id);
+    const isSelf = view.self && String(view.self.instance_id) === id;
+    try {
+      const d = await fetchJson(isSelf ? '/provisioning/control-plane' : `/provisioning/instances/${id}/core-upgrade`);
+      if (isSelf) view.self = d.preview;
+      else view.boxes = view.boxes.map((b) => (String(b.instance_id) === id ? d.preview : b));
+      steps.set(p.instance_id, 'preview');
+      repaint();
+    } catch (e) {
+      if (e && e.kind === '401') return;
+      await load();
+    }
+  }
+
+  // The projects this control plane hosts. `/provisioning/fleet` is the whole roster and
+  // needs its own atom; a holder of core.pin.move who lacks it still gets their OWN
+  // projects rather than an error, because the pin move itself is gated server-side per
+  // instance either way — this choice only decides what the page can LIST.
+  async function hostedProjects() {
+    try {
+      const d = await fetchJson('/provisioning/fleet');
+      return d.instances || [];
+    } catch (e) {
+      if (e && e.kind === '403') {
+        const d = await fetchJson('/provisioning/instances');
+        return d.instances || [];
+      }
+      throw e;
+    }
+  }
+
+  // Only a RUNNING box can have its pin moved, and the runner refuses every other shape.
+  // Filtering here keeps torn-down rows — there are far more of them than live ones — off
+  // a page whose whole job is naming what is live.
+  const UPGRADEABLE = new Set(['standalone', 'co-tenant']);
+  const isLive = (i) => i && i.status === 'active' && UPGRADEABLE.has(i.hosting_shape);
+
   async function load() {
     try {
-      const d = await fetchJson('/provisioning/control-plane');
-      $('dp-sub').textContent = `${d.preview.slug} — the box this platform runs on`;
+      let self = null;
+      let notEnrolled = null;
+      try {
+        const d = await fetchJson('/provisioning/control-plane');
+        self = d.preview;
+      } catch (e) {
+        if (e && e.kind === '401') return;
+        if (e && e.kind === '403') throw e;
+        notEnrolled = e.message || 'This platform has no deploy door yet.';
+      }
+
+      const live = (await hostedProjects()).filter(isLive);
+      // One preview per project, in parallel and INDEPENDENTLY: one project that cannot
+      // be read must not blank the page for the others. The request count scales with the
+      // fleet, which is deliberate and bounded — each is a cached server-side reading, not
+      // a live probe of the box, and this page exists precisely to show every box's state
+      // at once. It is re-read on OPEN only; a move refreshes just its own row.
+      const settled = await Promise.all(live.map(async (inst) => {
+        try {
+          const d = await fetchJson(`/provisioning/instances/${inst.id}/core-upgrade`);
+          return { ok: true, preview: d.preview };
+        } catch (e) {
+          if (e && e.kind === '401') return { ok: false, inst, message: 'not signed in' };
+          return { ok: false, inst, message: (e && e.message) || 'unknown error' };
+        }
+      }));
+
+      view = {
+        self,
+        notEnrolled,
+        boxes: settled.filter((s) => s.ok).map((s) => s.preview),
+        unreadable: settled.filter((s) => !s.ok).map((s) => ({ inst: s.inst, message: s.message })),
+      };
+      const n = view.boxes.length + view.unreadable.length;
+      $('dp-sub').textContent = n
+        ? `This platform and ${n} hosted project${n === 1 ? '' : 's'}`
+        : 'This platform';
       $('dp-body').hidden = false;
-      render(d.preview, 'preview');
+      repaint();
     } catch (e) {
       if (e && e.kind === '401') return;
       if (e && e.kind === '403') {
@@ -175,9 +309,6 @@
         $('dp-sub').textContent = 'Restricted';
         return;
       }
-      // Including 'control_plane_not_enrolled', whose message names the one command
-      // that fixes it — which is why the server's sentence is shown rather than a
-      // generic failure line.
       $('dp-body').hidden = false;
       $('dp-sub').textContent = 'Unavailable';
       $('dp-panel').innerHTML = `<p class="ps-invalid">${escapeHtml(e.message || 'Could not read the deploy state.')}</p>`;

package/modules/hall-ui/public/gate.html

@@ -43,6 +43,19 @@
                with a verdict band along its top is gone (task 1003469). -->
           <div class="stat-row ov-summary" id="gate-summary" aria-label="Held changes summary"></div>
 
+          <!-- The Autobongos fence (task 1003908, ADR 0307 §6). It lives on THIS
+               page because the Gate is already the owner's protected-surface
+               surface, and because the switch and the held PRs answer the same
+               question from two ends: what is allowed to reach main unattended.
+               Archon-only — the panel stays hidden for a Metic, and the routes
+               behind it are system:true/archon server-side regardless. -->
+          <section class="scroll" id="fence-panel" aria-labelledby="fence-h" hidden>
+            <h2 class="scroll__h" id="fence-h">Autobongos runner</h2>
+            <p class="scroll__lede">The unattended runner works only the goals listed here, and only while it is on. This is the switch — it lives on the server, so the machine can read it and cannot change it.</p>
+            <div id="fence-state"><span class="kit-skel"></span></div>
+            <div id="fence-goals"></div>
+          </section>
+
           <section class="scroll" aria-labelledby="gate-list-h">
             <h2 class="scroll__h" id="gate-list-h">Held pull requests</h2>
             <p class="scroll__lede">Each one touched a protected surface and stopped at the gate check. Approving records your seal on that commit and re-runs the check.</p>
@@ -65,6 +78,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/gate.js?v=2026-09-02-gate-rows"></script>
+<script src="/builders/gate.js?v=2026-09-19-fence"></script>
 </body>
 </html>

package/modules/hall-ui/public/gate.js

@@ -39,10 +39,25 @@
     const res = await api.request(method, `${API}${path}`, { body: body || {} });
     if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
     const data = res.data || {};
-    if (!res.ok) throw new Error(data.message || data.error || `${path} → ${res.status}`);
+    if (!res.ok) throw new Error(errorText(data, path, res.status));
     return data;
   }
 
+  // errorText — the readable half of a failed write.
+  //
+  // `data.error` is the ADR 0116 envelope, an OBJECT of { code, message }, so the
+  // old `data.message || data.error` fell through to it and produced the literal
+  // string "[object Object]" in the toast. Caught rendering this page against a
+  // 501 (task 1003908) — the button reported a failure the operator could not read,
+  // which is barely better than reporting nothing.
+  function errorText(data, path, status) {
+    const env = data && data.error;
+    if (env && typeof env === 'object' && typeof env.message === 'string') return env.message;
+    if (typeof env === 'string') return env;
+    if (typeof data?.message === 'string') return data.message;
+    return `${path} → ${status}`;
+  }
+
   // ---- formatters ----------------------------------------------------------
 
   const shortSha = (s) => (typeof s === 'string' ? s.slice(0, 7) : '');
@@ -222,6 +237,103 @@
     if (body) body.textContent = `Available from the ${rankLabel('metic')} rank up.`;
   }
 
+  // ---- the Autobongos fence (task 1003908, ADR 0307 §6) --------------------
+  //
+  // The kill switch and the goal allowlist for the unattended runner. On this page
+  // because the Gate is already where the owner decides what reaches main without
+  // a person in the loop; the held-PR list and this panel are the same question
+  // from two ends.
+  //
+  // ARCHON ONLY, and the panel simply is not rendered for anyone else. That is
+  // cosmetic: POST /autonomy/fence and the two allowlist routes carry
+  // `autonomy.fence.manage`, which the catalog declares system:true + archon, so
+  // it cannot be granted to a custom rank. The wall is the server's.
+
+  function renderFenceState(fence) {
+    const on = fence.enabled === true;
+    const el = document.getElementById('fence-state');
+    el.innerHTML = `
+      <div class="ov-foot" style="display:flex;align-items:center;gap:12px;flex-wrap:wrap;">
+        <strong>${on ? 'Running' : 'Stopped'}</strong>
+        <span>${on ? 'The runner may claim and work allowlisted goals.' : escapeHtml(fence.paused_reason || 'The runner is doing nothing.')}</span>
+        <button type="button" id="fence-toggle" class="btn">${on ? 'Stop the runner' : 'Start the runner'}</button>
+      </div>`;
+    document.getElementById('fence-toggle').addEventListener('click', async () => {
+      // Turning it OFF asks why. Stopping an unattended machine is the kind of act
+      // someone reconstructs weeks later, and "halted" answers none of their
+      // questions. Turning it ON needs no reason — the allowlist already is one.
+      let reason = null;
+      if (on) {
+        reason = window.prompt('Why are you stopping the runner? (shown to anyone who asks why it is idle)');
+        if (reason === null) return;   // cancelled — not the same as an empty reason
+      }
+      try {
+        await sendJson('POST', '/autonomy/fence', { enabled: !on, reason: reason || undefined });
+        toast(on ? 'Runner stopped.' : 'Runner started.');
+        await loadFence();
+      } catch (err) { toast(err.message || 'Could not change the switch.'); }
+    });
+  }
+
+  function renderFenceGoals(goals) {
+    const el = document.getElementById('fence-goals');
+    const rows = (goals || []).map((g) => `
+      <li class="ov-row" style="display:flex;align-items:center;gap:12px;">
+        <a href="/builders#/goal/${encodeURIComponent(g.goal_id)}">Goal ${escapeHtml(String(g.goal_id))}</a>
+        <span style="flex:1;">${escapeHtml(g.note || '')}</span>
+        <button type="button" class="btn" data-revoke="${escapeHtml(String(g.goal_id))}">Remove</button>
+      </li>`).join('');
+    el.innerHTML = `
+      <h3 class="scroll__h" style="font-size:1rem;">Allowlisted goals</h3>
+      ${goals && goals.length ? `<ul class="ov-rows">${rows}</ul>`
+        : emptyStateHtml('No goal is allowlisted, so the runner has nothing it may work on.')}
+      <form id="fence-add" class="ov-foot" style="display:flex;gap:8px;align-items:center;margin-top:12px;">
+        <label for="fence-goal-id">Allow goal</label>
+        <input type="number" id="fence-goal-id" min="1" step="1" required placeholder="1000119">
+        <input type="text" id="fence-goal-note" maxlength="500" placeholder="why (optional)">
+        <button type="submit" class="btn">Add</button>
+      </form>`;
+
+    document.getElementById('fence-add').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      const goalId = Number(document.getElementById('fence-goal-id').value);
+      if (!Number.isSafeInteger(goalId) || goalId <= 0) { toast('Enter a goal number.'); return; }
+      try {
+        await sendJson('POST', '/autonomy/fence/goals', { goal_id: goalId, note: document.getElementById('fence-goal-note').value || undefined });
+        toast(`Goal ${goalId} allowlisted.`);
+        await loadFence();
+      } catch (err) { toast(err.message || 'Could not add that goal.'); }
+    });
+
+    for (const btn of el.querySelectorAll('[data-revoke]')) {
+      btn.addEventListener('click', async () => {
+        const goalId = btn.getAttribute('data-revoke');
+        try {
+          await sendJson('DELETE', `/autonomy/fence/goals/${encodeURIComponent(goalId)}`);
+          toast(`Goal ${goalId} removed.`);
+          await loadFence();
+        } catch (err) { toast(err.message || 'Could not remove that goal.'); }
+      });
+    }
+  }
+
+  async function loadFence() {
+    let fence;
+    try {
+      fence = await fetchJson('/autonomy/fence');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      // A fence the HALL cannot read is only a rendering problem — the RUNNER
+      // reads it separately and refuses on the same failure. Say so plainly rather
+      // than showing a switch whose position is a guess.
+      document.getElementById('fence-state').innerHTML = emptyStateHtml('Could not read the runner switch just now.');
+      document.getElementById('fence-goals').innerHTML = '';
+      return;
+    }
+    renderFenceState(fence);
+    renderFenceGoals(fence.goals);
+  }
+
   async function init() {
     // Confirm the viewer's rank for a friendly sealed notice; the server gates the page
     // + every endpoint regardless (cosmetic defence-in-depth).
@@ -242,6 +354,10 @@
 
     document.getElementById('gate-sub').textContent = 'Changes touching protected build surfaces, held for your approval.';
     document.getElementById('gate-body').hidden = false;
+    if (rank === 'archon') {
+      document.getElementById('fence-panel').hidden = false;
+      await loadFence();
+    }
     await load();
   }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.873",
+  "version": "1.19.875",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.873",
+      "version": "1.19.875",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.873",
+  "version": "1.19.875",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",