@bongos/core 1.19.874 → 1.19.876

package/modules/autonomy/db.js

@@ -44,7 +44,81 @@ async function lastAutonomyHead(routine) {
   return rows[0]?.head_sha || null;
 }
 
+// ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
+//
+// These back the one control surface the runner host cannot write to. Everything
+// here is deliberately dumb — a SELECT and three small writes — because the
+// decision logic is pure and lives in ../fence.js; a query that made a judgement
+// would put half the fence somewhere no test can reach without a database.
+
+// readFence — the kill switch and the allowlist, in one round trip.
+//
+// The singleton row is SEEDED by the migration, so a missing row means the
+// migration has not run, not "not configured yet". Returning null for that makes
+// it unreadable to the caller, which refuses — never a permissive default.
+async function readFence() {
+  const [fence, goals] = await Promise.all([
+    pool.query('SELECT enabled, paused_reason, updated_at, updated_by FROM autonomy_fence WHERE id = 1'),
+    pool.query('SELECT goal_id, note, added_at, added_by FROM autonomy_allowed_goals ORDER BY added_at DESC'),
+  ]);
+  const row = fence.rows[0];
+  if (!row) return null;
+  return {
+    enabled: row.enabled === true,
+    paused_reason: row.paused_reason,
+    updated_at: row.updated_at,
+    updated_by: row.updated_by ? String(row.updated_by) : null,
+    // goal_id is a bigint, which node-postgres hands back as a STRING. The runner
+    // compares it against a task's goal_id, so normalise here rather than leaving
+    // every caller to remember — a '1000119' !== 1000119 mismatch would silently
+    // empty the allowlist and read as "nothing to work on".
+    goals: goals.rows.map((g) => ({
+      goal_id: Number(g.goal_id), note: g.note, added_at: g.added_at,
+      added_by: g.added_by ? String(g.added_by) : null,
+    })),
+  };
+}
+
+// setFenceEnabled — throw the kill switch. The reason is stored on the OFF case
+// so a stopped machine can say who stopped it and why, which "halted" cannot.
+async function setFenceEnabled({ enabled, reason = null, builderId = null }) {
+  const { rows } = await pool.query(
+    `UPDATE autonomy_fence
+        SET enabled = $1, paused_reason = $2, updated_at = now(), updated_by = $3
+      WHERE id = 1
+      RETURNING enabled, paused_reason, updated_at`,
+    [enabled === true, enabled === true ? null : (reason || 'stopped by an owner'), builderId]
+  );
+  return rows[0] || null;
+}
+
+// allowGoal — put a goal on the allowlist. Idempotent: re-adding an allowed goal
+// updates its note rather than erroring, so the hall's form has no special case.
+async function allowGoal({ goalId, note = null, builderId = null }) {
+  const { rows } = await pool.query(
+    `INSERT INTO autonomy_allowed_goals (goal_id, note, added_by)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (goal_id) DO UPDATE SET note = EXCLUDED.note
+     RETURNING goal_id, note, added_at`,
+    [goalId, note, builderId]
+  );
+  const r = rows[0];
+  return r ? { ...r, goal_id: Number(r.goal_id) } : null;
+}
+
+// disallowGoal — take a goal off the allowlist. `removed` says whether a row
+// actually went, because "already gone" and "just revoked" are different answers
+// to an owner clicking Remove.
+async function disallowGoal(goalId) {
+  const { rowCount } = await pool.query('DELETE FROM autonomy_allowed_goals WHERE goal_id = $1', [goalId]);
+  return { removed: rowCount > 0 };
+}
+
 module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
+  readFence,
+  setFenceEnabled,
+  allowGoal,
+  disallowGoal,
 };

package/modules/autonomy/fence.js

@@ -0,0 +1,172 @@
+'use strict';
+
+// modules/autonomy/fence.js — what an unattended runner is allowed to touch
+// (task 1003908, ADR 0307 §6). Pure: no I/O, no clock, no pool. The caller reads
+// the facts and hands them in; this decides.
+//
+// FOUR GATES, and they are four because each fails in a different direction.
+//
+//   1. THE KILL SWITCH. A boolean in the database, flipped from the hall. Not a
+//      file and not an env var on the runner host: the premise of this whole
+//      system is a machine nobody is watching, running a worker with blanket
+//      bypassPermissions. Anything that machine can WRITE, the worker can write
+//      too, and a stop button the thing being stopped can press is not a stop
+//      button. So the switch lives where the machine can only read it.
+//
+//   2. THE ALLOWLIST. Which goals a worker may be spawned against, also in the
+//      database. `--goal` / AUTOBONGOS_GOALS survive as a NARROWING filter for an
+//      operator running one goal by hand, and they can only ever take goals AWAY
+//      from the allowlist — a machine-local setting must not be able to add one.
+//
+//   3. PROTECTED PATHS. The ADR 0043 registry, reused rather than re-derived.
+//      This is the honest half of the gate and the header says so: it reads the
+//      task's DECLARED `touches[]`, which is a claim by whoever filed the task,
+//      not a fact about what the work will edit. A task with `touches: []` clears
+//      it trivially. That is acceptable ONLY because it is the outer of three
+//      layers — the grader's permission-path pre-pass and the post-push main
+//      audit both read the REAL diff, server-side, where the machine cannot
+//      reach. Treating this layer as sufficient on its own would be the bug.
+//
+//   4. THE GRADER. The runner holds no push credential (ADR 0055), so the only
+//      road to main is the server-mediated ship and its server-side grade — which
+//      makes that grade the ONLY review standing between an unattended worker and
+//      main. When it is bypassed, the correct response is to STOP, not to ship
+//      unreviewed. This is the one gate whose failure mode is "everything still
+//      works, and nothing is being checked", which is why it is explicit.
+//
+// UNREADABLE IS NOT PERMITTED. Every gate fails CLOSED: a fence row that cannot
+// be read, a malformed allowlist, an unknown grader state all refuse. This is the
+// opposite of the gauge's neighbour rule (`modules/autonomy/gauge.js` holds when
+// it cannot vouch for a reading) only in wording — both say the same thing. A
+// machine that cannot prove it is allowed to act does not act.
+
+// The refusal vocabulary. Fixed strings, because the run log, the digest and any
+// future alert all key on them; free-text reasons ride alongside.
+const REFUSALS = {
+  fence_unreadable: 'the fence could not be read, so nothing is permitted',
+  kill_switch: 'the kill switch is off — an owner stopped the runner',
+  no_allowlist: 'no goal is allowlisted, so there is nothing this runner may work on',
+  goal_not_allowlisted: 'that goal is not on the allowlist',
+  protected_path: 'the task declares work on a permission, migration, infrastructure or deploy-pipeline surface',
+  grader_unavailable: 'the grader is bypassed, and it is the only review between an unattended worker and main',
+};
+
+// normaliseFence — turn whatever the route returned into something decidable, or
+// null for "unreadable". Deliberately strict: a shape this does not recognise is
+// unreadable, never a permissive default.
+function normaliseFence(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  // `enabled` is the ONE field that makes a fence readable: without a trustworthy
+  // boolean there is no answer to "am I allowed to run", and the honest report is
+  // that the fence could not be read.
+  if (typeof raw.enabled !== 'boolean') return null;
+  // A missing or malformed goals list is NOT unreadable — it degrades to an EMPTY
+  // allowlist, which is the most restrictive reading available and refuses just as
+  // hard. The difference is what the operator is told: a thrown kill switch should
+  // always be reported as a thrown kill switch, never buried under "unreadable"
+  // because a list beside it was the wrong shape.
+  const goals = Array.isArray(raw.goals) ? raw.goals : [];
+  const ids = [];
+  for (const g of goals) {
+    // A goal row may be a bare id or { goal_id }. Anything that is not a positive
+    // integer is DROPPED rather than coerced — Number('') is 0, and a 0 sitting
+    // in an allowlist is a goal id nobody meant to grant.
+    const n = Number(typeof g === 'object' && g !== null ? g.goal_id : g);
+    if (Number.isSafeInteger(n) && n > 0) ids.push(n);
+  }
+  return {
+    enabled: raw.enabled === true,
+    pausedReason: typeof raw.paused_reason === 'string' ? raw.paused_reason : null,
+    goals: ids,
+  };
+}
+
+// allowedGoals — the goals this run may work, given the fence and whatever the
+// operator asked for on the command line.
+//
+// The INTERSECTION is the point. `requested` can only narrow: a goal the operator
+// named that the database does not allow is dropped, and reported, rather than
+// honoured. The runner host is not a place authority can come from.
+function allowedGoals(fence, requested = []) {
+  const allowed = new Set(fence.goals);
+  const asked = (requested || []).map((g) => Number(g)).filter((n) => Number.isSafeInteger(n) && n > 0);
+  if (!asked.length) return { goals: fence.goals.slice(), refused: [] };
+  return {
+    goals: asked.filter((g) => allowed.has(g)),
+    refused: asked.filter((g) => !allowed.has(g)),
+  };
+}
+
+// decideRun — may this runner start an iteration at all?
+//
+// Called BEFORE the gauge and before anything is picked, because three of these
+// four conditions make every task refusable and there is no sense costing a
+// capacity read to discover it. `graderBypassed` comes from GET /me's
+// `grader_bypass` (ADR 0041's global killswitch, resolved server-side); `null`
+// means it could not be read, which is not the same as `false` and must not be
+// treated as one.
+function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null } = {}) {
+  const fence = normaliseFence(rawFence);
+  if (!fence) return { go: false, code: 'fence_unreadable', reason: REFUSALS.fence_unreadable, goals: [] };
+
+  if (!fence.enabled) {
+    return {
+      go: false, code: 'kill_switch', goals: [],
+      reason: fence.pausedReason ? `${REFUSALS.kill_switch}: ${fence.pausedReason}` : REFUSALS.kill_switch,
+    };
+  }
+
+  // `true` and `null` both refuse. An unknown grader state is an unreviewed ship
+  // waiting to happen, and the fail direction here is to stop.
+  if (graderBypassed !== false) {
+    return {
+      go: false, code: 'grader_unavailable', goals: [],
+      reason: graderBypassed === null
+        ? 'could not read whether the grader is available — refusing rather than shipping unreviewed'
+        : REFUSALS.grader_unavailable,
+    };
+  }
+
+  const { goals, refused } = allowedGoals(fence, requestedGoals);
+  if (!goals.length) {
+    return {
+      go: false, goals: [], refusedGoals: refused,
+      code: refused.length ? 'goal_not_allowlisted' : 'no_allowlist',
+      reason: refused.length
+        ? `${REFUSALS.goal_not_allowlisted} (asked for ${refused.join(', ')})`
+        : REFUSALS.no_allowlist,
+    };
+  }
+  return { go: true, goals, refusedGoals: refused, code: null, reason: null };
+}
+
+// decideTask — may THIS task be handed to an unattended worker?
+//
+// `protectedHits` is the output of the ADR 0043 registry matcher run over the
+// task's declared touches[], injected so this file stays pure — the matcher lives
+// in core and a module reaches core only through the doorway. Passing the hits in
+// also means the caller decides WHAT to match, which is what lets a future caller
+// run the same decision over a real diff instead of a declaration.
+function decideTask({ task, goals = [], protectedHits = [] } = {}) {
+  if (!task || task.id === undefined || task.id === null) {
+    return { go: false, code: 'fence_unreadable', reason: 'no task to decide about' };
+  }
+  const goalId = Number(task.goal_id);
+  if (!goals.map(Number).includes(goalId)) {
+    return {
+      go: false, code: 'goal_not_allowlisted',
+      reason: `${REFUSALS.goal_not_allowlisted} (task ${task.id} is in goal ${task.goal_id ?? 'none'})`,
+    };
+  }
+  if (Array.isArray(protectedHits) && protectedHits.length) {
+    const globs = [...new Set(protectedHits.map((h) => h && h.glob).filter(Boolean))];
+    return {
+      go: false, code: 'protected_path',
+      reason: `${REFUSALS.protected_path}${globs.length ? ` (${globs.join(', ')})` : ''}`,
+      globs,
+    };
+  }
+  return { go: true, code: null, reason: null };
+}
+
+module.exports = { REFUSALS, normaliseFence, allowedGoals, decideRun, decideTask };

package/modules/autonomy/migrations/autonomy_001_autobongos_fence.sql

@@ -0,0 +1,71 @@
+-- autonomy_001_autonomy_fence.sql — the Autobongos fence (task 1003908, ADR 0307 §6).
+--
+-- WHY THIS IS A TABLE AND NOT A FILE. The Autobongos runner is a program on an
+-- always-on Windows PC that nobody is watching. Its allowlist — which goals a
+-- worker may be spawned against — cannot live in a file on that machine, because
+-- a file there is editable by anything running there, including the very
+-- bypassPermissions worker the allowlist exists to bound. The owner's control
+-- has to sit somewhere the machine can READ and cannot WRITE. That is the
+-- server, behind an archon-gated route, which is what these two tables back.
+--
+-- THE DEFAULT IS OFF, and that is the whole safety argument. `enabled` defaults
+-- to FALSE and the allowlist starts EMPTY, so a fresh instance that installs this
+-- module gets a runner that refuses to do anything until a person deliberately
+-- turns it on and names a goal. An allowlist that defaults to "everything" would
+-- make the fence a formality the first time someone forgot to configure it.
+--
+-- ONE ROW, ENFORCED. autonomy_fence is a singleton (id smallint PRIMARY KEY
+-- CHECK (id = 1)): a second row would mean two kill switches and no way to say
+-- which one is live, which is the failure mode of every "settings table" that
+-- forgot to pin its cardinality. The row is seeded here so every read is a plain
+-- SELECT that cannot come back empty and be mistaken for "not configured yet" —
+-- an empty read and a disabled fence must not look alike to a machine.
+--
+-- NO FOREIGN KEY ON goal_id, deliberately. A goal deleted out from under the
+-- allowlist must leave a row that reads as "this goal is allowed and does not
+-- exist" rather than silently removing the fence entry — the runner refuses a
+-- goal it cannot fetch anyway (it halts on the fetch), and a CASCADE here would
+-- turn a deletion into a silent widening of nothing into nothing. The cost is a
+-- stale row the hall can show and an owner can clear.
+--
+-- Module migrations are ADDITIVE and NAMESPACED (ADR 0083 §Decision #5): every
+-- object is autonomy_-prefixed (fitness.js refuses an autobongos_ name here, and it
+-- is right to: the table belongs to the MODULE, not to the feature), there is
+-- no down-migration, and the filename is autonomy_-prefixed (ADR 0108 §5).
+-- Idempotent: safe to re-run.
+
+BEGIN;
+
+-- The kill switch, and the reason it was thrown. One row, forever.
+CREATE TABLE IF NOT EXISTS autonomy_fence (
+  id            smallint PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  -- FALSE = the runner does no work. Default off (see the header).
+  enabled       boolean NOT NULL DEFAULT false,
+  -- Why it is off. Free text, shown in the hall and printed by the runner so a
+  -- machine that stopped can say WHO stopped it and why, not just "halted".
+  paused_reason text,
+  updated_at    timestamptz NOT NULL DEFAULT now(),
+  updated_by    bigint
+);
+
+-- Seed the singleton so a read can never be empty. ON CONFLICT keeps a re-run
+-- from resetting a live instance's switch back to off.
+INSERT INTO autonomy_fence (id, enabled, paused_reason)
+VALUES (1, false, 'never enabled — no one has turned the runner on yet')
+ON CONFLICT (id) DO NOTHING;
+
+-- The allowlist. A goal is claimable by an unattended worker only if it is here.
+CREATE TABLE IF NOT EXISTS autonomy_allowed_goals (
+  goal_id   bigint PRIMARY KEY,
+  note      text,
+  added_at  timestamptz NOT NULL DEFAULT now(),
+  added_by  bigint
+);
+
+-- The runner's read is "every allowed goal", newest first for the hall's list.
+-- Small table by design (a handful of goals), so this index is for the ordering,
+-- not the lookup — the lookup is the primary key.
+CREATE INDEX IF NOT EXISTS autonomy_allowed_goals_added_idx
+  ON autonomy_allowed_goals (added_at DESC);
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -27,6 +27,11 @@ const auth = api;
 // from OUTSIDE the kernel boundary, which a modules/ file may not do). scripts/ is
 // neither core internals nor a sibling module, so importing it here is allowed.
 const autonomyGate = require('../../../scripts/gds/autonomy-gate');
+const db = require('../db');
+// The doorway's namespaced logger and strict body validator. Raw console.* is
+// ratcheted repo-wide (fitness.js console_call_count) and unstructured besides.
+const log = api.logger('autonomy');
+const { validateOrRespond } = api;
 
 // System 3 (task 1351): the autonomy precheck over HTTP. The deterministic
 // decision logic lives in scripts/gds/autonomy-gate.js (run directly as a CLI
@@ -52,5 +57,91 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
+  //
+  // These four routes ARE the fence. Everything the unattended runner is allowed
+  // to do is decided by rows only these can write, on a server the runner host
+  // cannot reach — that separation is the entire safety argument, so read the
+  // rank gates below as load-bearing rather than boilerplate.
+
+  // The runner's own read, every iteration. ANY-BUILDER on purpose: learning that
+  // you must stop should never require an elevated session, because the failure
+  // mode of "could not read the fence" is a machine that keeps going. The body
+  // carries no secret — it is a boolean, a reason string and a list of goal ids.
+  router.get('/autonomy/fence', auth.requireBuilder, async (req, res) => {
+    try {
+      const fence = await db.readFence();
+      // Null means the singleton row is missing, i.e. the migration has not run.
+      // Say so rather than synthesising a default: a fabricated { enabled: false }
+      // is indistinguishable from a real one, and an operator would chase a kill
+      // switch nobody threw.
+      if (!fence) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      res.json(fence);
+    } catch (err) {
+      log.error('[gds] GET /autonomy/fence', err);
+      // FAIL CLOSED, unlike the precheck above. That one is fail-open because an
+      // autonomy gate must never become a new way to break a routine; this one is
+      // the opposite question — an unreadable fence must never read as permission.
+      res.fail('fence_unreadable', { status: 503, message: 'could not read the autonomy fence' });
+    }
+  });
+
+  // The kill switch. Archon, system:true — see the catalog entry for why it is the
+  // one permission that cannot be delegated to a custom rank.
+  router.post('/autonomy/fence', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      enabled: { required: true, type: 'boolean' },
+      reason: { type: 'string', maxLength: 500 },
+    })) return;
+    const body = req.body || {};
+    const reason = typeof body.reason === 'string' ? body.reason : null;
+    try {
+      const row = await db.setFenceEnabled({ enabled: body.enabled, reason, builderId: req.builder.id });
+      if (!row) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      // Logged at info, always. Throwing this switch is the single most consequential
+      // thing anyone does to the unattended runner, and an ops surface that changes
+      // silently is one nobody can reconstruct afterwards.
+      log.info(`[gds] autonomy fence ${body.enabled ? 'ENABLED' : 'DISABLED'} by builder ${req.builder.id} (${req.builder.rank})${reason ? `: ${reason}` : ''}`);
+      res.json(row);
+    } catch (err) {
+      log.error('[gds] POST /autonomy/fence', err);
+      res.fail('fence_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // Add a goal to the allowlist.
+  router.post('/autonomy/fence/goals', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      goal_id: { required: true },   // number or stringified number; coerced below
+      note: { type: 'string', maxLength: 500 },
+    })) return;
+    const goalId = Number(req.body?.goal_id);
+    if (!Number.isSafeInteger(goalId) || goalId <= 0) return res.fail('goal_id_required', { status: 400, message: 'pass { "goal_id": <number> }' });
+    const note = typeof req.body?.note === 'string' ? req.body.note : null;
+    try {
+      const row = await db.allowGoal({ goalId, note, builderId: req.builder.id });
+      log.info(`[gds] autonomy fence: goal ${goalId} ALLOWED by builder ${req.builder.id} (${req.builder.rank})`);
+      res.status(201).json({ goal: row });
+    } catch (err) {
+      log.error('[gds] POST /autonomy/fence/goals', err);
+      res.fail('allow_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // Revoke one. `removed` distinguishes "just revoked" from "already gone" — an
+  // owner clicking Remove deserves to know which happened.
+  router.delete('/autonomy/fence/goals/:goalId', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    const goalId = Number(req.params.goalId);
+    if (!Number.isSafeInteger(goalId) || goalId <= 0) return res.fail('bad_goal_id', 400);
+    try {
+      const out = await db.disallowGoal(goalId);
+      log.info(`[gds] autonomy fence: goal ${goalId} REVOKED by builder ${req.builder.id} (${req.builder.rank}) — removed=${out.removed}`);
+      res.json(out);
+    } catch (err) {
+      log.error('[gds] DELETE /autonomy/fence/goals/:goalId', err);
+      res.fail('revoke_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -172,6 +172,14 @@ function createClient(opts = {}) {
       getAuthWebStart: (args) => request("GET", "/auth/web/start", { hasBody: false }, args),
     },
     "autonomy": {
+      // GET /autonomy/fence — rank: any-builder — GET /autonomy/fence
+      getAutonomyFence: (args) => request("GET", "/autonomy/fence", { hasBody: false }, args),
+      // POST /autonomy/fence — rank: archon — POST /autonomy/fence
+      postAutonomyFence: (args) => request("POST", "/autonomy/fence", { hasBody: true }, args),
+      // POST /autonomy/fence/goals — rank: archon — POST /autonomy/fence/goals
+      postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
+      // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
+      deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
     },

package/modules/government/catalog.js

@@ -109,6 +109,17 @@ const PERMISSIONS = [
   // so this cannot be delegated downward by a custom rank. The web tier still gains
   // no shell - the route only QUEUES an intent the control-plane runner drains.
   { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293)' },
+  // autonomy.fence.manage (task 1003908, ADR 0307 §6) — THE AUTOBONGOS KILL
+  // SWITCH and the allowlist of goals an unattended runner may work. system:true
+  // + archon for core.pin.move's reason, in a slightly sharper form: this decides
+  // whether a machine nobody is watching spawns sessions with blanket
+  // bypassPermissions against the repo. The catalog's own invariant forbids
+  // granting a system key to metic, so it cannot be delegated downward by a custom
+  // rank — which is the property that makes it a stop button rather than a
+  // suggestion. Deliberately NOT paired with a read permission: seeing whether the
+  // runner is on is harmless, and GET /autonomy/fence is any-builder so the runner
+  // itself does not need an elevated session merely to learn it must stop.
+  { key: 'autonomy.fence.manage', system: true, floor: 'archon', guards: 'POST /autonomy/fence (the kill switch), POST|DELETE /autonomy/fence/goals (the allowlist) — the Autobongos fence (ADR 0307 §6)' },
   // BV1.R21 (task 1003608, goal 1000086). ADR 0250 §6 amends ADR 0157 for exactly
   // this key: `version.create` returns to the Archon floor.
   //

package/modules/government/migrations/government_016_autonomy_fence_manage.sql

@@ -0,0 +1,37 @@
+-- government_016_autonomy_fence_manage.sql — grant the new `autonomy.fence.manage`
+-- atom to the Archon (task 1003908, ADR 0307 §6).
+--
+-- WHAT IT IS. The Autobongos kill switch and the allowlist of goals an unattended
+-- runner may work. The runner is a program on an always-on machine that spawns
+-- Claude sessions with blanket bypassPermissions; this key gates the only surface
+-- that can stop it or change what it is allowed to touch.
+--
+-- ARCHON ONLY, one block. The catalog declares the key `system: true, floor:
+-- 'archon'` — the same shape as `core.pin.move` (government_014) and for a sharper
+-- version of its reason. A stop button the thing being stopped can be granted the
+-- power to press is not a stop button, and the catalog's own invariant (a system
+-- key is never grantable below its floor) is what makes that structural rather
+-- than a convention. So there is no metic rung here, deliberately: adding one
+-- would be the whole safety property, undone quietly in a migration.
+--
+-- WHY THIS FILE EXISTS AT ALL. RANK_SEED is derived from the catalog's floors, and
+-- the drift guard (tests/government_seed.mjs) compares it against the UNION of the
+-- run-once seed plus every later grant migration, per rank. Minting the catalog row
+-- without this migration leaves the Archon holding the key on paper and not in the
+-- database — which is exactly what that guard catches, and it did.
+--
+-- Additive only: one new permission key granted to one rank; nothing is revoked.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally, and a combined form parses as zero grants and reds it.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'autonomy.fence.manage'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/gate.html

@@ -43,6 +43,19 @@
                with a verdict band along its top is gone (task 1003469). -->
           <div class="stat-row ov-summary" id="gate-summary" aria-label="Held changes summary"></div>
 
+          <!-- The Autobongos fence (task 1003908, ADR 0307 §6). It lives on THIS
+               page because the Gate is already the owner's protected-surface
+               surface, and because the switch and the held PRs answer the same
+               question from two ends: what is allowed to reach main unattended.
+               Archon-only — the panel stays hidden for a Metic, and the routes
+               behind it are system:true/archon server-side regardless. -->
+          <section class="scroll" id="fence-panel" aria-labelledby="fence-h" hidden>
+            <h2 class="scroll__h" id="fence-h">Autobongos runner</h2>
+            <p class="scroll__lede">The unattended runner works only the goals listed here, and only while it is on. This is the switch — it lives on the server, so the machine can read it and cannot change it.</p>
+            <div id="fence-state"><span class="kit-skel"></span></div>
+            <div id="fence-goals"></div>
+          </section>
+
           <section class="scroll" aria-labelledby="gate-list-h">
             <h2 class="scroll__h" id="gate-list-h">Held pull requests</h2>
             <p class="scroll__lede">Each one touched a protected surface and stopped at the gate check. Approving records your seal on that commit and re-runs the check.</p>
@@ -65,6 +78,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/gate.js?v=2026-09-02-gate-rows"></script>
+<script src="/builders/gate.js?v=2026-09-19-fence"></script>
 </body>
 </html>