@bongos/core 1.19.874 → 1.19.876

package/modules/hall-ui/public/gate.js

@@ -39,10 +39,25 @@
     const res = await api.request(method, `${API}${path}`, { body: body || {} });
     if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw { kind: '401' }; }
     const data = res.data || {};
-    if (!res.ok) throw new Error(data.message || data.error || `${path} → ${res.status}`);
+    if (!res.ok) throw new Error(errorText(data, path, res.status));
     return data;
   }
 
+  // errorText — the readable half of a failed write.
+  //
+  // `data.error` is the ADR 0116 envelope, an OBJECT of { code, message }, so the
+  // old `data.message || data.error` fell through to it and produced the literal
+  // string "[object Object]" in the toast. Caught rendering this page against a
+  // 501 (task 1003908) — the button reported a failure the operator could not read,
+  // which is barely better than reporting nothing.
+  function errorText(data, path, status) {
+    const env = data && data.error;
+    if (env && typeof env === 'object' && typeof env.message === 'string') return env.message;
+    if (typeof env === 'string') return env;
+    if (typeof data?.message === 'string') return data.message;
+    return `${path} → ${status}`;
+  }
+
   // ---- formatters ----------------------------------------------------------
 
   const shortSha = (s) => (typeof s === 'string' ? s.slice(0, 7) : '');
@@ -222,6 +237,103 @@
     if (body) body.textContent = `Available from the ${rankLabel('metic')} rank up.`;
   }
 
+  // ---- the Autobongos fence (task 1003908, ADR 0307 §6) --------------------
+  //
+  // The kill switch and the goal allowlist for the unattended runner. On this page
+  // because the Gate is already where the owner decides what reaches main without
+  // a person in the loop; the held-PR list and this panel are the same question
+  // from two ends.
+  //
+  // ARCHON ONLY, and the panel simply is not rendered for anyone else. That is
+  // cosmetic: POST /autonomy/fence and the two allowlist routes carry
+  // `autonomy.fence.manage`, which the catalog declares system:true + archon, so
+  // it cannot be granted to a custom rank. The wall is the server's.
+
+  function renderFenceState(fence) {
+    const on = fence.enabled === true;
+    const el = document.getElementById('fence-state');
+    el.innerHTML = `
+      <div class="ov-foot" style="display:flex;align-items:center;gap:12px;flex-wrap:wrap;">
+        <strong>${on ? 'Running' : 'Stopped'}</strong>
+        <span>${on ? 'The runner may claim and work allowlisted goals.' : escapeHtml(fence.paused_reason || 'The runner is doing nothing.')}</span>
+        <button type="button" id="fence-toggle" class="btn">${on ? 'Stop the runner' : 'Start the runner'}</button>
+      </div>`;
+    document.getElementById('fence-toggle').addEventListener('click', async () => {
+      // Turning it OFF asks why. Stopping an unattended machine is the kind of act
+      // someone reconstructs weeks later, and "halted" answers none of their
+      // questions. Turning it ON needs no reason — the allowlist already is one.
+      let reason = null;
+      if (on) {
+        reason = window.prompt('Why are you stopping the runner? (shown to anyone who asks why it is idle)');
+        if (reason === null) return;   // cancelled — not the same as an empty reason
+      }
+      try {
+        await sendJson('POST', '/autonomy/fence', { enabled: !on, reason: reason || undefined });
+        toast(on ? 'Runner stopped.' : 'Runner started.');
+        await loadFence();
+      } catch (err) { toast(err.message || 'Could not change the switch.'); }
+    });
+  }
+
+  function renderFenceGoals(goals) {
+    const el = document.getElementById('fence-goals');
+    const rows = (goals || []).map((g) => `
+      <li class="ov-row" style="display:flex;align-items:center;gap:12px;">
+        <a href="/builders#/goal/${encodeURIComponent(g.goal_id)}">Goal ${escapeHtml(String(g.goal_id))}</a>
+        <span style="flex:1;">${escapeHtml(g.note || '')}</span>
+        <button type="button" class="btn" data-revoke="${escapeHtml(String(g.goal_id))}">Remove</button>
+      </li>`).join('');
+    el.innerHTML = `
+      <h3 class="scroll__h" style="font-size:1rem;">Allowlisted goals</h3>
+      ${goals && goals.length ? `<ul class="ov-rows">${rows}</ul>`
+        : emptyStateHtml('No goal is allowlisted, so the runner has nothing it may work on.')}
+      <form id="fence-add" class="ov-foot" style="display:flex;gap:8px;align-items:center;margin-top:12px;">
+        <label for="fence-goal-id">Allow goal</label>
+        <input type="number" id="fence-goal-id" min="1" step="1" required placeholder="1000119">
+        <input type="text" id="fence-goal-note" maxlength="500" placeholder="why (optional)">
+        <button type="submit" class="btn">Add</button>
+      </form>`;
+
+    document.getElementById('fence-add').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      const goalId = Number(document.getElementById('fence-goal-id').value);
+      if (!Number.isSafeInteger(goalId) || goalId <= 0) { toast('Enter a goal number.'); return; }
+      try {
+        await sendJson('POST', '/autonomy/fence/goals', { goal_id: goalId, note: document.getElementById('fence-goal-note').value || undefined });
+        toast(`Goal ${goalId} allowlisted.`);
+        await loadFence();
+      } catch (err) { toast(err.message || 'Could not add that goal.'); }
+    });
+
+    for (const btn of el.querySelectorAll('[data-revoke]')) {
+      btn.addEventListener('click', async () => {
+        const goalId = btn.getAttribute('data-revoke');
+        try {
+          await sendJson('DELETE', `/autonomy/fence/goals/${encodeURIComponent(goalId)}`);
+          toast(`Goal ${goalId} removed.`);
+          await loadFence();
+        } catch (err) { toast(err.message || 'Could not remove that goal.'); }
+      });
+    }
+  }
+
+  async function loadFence() {
+    let fence;
+    try {
+      fence = await fetchJson('/autonomy/fence');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      // A fence the HALL cannot read is only a rendering problem — the RUNNER
+      // reads it separately and refuses on the same failure. Say so plainly rather
+      // than showing a switch whose position is a guess.
+      document.getElementById('fence-state').innerHTML = emptyStateHtml('Could not read the runner switch just now.');
+      document.getElementById('fence-goals').innerHTML = '';
+      return;
+    }
+    renderFenceState(fence);
+    renderFenceGoals(fence.goals);
+  }
+
   async function init() {
     // Confirm the viewer's rank for a friendly sealed notice; the server gates the page
     // + every endpoint regardless (cosmetic defence-in-depth).
@@ -242,6 +354,10 @@
 
     document.getElementById('gate-sub').textContent = 'Changes touching protected build surfaces, held for your approval.';
     document.getElementById('gate-body').hidden = false;
+    if (rank === 'archon') {
+      document.getElementById('fence-panel').hidden = false;
+      await loadFence();
+    }
     await load();
   }
 

package/modules/security/tests/artifact_scan.mjs

@@ -31,10 +31,35 @@ const { createQuarantine, siteRefusal, isSyncBacked, isInside, REPO_ROOT, CAPS }
 const { buildManifest, verifyUnchanged, CapExceeded, KIND } = manifest;
 const { validateTargetUrl, hardeningConfig, hardenedEnv, parseLsFiles, fetchArtifact, blockedAddress, assertHostResolvesPublic } = fetchMod;
 
+
+// Test hook (task 1003993): forces the platform-cannot-symlink branch so the skip path is
+// reachable on a box where symlinks work. Throws exactly where fs.symlinkSync would.
+function symlinkOrRefuse(target, link) {
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') throw new Error('EPERM (forced by BONGOS_TEST_FORCE_NO_SYMLINK)');
+  fs.symlinkSync(target, link);
+}
+
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
@@ -182,10 +207,9 @@ await test('a symlink is recorded by its link text and its target is NEVER opene
   fs.writeFileSync(secret, 'AKIA-SUPER-SECRET-TOKEN\n');
   fs.writeFileSync(path.join(root, 'README.md'), 'hi\n');
   try {
-    fs.symlinkSync(secret, path.join(root, 'stolen'));
+    symlinkOrRefuse(secret, path.join(root, 'stolen'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
   const link = m.entries.find((e) => e.path === 'stolen');
@@ -542,11 +566,10 @@ await test('symlinks count against maxFiles too — a cap on regular files only
   const root = mkTmp();
   fs.writeFileSync(path.join(root, 'a.txt'), 'a');
   try {
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l1'));
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l2'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l1'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l2'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   await assert.rejects(() => buildManifest(root, { maxFiles: 2, maxBytes: 1e6 }), /entry cap/);
 });
@@ -588,5 +611,5 @@ await test('CAPS are finite — no accidental unlimited default', async () => {
 
 for (const d of tmpDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
 
-console.log(`\nartifact_scan: ${passed} passed, ${failed} failed`);
+console.log(`\nartifact_scan: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/mirror.mjs

@@ -35,14 +35,35 @@ const { scrubUntrusted, newFenceDelim, FENCE_MARKER, DANGEROUS_CHARS } = fenceLo
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // Test hook (task 1003993): the skip branch is unreachable on any box that CAN symlink,
+  // which is every CI runner — exactly why the old fake-pass went unnoticed for so long.
+  // tests/skip_is_not_pass.mjs sets this to exercise the skip path anywhere.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'symlink-probe-target');
   const link = path.join(dir, 'symlink-probe-link');
   try {
@@ -176,7 +197,7 @@ async function run() {
       const rel = `docs/${rlo}evil.md`;
       let wrote = true;
       try { writePristine(pen, rel, 'body'); } catch { wrote = false; }
-      if (!wrote) { console.log('     (skipped: this filesystem refuses bidi filenames)'); return; }
+      if (!wrote) return skipCase('this filesystem refuses bidi filenames');
       const res = await buildMirror({
         pristineDir: pen.pristineDir, mirrorDir: pen.mirrorDir, quarantineRoot: pen.root,
         entries: [fileEntry(rel, 4)],
@@ -313,7 +334,8 @@ async function run() {
       } finally { pen.cleanup(); }
     });
   } else {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
+    noteSkip('a REAL on-disk symlink whose realpath escapes the pen is refused (defense in depth)',
+      'this platform/account cannot create symlinks');
   }
 
   // ---------- the index: the record downstream stages reduce over ----------
@@ -352,5 +374,5 @@ function* walkFiles(dir) {
 }
 
 await run();
-console.log(`\nmirror: ${passed} passed, ${failed} failed`);
+console.log(`\nmirror: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/sanitize_rebuild.mjs

@@ -25,11 +25,23 @@ const { excerpt } = require('../artifact-scan/detectors/shared.js');
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
 async function test(name, fn) {
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
 }
 
+// A case that did not run is NOT a case that passed (task 1003993). This prints SKIP rather
+// than `ok` and counts separately, so the difference between "verified" and "not attempted"
+// survives into the summary line and into run-unit-tests.js's roll-up. It takes the same
+// `name` the real case would have used, because "which coverage did I lose?" is the only
+// question worth answering here.
+function skip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
+
 const RAW_DANGEROUS_RE = new RegExp(
   '[\\u200b-\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff]|[\\u{e0000}-\\u{e007f}]', 'u');
 
@@ -384,6 +396,11 @@ await test('a failed build leaves NO partial sanitized/ tree, and a retry is sti
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as mirror.mjs / artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // A test hook, because the branch below is unreachable on any box that CAN symlink — which
+  // is every CI runner and most dev machines, and is precisely why the old fake-pass survived
+  // so long unnoticed. tests/skip_is_not_pass.mjs sets this to exercise the skip path on a
+  // platform where the real probe succeeds.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'probe-target');
   const link = path.join(dir, 'probe-link');
   try {
@@ -434,9 +451,13 @@ function canSymlink(dir) {
       } finally { pen.cleanup(); fs.rmSync(farAway, { recursive: true, force: true }); }
     });
   } else {
-    console.log('  ok  physical-confinement symlink cases');
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    passed += 2;
+    // These two are the ONLY coverage of physical confinement, so losing them silently is
+    // how task 1003848 reached CI red while this box read 760/760: a change to isInside()
+    // collapsed the lexical/physical staging in sanitize.js, and the cases that would have
+    // caught it had been reporting `ok` without running for as long as anyone could remember.
+    const why = 'this platform/account cannot create symlinks';
+    skip('physical confinement: a real symlink the manifest calls a "file" is refused, and its target never reaches sanitized/', why);
+    skip('physical confinement: a symlink whose realpath escapes the QUARANTINE entirely is refused', why);
   }
 }
 
@@ -495,5 +516,5 @@ await test('an artifact with no docs still yields an honest spec — the no-docs
 });
 
 console.log('');
-console.log(`${passed} passed, ${failed} failed`);
+console.log(`${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.874",
+  "version": "1.19.876",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.874",
+      "version": "1.19.876",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.874",
+  "version": "1.19.876",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/autobongos-run.js

@@ -6,15 +6,18 @@
 // one worker → record. No model anywhere in this file; every branch it takes is
 // a branch a person can read.
 //
-//   node scripts/gds/autobongos-run.js --goal 1000119            # one task
-//   node scripts/gds/autobongos-run.js --goal 1000119 --max-tasks 5
-//   node scripts/gds/autobongos-run.js --goal 1000119 --dry-run  # pick only, claim nothing
+//   node scripts/gds/autobongos-run.js                           # every allowlisted goal
+//   node scripts/gds/autobongos-run.js --goal 1000119            # narrow to one of them
+//   node scripts/gds/autobongos-run.js --max-tasks 5
+//   node scripts/gds/autobongos-run.js --dry-run                 # pick only, claim nothing
 //
 // SCOPE, and what deliberately is NOT here:
-//   · the ALLOWLIST is `--goal` / AUTOBONGOS_GOALS for now. Task 1003908 moves it
-//     into the database where the machine cannot edit it, and adds the kill
-//     switch. Until then this refuses to run with no goal named, rather than
-//     defaulting to "anything claimable".
+//   · the ALLOWLIST and the KILL SWITCH live in the DATABASE (task 1003908,
+//     ADR 0307 §6) and are read at step 0 of every iteration. `--goal` and
+//     AUTOBONGOS_GOALS survive only as a NARROWING filter — they can take goals
+//     away from the allowlist and can never add one, because a setting on this
+//     machine is editable by the very bypassPermissions worker the allowlist
+//     exists to bound.
 //   · CONFIRMING a ship against the ledger is autobongos-verify.js (task
 //     1003903), called at step 6. A worker's `shipped` is a CLAIM — recorded here
 //     as `claims_shipped` so nothing can mistake it for a fact — and the ledger
@@ -33,6 +36,12 @@ const {
   buildWorkerArgs, buildWorkerPrompt, classifyRun, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
 } = require('./autobongos-loop.js');
 const { verifyShip } = require('./autobongos-verify.js');
+const fence = require('../../modules/autonomy/fence.js');
+// The ADR 0043 protected-path registry, reused rather than re-derived. scripts/
+// sits outside the kernel boundary, so this direct core require is allowed here
+// where it would not be inside modules/ — which is exactly why fence.js takes the
+// hits as an argument instead of matching them itself.
+const { matchProtected } = require('../../src/bongos/permission-path-check');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -51,6 +60,10 @@ function readArgv(argv) {
   if (!out.goals.length && process.env.AUTOBONGOS_GOALS) {
     out.goals = String(process.env.AUTOBONGOS_GOALS).split(',').map((g) => Number(g.trim())).filter(Boolean);
   }
+  // NOTE the semantics changed in task 1003908: `out.goals` is a REQUESTED filter,
+  // intersected with the database allowlist. An empty list no longer means "refuse
+  // to run" — it means "every allowlisted goal" — because the thing that refuses
+  // when nothing is permitted is now the fence, which this machine cannot edit.
   return out;
 }
 
@@ -202,6 +215,33 @@ function worktreeName(taskId) {
   return `autobongos-${taskId}-${crypto.randomBytes(3).toString('hex')}`;
 }
 
+// readFence — the two facts the fence is made of, in one place.
+//
+// BOTH come from the server. `GET /autonomy/fence` is the kill switch and the
+// allowlist; `GET /me`'s `grader_bypass` is ADR 0041's global grader killswitch,
+// resolved server-side from the server's own env. Neither is readable from a file
+// on this machine, and that is the entire point — see modules/autonomy/fence.js.
+//
+// A failure of EITHER read returns the shape that refuses. An unreachable
+// instance and a thrown kill switch are different facts, but they license the
+// same action: do nothing.
+async function readFence(deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  let raw = null;
+  let graderBypassed = null;
+  try {
+    const r = await api.autonomy.getAutonomyFence();
+    if (r && r.ok) raw = r.data;
+  } catch (_) { /* unreadable → refuses below */ }
+  try {
+    const me = await api.me.getMe();
+    // Strictly a boolean or nothing. `undefined` from an older server is NOT
+    // `false`: it means this instance cannot tell us, which refuses.
+    if (me && me.ok && typeof me.data.grader_bypass === 'boolean') graderBypassed = me.data.grader_bypass;
+  } catch (_) { /* unreadable → refuses below */ }
+  return { raw, graderBypassed };
+}
+
 async function iteration(opts, deps = {}) {
   const runCmd = deps.run || run;
   const spawnWork = deps.spawnWorker || spawnWorker;
@@ -209,17 +249,53 @@ async function iteration(opts, deps = {}) {
   const pick = deps.pickTask || pickTask;
   const log = deps.record || record;
 
+  // 0. THE FENCE (task 1003908, ADR 0307 §6). Before the gauge, because three of
+  // its four gates make every task refusable and there is no sense paying for a
+  // capacity read to discover that. Before anything is picked, claimed or spawned,
+  // because a fence checked after the fact is not a fence.
+  const { raw, graderBypassed } = deps.readFence ? await deps.readFence(deps) : await readFence(deps);
+  // NOT named `run`. The module-level exec helper above is called `run`, and a
+  // `const run` anywhere in this function hoists into a Temporal Dead Zone that
+  // covers the WHOLE body — including `deps.run || run` at the top, which is the
+  // PRODUCTION call shape (main() passes no deps). That shadowing threw
+  // `ReferenceError: Cannot access 'run' before initialization` on the first line
+  // of every real iteration while every test stayed green, because the harness
+  // always injected deps.run. Caught by the grader on task 1003908; the test that
+  // now drives iteration() with no deps is the actual fix — this rename is half.
+  const gate = fence.decideRun({ fence: raw, requestedGoals: opts.goals, graderBypassed });
+  if (!gate.go) {
+    return log({ event: 'fenced', code: gate.code, reason: gate.reason, refused_goals: gate.refusedGoals || [] });
+  }
+
   // 1. The gauge. Never start a task we cannot pay for out of the window.
   const g = readGauge();
   if (!g.decision.go) {
     return log({ event: 'hold', go: false, unknown: !!g.decision.unknown, reason: g.decision.reason, sleep_until: g.decision.sleepUntil ?? null });
   }
 
-  // 2. Pick.
-  const picked = await pick(opts.goals, deps.pickDeps || {});
+  // 2. Pick — from the ALLOWLISTED goals, never from what the command line asked
+  // for. gate.goals is already the intersection.
+  const picked = await pick(gate.goals, deps.pickDeps || {});
   if (picked.error) return log({ event: 'pick_failed', reason: picked.error });
   if (picked.none) return log({ event: 'nothing_claimable', goals: opts.goals });
   const task = picked.task;
+
+  // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
+  // a protected-path task, and this re-asks anyway — not from distrust of the
+  // matrix, but because the matrix is a shared component with its own callers and
+  // the fence must not be a property of whoever happens to be picking. A gate that
+  // only holds while a collaborator keeps calling it is not a gate.
+  //
+  // Both halves read the task's DECLARED touches[], which is a claim, not a fact —
+  // see the header of modules/autonomy/fence.js for why that is acceptable as the
+  // OUTER of three layers and would not be as the only one.
+  const taskGate = fence.decideTask({
+    task, goals: gate.goals, protectedHits: matchProtected(task.touches || []),
+  });
+  if (!taskGate.go) {
+    return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: task.id, goal_id: picked.goalId, globs: taskGate.globs || [] });
+  }
+
   if (opts.dryRun) return log({ event: 'dry_run', task_id: task.id, title: task.title, goal_id: picked.goalId });
 
   // 3. The task's own working tree.
@@ -290,11 +366,10 @@ async function iteration(opts, deps = {}) {
 
 async function main(argv) {
   const opts = readArgv(argv);
-  if (!opts.goals.length) {
-    console.error('autobongos-run: name at least one allowlisted goal (--goal N, or AUTOBONGOS_GOALS).');
-    console.error('  Refusing to run against "anything claimable" — the allowlist is half of what makes this safe to leave alone.');
-    return 2;
-  }
+  // No "name a goal" refusal here any more. It used to be the only allowlist, and
+  // it lived on the machine being fenced; the database owns that now, and an empty
+  // `--goal` means "every allowlisted goal" rather than "anything claimable". The
+  // refusal did not disappear — it moved somewhere the runner host cannot edit.
   for (let i = 0; i < opts.maxTasks; i++) {
     const row = await iteration(opts);
     if (opts.json) console.log(JSON.stringify(row));
@@ -314,4 +389,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, worktreeName };
+module.exports = { readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, worktreeName, readFence };

package/scripts/gds/run-unit-tests.js

@@ -213,12 +213,27 @@ const KNOWN_FAILING = new Set([
 // suites set exitCode rather than hard-exiting, so they do not hit this.
 const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
 
+// A suite that reports honest skips ends `N passed, 0 failed, M skipped` (task 1003993), so
+// the optional suffix is part of a clean verdict. Without it, the first suite to start telling
+// the truth about unrun coverage would have its clean verdict read as unrecognised and its
+// Windows teardown abort counted as a real failure — a fix for one honesty bug creating another.
+const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
+
+// `  SKIP <name>` from a suite's own stdout. Counted here rather than parsed out of the summary
+// line so a suite that prints skips without a summary suffix is still surfaced.
+const SKIP_LINE_RE = /^\s*SKIP\b/;
+
+function countSkips(stdout) {
+  if (!stdout) return 0;
+  return stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+}
+
 function isCleanTeardownAbort(stdout, stderr) {
   if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
   // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
   if (/^\s*FAIL\b/m.test(stdout)) return false;
   const lastLine = stdout.trim().split('\n').pop();
-  return /\b[1-9]\d* passed, 0 failed\s*$/.test(lastLine);
+  return CLEAN_VERDICT_RE.test(lastLine);
 }
 
 // The failing tests as ONE line, for the `unit-report` commit status the workflow
@@ -427,9 +442,13 @@ function main() {
 
   const failures = [];
   const teardownAborts = [];
+  // A GREEN suite that skipped cases is the shape this roll-up used to hide: the suite said so
+  // on its own stdout, which was discarded on success, so the only visible line was `ok` and a
+  // session reading the roll-up could not tell exercised coverage from absent coverage.
+  const skipped = [];
   const runOne = (displayName, filePath) => {
     try {
-      execFileSync(process.execPath, [filePath], {
+      const out = execFileSync(process.execPath, [filePath], {
         // task 1002644: stdout used to be IGNORED, so the failing assertion (test
         // files print their FAIL lines to stdout) was discarded and the only
         // context shown was the last 3 STDERR lines — often stale diagnostic
@@ -441,7 +460,9 @@ function main() {
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
-      console.log(`  ok    ${displayName}`);
+      const n = countSkips(out ? out.toString() : '');
+      if (n) skipped.push({ name: displayName, n });
+      console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run on this platform)` : ''}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
@@ -492,6 +513,11 @@ function main() {
   if (teardownAborts.length) {
     console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
   }
+  if (skipped.length) {
+    const n = skipped.reduce((sum, s) => sum + s.n, 0);
+    console.log(`${label}: ${n} case(s) NOT RUN on this platform — ${skipped.map((s) => `${s.name} (${s.n})`).join(', ')}`);
+    console.log(`${label}: a skipped case is not a passing one. Green here does not mean that coverage was exercised.`);
+  }
   reportToWorkflow(failures);
   if (failures.length === 0) {
     console.log(`${label}: all ${total} passed.`);
@@ -503,4 +529,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests, isCleanTeardownAbort, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };
+module.exports = { discoverModuleTests, isCleanTeardownAbort, countSkips, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.874'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.876'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');