@bongos/core 1.20.36 → 1.20.38

package/docs/copy-registry.json

@@ -2976,7 +2976,7 @@
       "surface": "builders-hall",
       "text": "Allow goal",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 288,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3003,7 +3003,7 @@
       "surface": "builders-hall",
       "text": "Allowlisted goals",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 286,
+      "line": 300,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3741,7 +3741,7 @@
       "surface": "builders-hall",
       "text": "Changes touching protected build surfaces, held for your approval.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 403,
+      "line": 432,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5370,7 +5370,7 @@
       "surface": "builders-hall",
       "text": "Enter a goal number.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 300,
+      "line": 315,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6054,7 +6054,7 @@
       "surface": "builders-hall",
       "text": "Goal {…}",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 280,
+      "line": 288,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6063,7 +6063,7 @@
       "surface": "builders-hall",
       "text": "Goal {…} allowlisted.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 303,
+      "line": 318,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6072,7 +6072,7 @@
       "surface": "builders-hall",
       "text": "Goal {…} removed.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 313,
+      "line": 341,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -14442,7 +14442,7 @@
       "surface": "builders-hall",
       "text": "last check-in {…} ago",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 360,
+      "line": 391,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15846,7 +15846,7 @@
       "surface": "builders-hall",
       "text": "why (optional)",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 288,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -365,6 +365,7 @@ tests/
 ├── backlog-review/SKILL.md        ← /backlog-review — daily walk of status=backlog, the pre-workable state a human must say go on: splits rows waiting on a PERSON (promote / kill / water) from rows waiting on a live dep TRIGGER (counted, never walked, migration 163) and surfaces rows stranded behind an abandoned dep; runs scripts/gds/backlog-review.js (task 1003746); Metic+
 ├── blocker-review/SKILL.md        ← /blocker-review — daily review of open Bongos blockers (resolve / escalate / note); Metic+
 ├── blocker-solve/SKILL.md         ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
+├── bongos-feedback/SKILL.md       ← /bongos-feedback — send feedback about Bongos itself upstream to the Cloud Bongos maintainers via `bongos feedback` (a bug lands as a backlog task in the maintenance goal, an idea in the hub inbox); backed by scripts/gds/feedback-send.js (task 1004462)
 ├── bug-triage/SKILL.md            ← /bug-triage — daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
 ├── builder-backup/SKILL.md        ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
 ├── builder-claim/SKILL.md         ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing

package/docs/module-api-changelog.md

@@ -2729,5 +2729,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.34 with no explicit bump. run 36787635391. (task 1002620)
   1.20.36 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.35 with no explicit bump. run 36788696388. (task 1002620)
+  1.20.37 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.36 with no explicit bump. run 36790298715. (task 1002620)
+  1.20.38 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.37 with no explicit bump. run 36794921587. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -873,7 +873,7 @@
       "surface": "builders",
       "title": "Gate",
       "states_read": ["queue","out","approve"],
-      "files_hash": "d8acda02b90e0cb5",
+      "files_hash": "14ac6944f79fb3cb",
       "reading_hash": "08d3e5d3657e5afb",
       "counts": {"lines":41,"placed":17,"shared":5,"unplaced":19},
       "omitted": {"data":34},
@@ -884,7 +884,7 @@
         {"key":"L0003","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":487,"string_id":"eba610d25523"},
         {"key":"L0004","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0005","section":"Gate","text":"Gate","placement":"unplaced"},
-        {"key":"L0006","section":"Gate","text":"Changes touching protected build surfaces, held for your approval.","placement":"placed","file":"modules/hall-ui/public/gate.js","line":403,"string_id":"4b714191b423"},
+        {"key":"L0006","section":"Gate","text":"Changes touching protected build surfaces, held for your approval.","placement":"placed","file":"modules/hall-ui/public/gate.js","line":431,"string_id":"4b714191b423"},
         {"key":"L0007","section":"Gate","text":"Awaiting your approval","placement":"unplaced"},
         {"key":"L0008","section":"Gate","text":"held at the gate check","placement":"unplaced"},
         {"key":"L0009","section":"Gate","text":"Hard-floor holds","placement":"unplaced"},

package/docs/recipes/upgrading-the-core.md

@@ -90,6 +90,8 @@ The sections above are the *manual* `bongos upgrade`. The **subscription** runs
 
 A **major** is never automatic; prereleases are never auto-targeted.
 
+**Where the channel comes from** ([ADR 0357](../adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md), task [1004468](https://cloudbongos.com/builders#/task/1004468)): the rule set on **/deploy** (`provisioning_instances.update_channel`) wins for any roster entry whose `slug` matches a project row. The roster's `channel` below is only the fallback, used when no row matches or the sweep can't read the database. The sweep reads the control plane's DB from its own `DATABASE_URL` / `PGDATABASE`, so the unit needs one of them set. Every run prints each entry's channel and its source.
+
 **Enrolling an instance** — add it to `config/update-subscriptions.json` (instance-side) (ships empty). `env` carries per-instance vars merged into the upgrade child — set `PGDATABASE` so `migrate` hits the right DB (see the Gotchas):
 
 ```json

package/modules/autonomy/db.js

@@ -76,7 +76,7 @@ async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
 // it unreadable to the caller, which refuses — never a permissive default.
 async function readFence() {
   const [fence, goals] = await Promise.all([
-    pool.query('SELECT enabled, paused_reason, updated_at, updated_by FROM autonomy_fence WHERE id = 1'),
+    pool.query('SELECT enabled, paused_reason, priority_goal_id, updated_at, updated_by FROM autonomy_fence WHERE id = 1'),
     pool.query('SELECT goal_id, note, added_at, added_by FROM autonomy_allowed_goals ORDER BY added_at DESC'),
   ]);
   const row = fence.rows[0];
@@ -84,6 +84,9 @@ async function readFence() {
   return {
     enabled: row.enabled === true,
     paused_reason: row.paused_reason,
+    // A bigint, so a string from node-postgres; normalised for the same reason as
+    // the goal ids below. null = no priority (task 1004453).
+    priority_goal_id: row.priority_goal_id == null ? null : Number(row.priority_goal_id),
     updated_at: row.updated_at,
     updated_by: row.updated_by ? String(row.updated_by) : null,
     // goal_id is a bigint, which node-postgres hands back as a STRING. The runner
@@ -124,6 +127,28 @@ async function allowGoal({ goalId, note = null, builderId = null }) {
   return r ? { ...r, goal_id: Number(r.goal_id) } : null;
 }
 
+// setPriorityGoal — name the goal the runner works first, or clear it with null
+// (task 1004453). The WHERE refuses a goal that is not allowlisted, so the write
+// either lands or returns nothing and the route can say why; the foreign key from
+// autonomy_003 backs the same rule in the schema. Returns:
+//   { row }           — written
+//   { notAllowed }    — that goal is not on the allowlist
+//   { missing }       — the singleton row is gone (migrations not run)
+async function setPriorityGoal({ goalId, builderId = null }) {
+  const { rows } = await pool.query(
+    `UPDATE autonomy_fence
+        SET priority_goal_id = $1, updated_at = now(), updated_by = $2
+      WHERE id = 1
+        AND ($1::bigint IS NULL OR EXISTS (SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = $1::bigint))
+      RETURNING priority_goal_id, updated_at`,
+    [goalId, builderId]
+  );
+  const r = rows[0];
+  if (r) return { row: { priority_goal_id: r.priority_goal_id == null ? null : Number(r.priority_goal_id), updated_at: r.updated_at } };
+  const { rows: fenceRows } = await pool.query('SELECT 1 FROM autonomy_fence WHERE id = 1');
+  return fenceRows.length ? { notAllowed: true } : { missing: true };
+}
+
 // disallowGoal — take a goal off the allowlist. `removed` says whether a row
 // actually went, because "already gone" and "just revoked" are different answers
 // to an owner clicking Remove.
@@ -137,11 +162,11 @@ async function disallowGoal(goalId) {
 // recordRunnerHeartbeat — upsert one host's check-in. ON CONFLICT so the normal
 // case is one write, and `host` is the key so a second runner appears as a second
 // row rather than silently overwriting the first.
-async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null }) {
+async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null }) {
   const { rows } = await pool.query(
     `INSERT INTO autonomy_runner_heartbeat
-       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at, updated_at)
-     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, now(), now())
+       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at, updated_at)
+     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, now(), now())
      ON CONFLICT (builder_id, host) DO UPDATE SET
        pid = EXCLUDED.pid,
        started_at = COALESCE(EXCLUDED.started_at, autonomy_runner_heartbeat.started_at),
@@ -149,10 +174,11 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
        consecutive_failures = EXCLUDED.consecutive_failures,
        last_event = EXCLUDED.last_event,
        working_task_id = EXCLUDED.working_task_id,
+       working_goal_id = EXCLUDED.working_goal_id,
        last_seen_at = now(),
        updated_at = now()
-     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at`,
-    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId]
+     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at`,
+    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId]
   );
   return rows[0] || null;
 }
@@ -167,14 +193,18 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
 // liveness view entirely (grader finding, task 1003905).
 async function readRunnerHeartbeats(builderId) {
   const { rows } = await pool.query(
-    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, last_seen_at
+    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at
        FROM autonomy_runner_heartbeat
       WHERE builder_id = $1
       ORDER BY last_seen_at DESC
       LIMIT 20`,
     [builderId]
   );
-  return rows.map((r) => ({ ...r, working_task_id: r.working_task_id ? String(r.working_task_id) : null }));
+  return rows.map((r) => ({
+    ...r,
+    working_task_id: r.working_task_id ? String(r.working_task_id) : null,
+    working_goal_id: r.working_goal_id ? String(r.working_goal_id) : null,
+  }));
 }
 
 module.exports = {
@@ -187,4 +217,5 @@ module.exports = {
   setFenceEnabled,
   allowGoal,
   disallowGoal,
+  setPriorityGoal,
 };

package/modules/autonomy/fence.js

@@ -74,25 +74,44 @@ function normaliseFence(raw) {
     const n = Number(typeof g === 'object' && g !== null ? g.goal_id : g);
     if (Number.isSafeInteger(n) && n > 0) ids.push(n);
   }
+  // The priority goal (task 1004453). Honoured only when it is ON the allowlist:
+  // the database already enforces that with a foreign key, and this re-checks it
+  // so a priority can only ever ORDER the allowlist, never add to it. Anything
+  // else (missing, malformed, not allowlisted) reads as "no priority", which is
+  // the old behaviour, not a refusal: the allowlist alone is still a safe answer.
+  const p = Number(raw.priority_goal_id);
+  const priorityGoal = raw.priority_goal_id != null && Number.isSafeInteger(p) && p > 0 && ids.includes(p) ? p : null;
   return {
     enabled: raw.enabled === true,
     pausedReason: typeof raw.paused_reason === 'string' ? raw.paused_reason : null,
     goals: ids,
+    priorityGoal,
   };
 }
 
+// prioritise — the same goals with the priority goal moved to the front. A goal
+// that is not in the list is ignored, so this can reorder and never add.
+function prioritise(goals, priorityGoal) {
+  if (priorityGoal == null || !goals.includes(priorityGoal)) return goals.slice();
+  return [priorityGoal, ...goals.filter((g) => g !== priorityGoal)];
+}
+
 // allowedGoals — the goals this run may work, given the fence and whatever the
 // operator asked for on the command line.
 //
 // The INTERSECTION is the point. `requested` can only narrow: a goal the operator
 // named that the database does not allow is dropped, and reported, rather than
 // honoured. The runner host is not a place authority can come from.
+//
+// The priority goal goes FIRST, after the intersection, so an operator narrowing
+// to goals that leave it out simply gets no priority rather than having it
+// re-added.
 function allowedGoals(fence, requested = []) {
   const allowed = new Set(fence.goals);
   const asked = (requested || []).map((g) => Number(g)).filter((n) => Number.isSafeInteger(n) && n > 0);
-  if (!asked.length) return { goals: fence.goals.slice(), refused: [] };
+  if (!asked.length) return { goals: prioritise(fence.goals, fence.priorityGoal), refused: [] };
   return {
-    goals: asked.filter((g) => allowed.has(g)),
+    goals: prioritise(asked.filter((g) => allowed.has(g)), fence.priorityGoal),
     refused: asked.filter((g) => !allowed.has(g)),
   };
 }
@@ -137,7 +156,10 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
         : REFUSALS.no_allowlist,
     };
   }
-  return { go: true, goals, refusedGoals: refused, code: null, reason: null };
+  // priorityGoal is reported only when it survived the intersection, so a row can
+  // say "this pick came from the priority goal" without re-deriving the rule.
+  const priorityGoal = fence.priorityGoal != null && goals[0] === fence.priorityGoal ? fence.priorityGoal : null;
+  return { go: true, goals, priorityGoal, refusedGoals: refused, code: null, reason: null };
 }
 
 // decideTask — may THIS task be handed to an unattended worker?
@@ -169,4 +191,4 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, normaliseFence, allowedGoals, decideRun, decideTask };
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, decideRun, decideTask };

package/modules/autonomy/migrations/autonomy_003_priority_goal.sql

@@ -0,0 +1,32 @@
+-- autonomy_003_priority_goal.sql — the fence's priority goal (task 1004453).
+--
+-- Owner ruling, 2026-09-30: whoever starts the runner says which goal comes FIRST
+-- as well as which goals it may touch at all. The priority sits on the fence row,
+-- next to the kill switch, for the same reason the allowlist does: the runner
+-- host can read it and cannot write it (see autonomy_001's header).
+--
+-- A FOREIGN KEY TO THE ALLOWLIST, deliberately. The priority goal must be an
+-- allowlisted goal; the route checks that, and this makes it a fact the database
+-- holds rather than a rule one route remembers. ON DELETE SET NULL is the safe
+-- direction: revoking the priority goal from the allowlist clears the priority,
+-- so a revoked goal can never be worked because it was once "first".
+--
+-- The priority ORDERS the allowlist; it never widens it. NULL (the default) means
+-- no priority, which is today's behaviour.
+--
+-- working_goal_id on the heartbeat is the other half of the done-when: the hall
+-- can say which goal the runner's current task came from. Nullable, no FK — a
+-- heartbeat is a report, and a report about a goal deleted since is still true.
+--
+-- Additive and idempotent (ADR 0083 §Decision #5): safe to re-run.
+
+BEGIN;
+
+ALTER TABLE autonomy_fence
+  ADD COLUMN IF NOT EXISTS priority_goal_id bigint
+    REFERENCES autonomy_allowed_goals (goal_id) ON DELETE SET NULL;
+
+ALTER TABLE autonomy_runner_heartbeat
+  ADD COLUMN IF NOT EXISTS working_goal_id bigint;
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -88,7 +88,7 @@ module.exports = function buildAutonomyRouter() {
 
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
-  // These four routes ARE the fence. Everything the unattended runner is allowed
+  // These five routes ARE the fence. Everything the unattended runner is allowed
   // to do is decided by rows only these can write, on a server the runner host
   // cannot reach — that separation is the entire safety argument, so read the
   // rank gates below as load-bearing rather than boilerplate.
@@ -172,6 +172,31 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // The priority goal (task 1004453): which allowlisted goal the runner works
+  // first. Same gate as the allowlist — choosing what an unattended machine does
+  // first is part of choosing what it may do. The goal must already be on the
+  // allowlist (409 otherwise), so a priority can order the list and never widen
+  // it. `goal_id: null` clears it.
+  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    // Declared with an open rule: the value is a number OR null, which the
+    // validator has no type for, so the shape is checked just below.
+    if (validateOrRespond(req, res, { goal_id: {} })) return;
+    const raw = req.body ? req.body.goal_id : undefined;
+    if (raw === undefined) return res.fail('goal_id_required', { status: 400, message: 'pass { "goal_id": <number> } or { "goal_id": null } to clear' });
+    const goalId = raw === null ? null : Number(raw);
+    if (goalId !== null && (!Number.isSafeInteger(goalId) || goalId <= 0)) return res.fail('goal_id_required', { status: 400, message: 'pass { "goal_id": <number> } or { "goal_id": null } to clear' });
+    try {
+      const out = await db.setPriorityGoal({ goalId, builderId: req.builder.id });
+      if (out.missing) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      if (out.notAllowed) return res.fail('goal_not_allowlisted', { status: 409, message: `goal ${goalId} is not on the allowlist — add it first` });
+      log.info(`[gds] autonomy fence: priority goal ${goalId === null ? 'CLEARED' : `set to ${goalId}`} by builder ${req.builder.id} (${req.builder.rank})`);
+      res.json(out.row);
+    } catch (err) {
+      log.error('[gds] POST /autonomy/fence/priority', err);
+      res.fail('priority_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // ── the runner heartbeat (task 1003905) ────────────────────────────────────
   //
   // A dead runner must be VISIBLE, not silent. The runner also writes a heartbeat
@@ -193,6 +218,7 @@ module.exports = function buildAutonomyRouter() {
       consecutive_failures: { type: 'number' },
       last_event: { type: 'string', maxLength: 64 },
       working_task_id: { type: 'number' },
+      working_goal_id: { type: 'number' },
     })) return;
     const b = req.body || {};
     try {
@@ -207,6 +233,7 @@ module.exports = function buildAutonomyRouter() {
         consecutiveFailures: Number.isInteger(b.consecutive_failures) ? b.consecutive_failures : null,
         lastEvent: b.last_event || null,
         workingTaskId: Number.isInteger(b.working_task_id) ? b.working_task_id : null,
+        workingGoalId: Number.isInteger(b.working_goal_id) ? b.working_goal_id : null,
       });
       res.json({ ok: true, heartbeat: row });
     } catch (err) {

package/modules/hall-ui/public/gate.js

@@ -275,16 +275,31 @@
     });
   }
 
-  function renderFenceGoals(goals) {
+  // The priority goal (task 1004453) is one of the allowlisted rows, marked and
+  // listed first, because that is the order the runner works them in. Its button
+  // clears it; every other row's button makes that goal the priority.
+  function renderFenceGoals(goals, priorityGoalId) {
     const el = document.getElementById('fence-goals');
-    const rows = (goals || []).map((g) => `
+    const pri = priorityGoalId == null ? null : Number(priorityGoalId);
+    // true - false = 1, so the priority row sorts ahead of every other; the rest keep their order.
+    const ordered = (goals || []).slice().sort((a, b) => (Number(b.goal_id) === pri) - (Number(a.goal_id) === pri));
+    const rows = ordered.map((g) => {
+      const isPri = Number(g.goal_id) === pri;
+      return `
       <li class="ov-row" style="display:flex;align-items:center;gap:12px;">
         <a href="/builders#/goal/${encodeURIComponent(g.goal_id)}">Goal ${escapeHtml(String(g.goal_id))}</a>
+        ${isPri ? '<span class="fact-pill fact-pill--ok">Priority</span>' : ''}
         <span style="flex:1;">${escapeHtml(g.note || '')}</span>
+        <button type="button" class="btn" data-priority="${isPri ? '' : escapeHtml(String(g.goal_id))}">${isPri ? 'Clear priority' : 'Make priority'}</button>
         <button type="button" class="btn" data-revoke="${escapeHtml(String(g.goal_id))}">Remove</button>
-      </li>`).join('');
+      </li>`;
+    }).join('');
+    const priLine = pri === null
+      ? 'No priority goal: the runner works these in any order.'
+      : `The runner works goal ${escapeHtml(String(pri))} first, then the others once it has nothing left to claim there.`;
     el.innerHTML = `
       <h3 class="scroll__h" style="font-size:1rem;">Allowlisted goals</h3>
+      ${goals && goals.length ? `<p class="ov-foot">${priLine}</p>` : ''}
       ${goals && goals.length ? `<ul class="ov-rows">${rows}</ul>`
         : emptyStateHtml('No goal is allowlisted, so the runner has nothing it may work on.')}
       <form id="fence-add" class="ov-foot" style="display:flex;gap:8px;align-items:center;margin-top:12px;">
@@ -305,6 +320,19 @@
       } catch (err) { toast(err.message || 'Could not add that goal.'); }
     });
 
+    for (const btn of el.querySelectorAll('[data-priority]')) {
+      btn.addEventListener('click', async () => {
+        // An empty attribute is the Clear button on the current priority row.
+        const v = btn.getAttribute('data-priority');
+        const goalId = v ? Number(v) : null;
+        try {
+          await sendJson('POST', '/autonomy/fence/priority', { goal_id: goalId });
+          toast(goalId === null ? 'Priority cleared.' : `Goal ${goalId} is now the priority.`);
+          await loadFence();
+        } catch (err) { toast(err.message || 'Could not change the priority.'); }
+      });
+    }
+
     for (const btn of el.querySelectorAll('[data-revoke]')) {
       btn.addEventListener('click', async () => {
         const goalId = btn.getAttribute('data-revoke');
@@ -360,6 +388,7 @@
       return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
         <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
         <span>${escapeHtml(h.detail || '')}</span>
+        ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
         <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
       </p>`;
     }).join('');
@@ -379,7 +408,7 @@
       return;
     }
     renderFenceState(fence);
-    renderFenceGoals(fence.goals);
+    renderFenceGoals(fence.goals, fence.priority_goal_id);
   }
 
   async function init() {

package/modules/ideas/routing.js

@@ -95,9 +95,16 @@ const NEVER_ROUTE_GRADE = 'full';
 //   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification
 //                     (modules/discord/discord-bugs.js forces kind='bug'), and
 //                     which already carries a rate cap + an unlinked-author guard.
+//   'instance-feedback' — POST /sso/feedback on the hub (task 1004462): a
+//                     federated project relaying `bongos feedback` about Bongos
+//                     itself. It earns the vector the way #bugs does — the
+//                     sender must be a hub-witnessed member of the calling
+//                     project, and the route caps filings per sender and per
+//                     project — and it always files with NO rank, so every
+//                     report lands at 'backlog' awaiting a nod.
 // 'discord-ideas' is deliberately ABSENT: it is an ideation channel, and the bug
 // reports that belong to Discord already have #bugs.
-const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs']);
+const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs', 'instance-feedback']);
 
 // decideLanding — the matrix, as one pure function.
 //

package/modules/platform-identity/instance-feedback.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// modules/platform-identity/instance-feedback.js — feedback about Bongos ITSELF,
+// relayed up from a federated project to the hub (task 1004462).
+//
+// A builder on a hosted project runs `bongos feedback "…"`. Their OWN instance
+// stamps who sent it and which core it runs, and relays it here over the
+// hub-federation client credential (ADR 0141) — the same server-to-server channel
+// as the activity rollup. This file turns that relay into a filing on the hub:
+//
+//   kind 'bug'  → a task in the building version's MAINTENANCE goal, at 'backlog'
+//                 (ADR 0262's homeless-bug home, reached through the
+//                 'instance-feedback' routing vector).
+//   kind 'idea' → an idea_inbox row for /idea-triage, exactly as any goal-less
+//                 idea lands — a suggestion is not a defect, and the maintenance
+//                 goal is for defects.
+//
+// ALWAYS 'backlog', never 'ready' — the owner's decision (2026-09-30). Anyone on
+// any tenant project can send this, so an approval stands between a report and
+// paid agent work. That is enforced by passing NO filer rank: decideLanding reads
+// an absent rank as untrusted, so even the owner's own feedback waits for the nod
+// rather than inheriting a hub rank the instance never vouched for.
+//
+// THE ATTRIBUTION IS THE HUB'S, NOT THE INSTANCE'S. Client credentials prove WHICH
+// PROJECT is calling and nothing about WHO sent it, so the sender must hold a
+// membership on that project carrying the hub's own sign-in witness
+// (membershipBacksRollup — the ADR 0205 rule the rollup uses). The login printed
+// on the task is then read from the hub's account row, never from the body.
+
+const FEEDBACK_KINDS = Object.freeze({ bug: 'bug', idea: 'feature' });
+const MESSAGE_MAX = 4000;
+const TITLE_MAX = 120;
+
+// Per-hour caps, counted in memory on this hub process. Two, because they stop
+// different things: one noisy builder, and one project relaying for many.
+const FEEDBACK_WINDOW_MS = 60 * 60 * 1000;
+const PER_SENDER_LIMIT = 10;
+const PER_PROJECT_LIMIT = 30;
+
+// makeFeedbackLimiter — a sliding-window counter keyed by project and sender.
+// `take` records a filing only when BOTH caps have room, so a refusal on one cap
+// never spends the other.
+function makeFeedbackLimiter({ now = Date.now } = {}) {
+  const buckets = new Map(); // key -> timestamp[]
+  function prune(key, t) {
+    const arr = buckets.get(key);
+    if (!arr) return [];
+    while (arr.length && arr[0] <= t - FEEDBACK_WINDOW_MS) arr.shift();
+    if (arr.length === 0) buckets.delete(key);
+    return arr;
+  }
+  function take(clientId, githubId) {
+    const t = now();
+    const checks = [
+      [`p:${clientId}`, PER_PROJECT_LIMIT, 'project'],
+      [`s:${clientId}:${githubId}`, PER_SENDER_LIMIT, 'sender'],
+    ];
+    for (const [key, limit, scope] of checks) {
+      const arr = prune(key, t);
+      if (arr.length >= limit) {
+        const retryAfter = Math.max(1, Math.ceil((arr[0] + FEEDBACK_WINDOW_MS - t) / 1000));
+        return { ok: false, scope, retryAfter };
+      }
+    }
+    for (const [key] of checks) {
+      if (!buckets.has(key)) buckets.set(key, []);
+      buckets.get(key).push(t);
+    }
+    return { ok: true };
+  }
+  return { take, _buckets: buckets };
+}
+
+// A version stamp from the instance: short, and only the characters a version
+// string or an OS name uses, so it cannot carry markdown or links into the task.
+function cleanStamp(v) {
+  if (typeof v !== 'string') return null;
+  const s = v.trim().slice(0, 40);
+  return /^[\w.+\- ]+$/.test(s) ? s : null;
+}
+
+// The task title: the first non-empty line, trimmed to fit.
+function feedbackTitle(message) {
+  const first = String(message).split('\n').map((l) => l.trim()).find(Boolean) || 'Feedback';
+  const title = first.length > TITLE_MAX ? `${first.slice(0, TITLE_MAX - 1)}…` : first;
+  return `Feedback: ${title}`;
+}
+
+function feedbackBody({ message, client, account, githubId, context = {} }) {
+  const who = account && account.github_login ? `@${account.github_login}` : `GitHub user ${githubId}`;
+  const project = client.name ? `${client.name} (${client.origin || client.client_id})` : (client.origin || client.client_id);
+  const stamps = [
+    ['Core', cleanStamp(context.core_version)],
+    ['CLI', cleanStamp(context.cli_version)],
+    ['OS', cleanStamp(context.os)],
+  ].filter(([, v]) => v).map(([k, v]) => `${k} ${v}`).join(' · ');
+  // The hub's own attribution comes FIRST and the sender's words follow as a
+  // quote, so text they type can never pose as the footer a reviewer trusts.
+  const quoted = String(message).trim().split('\n').map((l) => `> ${l}`).join('\n');
+  return [
+    'Sent from a managed project with `bongos feedback`.',
+    `- Project: ${project}`,
+    `- Sent by: ${who}`,
+    ...(stamps ? [`- Running: ${stamps}`] : []),
+    '',
+    quoted,
+  ].join('\n');
+}
+
+// fileInstanceFeedback — file one relayed report. `deps.capture` is the
+// `ideas.capture` port; `deps.getAccount` and `deps.hubBuilderId` read the hub's
+// own rows for the sender. Returns the landing the CLI prints.
+async function fileInstanceFeedback({ client, githubId, message, kind, context }, deps) {
+  const account = await deps.getAccount(githubId).catch(() => null);
+  const capturedBy = await deps.hubBuilderId(githubId).catch(() => null);
+  const idea = await deps.capture({
+    title: feedbackTitle(message),
+    bodyMd: feedbackBody({ message, client, account, githubId, context }),
+    kind: FEEDBACK_KINDS[kind],
+    capturedBy,
+    filerRank: null, // untrusted by design — see the header
+    filedVia: 'api',
+    vector: 'instance-feedback',
+    suggestedPriority: 3,
+  });
+  const routing = (idea && idea.routing) || {};
+  return routing.routed
+    ? { landed: 'task', task_id: String(routing.task_id), goal_id: String(routing.goal_id), status: routing.status, idea_id: String(idea.id) }
+    : { landed: 'inbox', idea_id: String(idea.id) };
+}
+
+module.exports = {
+  FEEDBACK_KINDS,
+  MESSAGE_MAX,
+  PER_SENDER_LIMIT,
+  PER_PROJECT_LIMIT,
+  FEEDBACK_WINDOW_MS,
+  makeFeedbackLimiter,
+  feedbackTitle,
+  feedbackBody,
+  fileInstanceFeedback,
+};

package/modules/platform-identity/module.json

@@ -16,5 +16,5 @@
     "pollers": ["code-sweep", "visibility-pull", "guild-totals"]
   },
   "provides": ["platform-identity.hub", "project.publishGate", "project.catalog"],
-  "consumes": []
+  "consumes": ["ideas.capture"]
 }