@bongos/core 1.20.37 → 1.20.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.37",
+  "version": "1.20.38",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8313,5 +8313,25 @@
       "id": "1004406",
       "text": "The unattended runner stops restarting every time anyone merges: it now updates its code in place and only restarts when its own code has changed."
     }
+  ],
+  "1.20.38": [
+    {
+      "id": "1004468",
+      "text": "The nightly auto-update now follows the update rule you set on /deploy for each project, instead of a file on the server."
+    },
+    {
+      "id": "1004453",
+      "text": "When you start Autobongos from the Gate page you can now pick a priority goal: the runner works that goal first and moves to the other allowed goals only when it runs out of work there."
+    },
+    {
+      "id": "1004472",
+      "text": "Fixes the broken automatic check on main that was stopping everyone's finished work from landing."
+    },
+    {
+      "text": "When a builder complains that Bongos isn't working, their assistant now reports it to the Bongos team by itself, so every frustration becomes something on the fix list."
+    },
+    {
+      "text": "Builders on any Cloud Bongos project can now send feedback about Bongos itself with one command, and it arrives with the Bongos team as a task waiting for approval."
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -106,6 +106,15 @@ function record(entry) {
   return row;
 }
 
+// pickedFrom — the row fields that say where a pick came from (task 1004453).
+// `priority` is true only when the fence named a priority goal AND this pick came
+// from it, so "the priority goal ran dry and the runner moved on" reads as
+// priority:false beside the goal it moved on to.
+function pickedFrom(goalId, gate) {
+  const p = gate && gate.priorityGoal != null ? gate.priorityGoal : null;
+  return { priority: p !== null && Number(goalId) === p };
+}
+
 // pickTask — the allowlisted goals, in order, through sequence.js's halt matrix.
 // The matrix is reused rather than re-derived: it already refuses thin specs,
 // protected paths, judgement kinds and unmet dependencies, from facts on the row.
@@ -479,7 +488,7 @@ async function iteration(opts, deps = {}) {
       // looks like, and it must still reach the failure ladder (task 1004179).
       if (lastRefusal) return lastRefusal;
       return log({
-        event: 'nothing_claimable', goals: gate.goals,
+        event: 'nothing_claimable', goals: gate.goals, priority_goal: gate.priorityGoal ?? null,
         // Carried so the cadence can tell an EMPTY queue from one where every task
         // halts — the reasons are the matrix's own codes, safe to print.
         skipped: (got.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
@@ -501,10 +510,10 @@ async function iteration(opts, deps = {}) {
       task: candidate, goals: gate.goals, protectedHits: matchProtected(candidate.touches || []),
     });
     if (!taskGate.go) {
-      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, globs: taskGate.globs || [] });
+      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, ...pickedFrom(got.goalId, gate), globs: taskGate.globs || [] });
     }
 
-    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId });
+    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId, ...pickedFrom(got.goalId, gate) });
 
     // 3. The task's own working tree.
     const name = deps.worktreeName ? deps.worktreeName(candidate.id) : worktreeName(candidate.id);
@@ -566,6 +575,7 @@ async function iteration(opts, deps = {}) {
 
   const row = {
     event: 'worked', task_id: task.id, title: task.title, goal_id: picked.goalId,
+    ...pickedFrom(picked.goalId, gate),
     worktree: wtName,
     outcome: verdict.outcome, reason: verdict.reason,
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
@@ -1043,7 +1053,7 @@ async function forever(opts, deps = {}) {
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a
       // corpse.
-      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined });
+      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined, working_goal_id: Number(row.goal_id) || undefined });
       const seen = cadence.classifyEvent(row);
       // A hold that names its reset SECOND waits until that second (task 1004454).
       // classifyEvent carries it as an absolute epoch; the cadence has no clock of

package/scripts/gds/feedback-send.js

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (task 1004462).
+//
+// Usage:
+//   bongos feedback "the claim command hung for two minutes"
+//   bongos feedback --idea "let me filter the task list by goal"
+//   bongos feedback --message-file notes.md
+//   [--json]
+//
+// Not the /feedback skill, which loads a locally recorded walkthrough into a
+// session. This SENDS: it posts to the builder's OWN project (POST /feedback,
+// src/bongos/routes/feedback.js), which relays it to the hub. A bug lands on the
+// hub as a 'backlog' task in the maintenance goal awaiting a maintainer's nod; an
+// idea lands in the hub's idea inbox. Only the typed text and version stamps
+// travel — never code, a transcript or file contents.
+
+'use strict';
+
+const os = require('node:os');
+const { cliClient, requireSession, argText, hasFlag, errCode, errDetails, cliExit } = require('./cli-lib');
+
+const USAGE = [
+  'usage:',
+  '  bongos feedback "what went wrong"          report a problem with Bongos',
+  '  bongos feedback --idea "what you wish for" suggest an improvement',
+  '  bongos feedback --message-file notes.md    send a longer note from a file',
+  '',
+  'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
+  'versions you run are sent — no code, chat or files from your project.',
+].join('\n');
+
+// The CLI release, as `bongos version` reports it: config/bongos-cli.json where
+// the core checkout carries it (an instance does not — task 1824), else the
+// package version. Read from disk, never required, so a vanilla core still runs.
+function cliVersion() {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
+    try {
+      const f = path.join(__dirname, rel);
+      if (fs.existsSync(f)) { const v = JSON.parse(fs.readFileSync(f, 'utf8')).version; if (v) return v; }
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+// The message: --message / --message-file, else every positional word joined.
+function readMessage(args) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args);
+  return args.filter((a) => !a.startsWith('--')).join(' ');
+}
+
+// Every report goes through the transcript-grade secret scrubber before it leaves
+// this machine (task 1004467). An assistant may file unasked when a builder vents,
+// so nobody reviews the text first — the scrubber is the check that does not
+// depend on the assistant's judgment. FAIL CLOSED: no scrubber, nothing is sent.
+// It also strips the builder's environment secrets by value, whatever their shape.
+function scrubReport(message, env = process.env) {
+  let scrub;
+  try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
+  const text = scrub.scrubSecrets(message, scrub.collectEnvSecrets(env));
+  const removed = text.split(scrub.REDACTED).length - message.split(scrub.REDACTED).length;
+  return { text, removed };
+}
+
+// Plain-language lines for each refusal the route can give.
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  validation_failed: 'That could not be sent as written — keep it under 4,000 characters, or split it into two.',
+  not_hub_connected: 'This project is not connected to Cloud Bongos, so feedback cannot be relayed from here.\n'
+    + 'Report it to the Bongos maintainers on the Bongos core repository instead.',
+  membership_required: 'Cloud Bongos does not yet know you as a member of this project.\n'
+    + 'Sign in to this project once through Cloud Bongos in a browser, then try again.',
+  rate_limited: 'Too much feedback from you or this project in the last hour. Try again later.',
+  feedback_unavailable: 'Cloud Bongos is not taking bug reports right now (no version is being built). Try again later.',
+  hub_unreachable: 'Could not reach Cloud Bongos. Check your connection and try again.',
+};
+
+async function main(argv = process.argv.slice(2)) {
+  if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
+  const json = hasFlag('--json', argv);
+  const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
+  const message = String(readMessage(argv) || '').trim();
+  if (!message) { console.error(USAGE); return 2; }
+
+  const scrubbed = scrubReport(message);
+  if (!scrubbed) {
+    console.error('Feedback was not sent: the secret filter that checks every report is missing from this install.');
+    return 1;
+  }
+
+  await requireSession();
+  const api = await cliClient();
+  const res = await api.request('POST', '/feedback', {
+    body: { message: scrubbed.text, kind, context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` } },
+  });
+  if (scrubbed.removed > 0 && !json) {
+    console.log(`Removed ${scrubbed.removed} secret-looking value(s) from the report before sending.`);
+  }
+
+  if (json) { console.log(JSON.stringify(res.data, null, 2)); return res.ok ? 0 : 1; }
+  if (!res.ok) {
+    const code = errCode(res.data);
+    const details = errDetails(res.data) || {};
+    let line = REFUSALS[code] || `Feedback was not sent (${code || `HTTP ${res.status}`}).`;
+    if (code === 'rate_limited' && details.retry_after_seconds) {
+      line += ` (in about ${Math.ceil(details.retry_after_seconds / 60)} min)`;
+    }
+    console.error(line);
+    return 1;
+  }
+  const d = res.data || {};
+  if (d.landed === 'task') {
+    console.log(`Thanks — sent to the Cloud Bongos maintainers as task ${d.task_id}.`);
+    console.log('It waits for a maintainer to approve it before anyone works on it.');
+    if (d.hub_origin) console.log(`${String(d.hub_origin).replace(/\/+$/, '')}/builders#/task/${d.task_id}`);
+  } else {
+    console.log(`Thanks — your idea is in the Cloud Bongos idea inbox (idea ${d.idea_id}) for the maintainers to review.`);
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
+  main().then((code) => cliExit(code), (err) => {
+    console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
+    cliExit(1);
+  });
+}
+
+module.exports = { main, readMessage, REFUSALS, scrubReport };

package/scripts/gds/update-channel.js

@@ -228,6 +228,82 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
   };
 }
 
+// ---- the per-project rule set on /deploy (task 1004468, ADR 0357) -----------
+// The owner sets each project's update rule on /deploy, which writes
+// provisioning_instances.update_channel (migration provisioning_029, task 1004445). That column
+// is the rule; the roster's `channel` is only the fallback for an entry no project row matches,
+// or for a sweep that cannot reach the database. Before this, the button followed the column and
+// the sweep followed the roster, so a project set to `minor` on /deploy was still swept as `patch`.
+//
+// Matched by slug — the one stable key the table has (it records no directory). Read over psql,
+// which is how upgrade.js recordLedger reaches a PGDATABASE (a bare name over the unix socket +
+// peer auth, the self-host shape). recordLedger uses the pg driver for DATABASE_URL; this passes
+// the URL to `psql -d` instead, because the sweep is synchronous and pg is not. With no psql the
+// sweep falls back to the roster and says so.
+//
+// A failure's reason is a fixed class, never psql's own text: stderr can name a DB user or host,
+// and the reason is printed into the sweep's log.
+const CHANNEL_SOURCE_DEPLOY = 'deploy';
+const CHANNEL_SOURCE_ROSTER = 'roster';
+const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
+const DB_CHANNELS_TIMEOUT_MS = 15000;
+
+// PURE. psql's stderr reduced to a class that is safe to log.
+function psqlFailureClass(stderr) {
+  const s = String(stderr || '');
+  if (/relation .*provisioning_instances.* does not exist/i.test(s)) return 'no provisioning_instances table (provisioning module off?)';
+  if (/column .*update_channel.* does not exist/i.test(s)) return 'no update_channel column (migration provisioning_029 not applied)';
+  if (/authentication failed|role .* does not exist|permission denied/i.test(s)) return 'the sweep\'s database login was refused';
+  if (/could not connect|connection refused|no such file or directory|could not translate host/i.test(s)) return 'database unreachable';
+  if (/database .* does not exist/i.test(s)) return 'the named database does not exist';
+  return 'query failed';
+}
+
+// The line a sweep prints for one entry's channel. PURE.
+function channelLine(inst) {
+  return `  • ${inst.slug}: channel ${inst.channel}, ${inst.channelNote}`;
+}
+
+// Read every project's update rule. Never throws: { ok:true, channels: Map<slug, channel> }, or
+// { ok:false, reason } when there is no database to ask, psql is missing, or the table is absent
+// (an instance with the provisioning module off). The caller falls back to the roster and says why.
+function readDbChannels({ env = process.env, run = spawnSync } = {}) {
+  const target = env.DATABASE_URL || env.PGDATABASE;
+  if (!target) return { ok: false, reason: 'no DATABASE_URL or PGDATABASE set for the sweep' };
+  const r = run('psql', ['-d', target, '-At', '-F', '\t', '-v', 'ON_ERROR_STOP=1', '--no-psqlrc', '-c', DB_CHANNELS_SQL],
+    { encoding: 'utf8', timeout: DB_CHANNELS_TIMEOUT_MS });
+  if (!r || r.error) {
+    const code = r && r.error && r.error.code;
+    return { ok: false, reason: code === 'ENOENT' ? 'psql not found' : code === 'ETIMEDOUT' ? 'psql timed out' : 'psql could not be started' };
+  }
+  if (r.status !== 0) return { ok: false, reason: `psql exit ${r.status}: ${psqlFailureClass(r.stderr)}` };
+  const channels = new Map();
+  for (const line of String(r.stdout || '').split('\n')) {
+    const [slug, ch] = line.split('\t');
+    if (slug && ch) channels.set(slug.trim(), ch.trim());
+  }
+  return { ok: true, channels };
+}
+
+// PURE. Give each roster entry the channel it is actually under, and say where it came from:
+// `channelSource` is 'deploy' (the project row) or 'roster', `channelNote` the one-line reason a
+// sweep log prints. The roster's own value is kept as `rosterChannel`, so a disagreement stays
+// visible in the log instead of silently vanishing.
+function applyDbChannels(instances, db) {
+  return instances.map((inst) => {
+    if (db && db.ok && db.channels.has(inst.slug)) {
+      const ch = normalizeChannel(db.channels.get(inst.slug));
+      const differs = ch !== inst.channel;
+      return {
+        ...inst, channel: ch, channelSource: CHANNEL_SOURCE_DEPLOY, rosterChannel: inst.channel,
+        channelNote: `set on /deploy${differs ? ` (roster says ${inst.channel}, ignored)` : ''}`,
+      };
+    }
+    const why = db && db.ok ? 'no project row for this slug' : (db && db.reason) || 'database not read';
+    return { ...inst, channelSource: CHANNEL_SOURCE_ROSTER, rosterChannel: inst.channel, channelNote: `from the roster — ${why}` };
+  });
+}
+
 // ---- reporting: make "nothing happened" audible -----------------------------
 
 // Turn a loadSubscriptions() result into the line a routine prints EVERY run, plus a level a caller
@@ -322,6 +398,12 @@ module.exports = {
   listAvailableVersions,
   parseNpmViewVersions,
   loadSubscriptions,
+  readDbChannels,
+  applyDbChannels,
+  channelLine,
+  psqlFailureClass,
+  CHANNEL_SOURCE_DEPLOY,
+  CHANNEL_SOURCE_ROSTER,
   ROSTER_OK,
   ROSTER_ABSENT,
   ROSTER_MALFORMED,

package/src/bongos/routes/feedback.js

@@ -0,0 +1,110 @@
+'use strict';
+
+// src/bongos/routes/feedback.js — POST /api/bongos/feedback (task 1004462).
+//
+// `bongos feedback "…"` lands here, on the builder's OWN project, with the session
+// they already hold. This route stamps who sent it and which core this project
+// runs, then relays it to the hub's POST /sso/feedback over the hub-federation
+// client credential (ADR 0141) — the channel the activity rollup already uses. So
+// a builder never signs in to cloudbongos.com to report something about Bongos.
+//
+// Only the text the builder typed and version stamps travel. No code, transcript,
+// task or file content from this project is attached.
+//
+// In the CORE, not a module, for the reason core-update.js gives: the hub link is
+// kernel (src/bongos/auth-config.js), and every hosted project must have this door
+// whatever modules it runs. A project with no hub link (self-hosted, or the hub
+// itself) answers 409 not_hub_connected — told, not silently dropped.
+
+const express = require('express');
+const { asyncHandler, validateOrRespond } = require('./_helpers');
+const auth = require('../auth');
+const { loadIdpConfig } = require('../auth-config');
+const { userAgent } = require('../../branding');
+
+const MESSAGE_MAX = 4000;
+const HUB_TIMEOUT_MS = 15000;
+
+function safeIdpConfig() {
+  try { return loadIdpConfig(); } catch { return null; }
+}
+
+function runningCore() {
+  try { return require('../../module-api').CORE_VERSION || null; } catch { return null; }
+}
+
+// Hub refusals the builder can act on are passed through by code; anything else
+// is one generic failure, so the hub's internals never leak through this door.
+const PASS_THROUGH = new Set(['membership_required', 'rate_limited', 'feedback_unavailable', 'validation_failed']);
+
+async function relayToHub({ idp, builder, message, kind, context, fetchImpl = fetch }) {
+  const res = await fetchImpl(`${idp.origin.replace(/\/+$/, '')}/api/bongos/sso/feedback`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+    body: JSON.stringify({
+      client_id: idp.clientId,
+      client_secret: idp.clientSecret,
+      github_id: builder.github_id,
+      message,
+      kind,
+      context,
+    }),
+    signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
+  });
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON answer */ }
+  return { status: res.status, body };
+}
+
+function buildFeedbackRouter({ idpConfig = safeIdpConfig, fetchImpl = fetch } = {}) {
+  const router = express.Router();
+
+  // rank: any signed-in builder — reporting a problem with Bongos grants nothing
+  // here, and the hub files every report at 'backlog' behind a Metic+ nod.
+  router.post(
+    '/feedback',
+    auth.requireBuilder,
+    asyncHandler('POST /feedback', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        message: { required: true, type: 'string', maxLength: MESSAGE_MAX },
+        kind: { type: 'string', enum: ['bug', 'idea'] },
+        context: {},
+      })) return;
+      const b = req.body || {};
+      const message = b.message.trim();
+      if (!message) return res.fail('message_required', 400);
+      const kind = b.kind || 'bug';
+
+      const idp = idpConfig();
+      if (!idp) return res.fail('not_hub_connected', 409);
+
+      const ctx = b.context && typeof b.context === 'object' ? b.context : {};
+      const context = {
+        core_version: runningCore(),
+        cli_version: typeof ctx.cli_version === 'string' ? ctx.cli_version.slice(0, 40) : null,
+        os: typeof ctx.os === 'string' ? ctx.os.slice(0, 40) : null,
+      };
+
+      let hub;
+      try {
+        hub = await relayToHub({ idp, builder: req.builder, message, kind, context, fetchImpl });
+      } catch {
+        return res.fail('hub_unreachable', 502);
+      }
+      if (hub.status === 201 && hub.body && hub.body.ok) {
+        const { ok: _ok, ...landing } = hub.body;
+        return res.status(201).json({ ok: true, hub_origin: idp.origin, ...landing });
+      }
+      const err = hub.body && hub.body.error && typeof hub.body.error === 'object' ? hub.body.error : null;
+      if (err && PASS_THROUGH.has(err.code)) {
+        const retry = err.details && err.details.retry_after_seconds;
+        return res.fail(err.code, hub.status, retry ? { retry_after_seconds: retry } : undefined);
+      }
+      return res.fail('hub_refused', 502, { hub_status: hub.status });
+    }, { errorCode: 'feedback_failed', message: false }),
+  );
+
+  return router;
+}
+
+module.exports = buildFeedbackRouter;

package/src/bongos/routes.js

@@ -20,6 +20,7 @@ const express = require('express');
 const buildHealthzRouter = require('./routes/healthz');
 const buildInstanceRouter = require('./routes/instance');
 const buildCoreUpdateRouter = require('./routes/core-update');
+const buildFeedbackRouter = require('./routes/feedback');
 const buildAuthRouter = require('./routes/auth');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
@@ -144,6 +145,7 @@ function buildGdsRouter() {
   router.use(buildHealthzRouter());
   router.use(buildInstanceRouter());
   router.use(buildCoreUpdateRouter());
+  router.use(buildFeedbackRouter());
   router.use(buildAuthRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.37'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.38'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_fence.mjs

@@ -260,3 +260,65 @@ test('no request means every allowlisted goal', () => {
   assert.deepEqual(allowedGoals(f, []).goals, [1, 2]);
   assert.deepEqual(allowedGoals(f).goals, [1, 2]);
 });
+
+// ── the priority goal (task 1004453) ────────────────────────────────────────────
+//
+// Owner ruling: whoever starts the runner names the goal it works FIRST, as well as
+// the set it may touch. The priority ORDERS the allowlist; it must never widen it.
+
+test('the priority goal is read off the fence and moved to the front', () => {
+  const f = open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 });
+  assert.equal(normaliseFence(f).priorityGoal, 3);
+  const d = decideRun({ fence: f, ...GRADER_OK });
+  assert.equal(d.go, true);
+  assert.deepEqual(d.goals, [3, 1, 2], 'the runner walks goals in this order, so the priority goes first');
+  assert.equal(d.priorityGoal, 3);
+});
+
+test('a priority that is not on the allowlist is ignored, never added', () => {
+  // The database refuses this with a foreign key; the pure half refuses it again,
+  // because a priority that could add a goal would be a second, unguarded allowlist.
+  const f = open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: 99 });
+  assert.equal(normaliseFence(f).priorityGoal, null);
+  const d = decideRun({ fence: f, ...GRADER_OK });
+  assert.deepEqual(d.goals, [1, 2]);
+  assert.equal(d.priorityGoal, null);
+});
+
+test('a malformed or missing priority reads as "no priority", not as a refusal', () => {
+  for (const p of [undefined, null, '', 0, -4, 'abc', 1.5, {}]) {
+    const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: p }), ...GRADER_OK });
+    assert.equal(d.go, true, `priority ${JSON.stringify(p)} must not stop the run`);
+    assert.deepEqual(d.goals, [1, 2], `priority ${JSON.stringify(p)} must not reorder`);
+    assert.equal(d.priorityGoal, null);
+  }
+});
+
+test('a stringified priority id (a bigint from the database) still counts', () => {
+  const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }], priority_goal_id: '2' }), ...GRADER_OK });
+  assert.deepEqual(d.goals, [2, 1]);
+  assert.equal(d.priorityGoal, 2);
+});
+
+test('narrowing on the command line keeps the priority first, and can drop it', () => {
+  const f = normaliseFence(open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 }));
+  assert.deepEqual(allowedGoals(f, [1, 3]).goals, [3, 1]);
+  // An operator narrowing to goals that leave the priority out gets no priority —
+  // it is not quietly re-added behind their back.
+  assert.deepEqual(allowedGoals(f, [1, 2]).goals, [1, 2]);
+  const d = decideRun({ fence: open({ goals: [{ goal_id: 1 }, { goal_id: 2 }, { goal_id: 3 }], priority_goal_id: 3 }), requestedGoals: [1, 2], ...GRADER_OK });
+  assert.equal(d.priorityGoal, null, 'a row must not claim a pick came from a priority this run excluded');
+});
+
+test('prioritise only reorders: same members, same count', () => {
+  assert.deepEqual(fence.prioritise([5, 6, 7], 6), [6, 5, 7]);
+  assert.deepEqual(fence.prioritise([5, 6, 7], 8), [5, 6, 7]);
+  assert.deepEqual(fence.prioritise([5, 6, 7], null), [5, 6, 7]);
+});
+
+test('a closed fence still refuses whatever the priority says', () => {
+  const d = decideRun({ fence: open({ enabled: false, priority_goal_id: 1000119 }), ...GRADER_OK });
+  assert.equal(d.go, false);
+  assert.equal(d.code, 'kill_switch');
+  assert.deepEqual(d.goals, []);
+});

package/tests/autobongos_loop.mjs

@@ -1303,3 +1303,79 @@ test('past the uptime floor, a drift still exits', async () => {
   });
   assert.equal(code, runner.UPGRADE_EXIT_CODE);
 });
+
+// ── the priority goal reaches the picker, the rows and the heartbeat (task 1004453) ──
+
+const twoGoalFence = (priority) => async () => ({
+  raw: { enabled: true, paused_reason: null, goals: [{ goal_id: 1000119 }, { goal_id: 1000090 }], priority_goal_id: priority },
+  graderBypassed: false,
+});
+
+test('the picker is handed the priority goal first', async () => {
+  let sawGoals = null;
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async (goals) => { sawGoals = goals; return { task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }; },
+  });
+  await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.deepEqual(sawGoals, [1000090, 1000119]);
+});
+
+test('a worked row says its pick came from the priority goal', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: { ...aTask, goal_id: 1000090 }, goalId: 1000090, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000090);
+  assert.equal(row.priority, true);
+});
+
+test('once the priority goal runs dry, a pick from the rest reads priority:false', async () => {
+  const h = harness({
+    readFence: twoGoalFence(1000090),
+    pickTask: async () => ({ task: aTask, goalId: 1000119, skipped: [] }),
+  });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.goal_id, 1000119);
+  assert.equal(row.priority, false);
+});
+
+test('with no priority set, no pick claims to be one', async () => {
+  const h = harness({ readFence: twoGoalFence(null) });
+  const row = await runner.iteration({ ...opts, goals: [] }, h.deps);
+  assert.equal(row.priority, false);
+});
+
+test('a dry run and an empty queue both name the priority', async () => {
+  const dry = await runner.iteration({ ...opts, goals: [], dryRun: true }, harness({
+    readFence: twoGoalFence(1000119),
+  }).deps);
+  assert.equal(dry.event, 'dry_run');
+  assert.equal(dry.priority, true);
+  const none = await runner.iteration({ ...opts, goals: [] }, harness({
+    readFence: twoGoalFence(1000119),
+    pickTask: async () => ({ none: true, skipped: [] }),
+  }).deps);
+  assert.equal(none.event, 'nothing_claimable');
+  assert.equal(none.priority_goal, 1000119);
+});
+
+test('the server heartbeat carries the goal the current task came from', async () => {
+  const beats = [];
+  await runner.forever({ goals: [], maxTasks: 1, maxLoops: 1 }, {
+    iteration: async () => ({ event: 'worked', task_id: 4242, goal_id: 1000090, priority: true }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async (fields) => { beats.push(fields); return true; },
+    emit: () => {},
+    record: (r) => r,
+    codeDrifted: async () => false,
+  });
+  const b = beats.find((x) => x.working_task_id === 4242);
+  assert.ok(b, 'the beat after a worked row must name its task');
+  assert.equal(b.working_goal_id, 1000090);
+});