@bongos/core 1.20.73 → 1.20.75

package/modules/government/catalog.js

@@ -216,6 +216,9 @@ const PERMISSIONS = [
   { key: 'goal.scope.widen', system: false, floor: 'metic', guards: 'POST /goals/:id/scope (same-tier; cross-tier = goal.scope.manage, system)' },
   { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable' },
   { key: 'module.submit', system: false, floor: 'metic', guards: 'POST /modules/:key/submit, GET /modules/submissions' },
+  // Re-run a store version's automatic assessment (task 1003796, ADR 0359). Never a
+  // hand-set score: the owner ruled a person may ask for a re-check, not change the number.
+  { key: 'module.assessment.rerun', system: false, floor: 'metic', guards: 'POST /store/modules/:key/versions/:version/reassess' },
   { key: 'security.report.file', system: false, floor: 'metic', guards: 'POST /security/reports, GET /security/adr' },
   { key: 'llm_cache.use', system: false, floor: 'metic', guards: 'POST /llm-cache/{lookup,store}' },
   { key: 'backup.manage', system: false, floor: 'metic', guards: 'GET /backup/status, POST /backup/trigger' },

package/modules/government/migrations/government_021_module_assessment_rerun.sql

@@ -0,0 +1,36 @@
+-- government_021_module_assessment_rerun.sql — grant the new
+-- `module.assessment.rerun` atom to Metic and Archon (task 1003796, ADR 0359).
+--
+-- WHAT IT IS. A Metic+ person may ask the store to re-run a published version's
+-- automatic assessment (the Security gate, the Docs grader, then the score). It
+-- never sets a score by hand: the owner ruled (2026-10-01) that nobody may change
+-- a module's score, only trigger a re-check. A re-run costs about 5 cents (one
+-- Docs grader call), which is why it is Metic+ and not open to every builder.
+--
+-- WHY THIS FILE EXISTS. RANK_SEED is derived from the catalog's floors, and the
+-- drift guard (tests/government_seed.mjs) compares it against the union of the
+-- run-once seed plus every later grant migration, per rank. A metic-floor key is
+-- held by metic AND archon, so both are granted here.
+--
+-- Additive only: one new permission key granted to two ranks; nothing is revoked.
+-- Approved by the owner (Will, Archon) on 2026-10-01.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'module.assessment.rerun'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'module.assessment.rerun'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/provisioning/routes/provisioning.js

@@ -21,6 +21,9 @@
 //                                                      An `adopt` ALSO passes the credential
 //                                                      preflight — ../credential-preflight.js,
 //                                                      task 1002909; greenfield is exempt; a full box → 409, ../capacity-gate.js)
+//     POST   /provisioning/physics-check           — the planet-physics read before anything exists:
+//                                                     the screening stop + the soft-limit table
+//                                                     for the answers so far; writes nothing (task 1004418)
 //     GET    /provisioning/instances               — list the caller's instances
 //     GET    /provisioning/instances/:id           — read one of the caller's instances
 //                                                     (also SELF-HEALS its catalog projection,
@@ -196,6 +199,14 @@ module.exports = function provisioningRoutes() {
     max: 10,
     key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
   });
+  // Limiter for the planet-physics read (task 1004418). Signed-in and writes nothing,
+  // but the wizard asks it as the founder answers the four questions, so it is a
+  // repeated check like the slug one: 60 a minute is roomy for a person clicking
+  // through and sheds a loop. Keyed on the BUILDER for the slug check's reason.
+  const physicsCheckRateLimit = makeAskRateLimiter({
+    max: 60,
+    key: (req) => (req.builder ? `b:${req.builder.id}` : clientIp(req)),
+  });
 
   // Route ORDER is deliberate (the box.js precedent): the Archon-gated routes are
   // declared FIRST, then the any-builder routes. The route-rank auditor
@@ -285,6 +296,30 @@ module.exports = function provisioningRoutes() {
     }
   });
 
+  // POST /provisioning/physics-check — the planet-physics questions' read BEFORE anything
+  // exists (task 1004418, BV2.PS07). The create wizard asks it as the founder answers:
+  // would this description stop at the screening screen, and which options do the
+  // answers so far hide, grey or annotate (the PS02 soft-limit table, spec D6)? It is
+  // the same screen and the same table the create runs, so the screens can never
+  // disagree with the Create. Writes nothing, and the soft limits stay advice
+  // (`enforced: false`); the create still re-checks everything itself.
+  router.post('/provisioning/physics-check', auth.requireBuilder, physicsCheckRateLimit, (req, res) => {
+    if (validateOrRespond(req, res, {
+      description: { type: 'string', maxLength: provisioning.DESCRIPTION_MAX },
+      detail: { type: 'object' },
+    })) return;
+    const body = req.body || {};
+    const detailFault = badProjectDetail(body.detail);
+    if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
+    const screened = screenedOut(body.description);
+    res.set('Cache-Control', 'no-store');
+    res.json({
+      stop: !!screened,
+      message: screened ? screened.message : null,
+      soft_limits: provisioning.softLimitsFor(body.detail || {}),
+    });
+  });
+
   // POST /provisioning/instances — request a new instance. rank: any authenticated
   // builder (own resource) for `byo-host`, and for their FIRST live `cloud-host` (task
   // 1004412, ADR 0354). A further cloud-host needs provisioning.fleet.manage, and

package/modules/public-landing/public/assets/cosmos.css

@@ -1603,7 +1603,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the six-step strip as the rail: six hairlines, a 7px dot, one lit step on the
    accent with its halo, the number in the display voice, the name in the label
    face; a step already answered (role=button) stays a way back */
-#view-new .steps{display:grid;grid-template-columns:repeat(9,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
+#view-new .steps{display:grid;grid-template-columns:repeat(10,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
 #view-new .steps li{display:block;position:relative;border-top:1px solid var(--rule);padding:12px 0 0;gap:0;}
 #view-new .steps li::before{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;margin:0;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
 #view-new .steps .snum{display:block;width:auto;height:auto;border:0;border-radius:0;background:none;font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;line-height:1.1;color:var(--ink-faint);margin-bottom:2px;}