@bongos/core 1.20.79 → 1.20.81

package/modules/autonomy/fence.js

@@ -49,8 +49,78 @@ const REFUSALS = {
   goal_not_allowlisted: 'that goal is not on the allowlist',
   protected_path: 'the task declares work on a permission, migration, infrastructure or deploy-pipeline surface',
   grader_unavailable: 'the grader is bypassed, and it is the only review between an unattended worker and main',
+  not_permitted: 'your rank does not hold autonomy.run, so your runner may not work on this project',
+  builder_paused: 'the owner paused your runner',
+  no_builder_scope: 'you have not picked any goals for your runner — choose them in Settings',
 };
 
+// The stop codes effectiveFence may set, and the refusal each one becomes.
+const STOP_CODES = new Set(['kill_switch', 'not_permitted', 'builder_paused']);
+
+// effectiveFence — the fence ONE builder's runner reads (task 1004501).
+//
+// The project fence is one switch and one allowlist; each builder narrows it to the
+// goals they picked, and the owner can pause one builder without throwing the
+// master switch. This composes the three on the SERVER, so the runner stays dumb:
+// it reads `enabled` and `goals` exactly as before and cannot compute its own
+// widening, and a runner that predates this change gets the narrowing for free.
+//
+// The order is the order an operator asks "why is it idle": the project switch
+// first (it stops everyone), then whether this builder may run at all, then the
+// owner's pause on this builder. Each one wins over the ones after it.
+//
+// Empty picks mean NO goals, by owner ruling (2026-10-01): a builder who has set
+// nothing gets no autonomous work. Never "the whole allowlist".
+//
+// `project` is db.readFence()'s shape; `scope` is db.readBuilderScope()'s
+// ({ goals:[ids], owner_paused, owner_paused_reason, updated_at }) or null for a
+// builder with no row; `mayRun` is the autonomy.run answer, where anything but
+// `true` refuses. Returns null when the project fence is null (unreadable).
+function effectiveFence({ project, scope = null, mayRun = false } = {}) {
+  if (!project || typeof project !== 'object') return null;
+  const picks = new Set(((scope && scope.goals) || []).map(Number).filter((n) => Number.isSafeInteger(n) && n > 0));
+  const projectGoals = Array.isArray(project.goals) ? project.goals : [];
+  const goals = projectGoals.filter((g) => picks.has(Number(g && g.goal_id)));
+  const ids = goals.map((g) => Number(g.goal_id));
+  const priority = project.priority_goal_id != null && ids.includes(Number(project.priority_goal_id))
+    ? Number(project.priority_goal_id) : null;
+
+  let enabled = project.enabled === true;
+  let stopCode = enabled ? null : 'kill_switch';
+  let pausedReason = enabled ? null : (project.paused_reason || null);
+  if (enabled && mayRun !== true) {
+    enabled = false; stopCode = 'not_permitted'; pausedReason = REFUSALS.not_permitted;
+  } else if (enabled && scope && scope.owner_paused === true) {
+    enabled = false; stopCode = 'builder_paused';
+    pausedReason = scope.owner_paused_reason ? `${REFUSALS.builder_paused}: ${scope.owner_paused_reason}` : REFUSALS.builder_paused;
+  }
+
+  // The later of the two rows, so a pick or a pause wakes a runner that waits on
+  // the fence's updated_at exactly as a project change does.
+  const stamps = [project.updated_at, scope && scope.updated_at].filter(Boolean).map((t) => new Date(t).getTime()).filter(Number.isFinite);
+  const updatedAt = stamps.length ? new Date(Math.max(...stamps)).toISOString() : (project.updated_at || null);
+
+  return {
+    enabled,
+    paused_reason: pausedReason,
+    stop_code: stopCode,
+    priority_goal_id: priority,
+    updated_at: updatedAt,
+    updated_by: project.updated_by ?? null,
+    goals,
+    // What the caller chose and may do, so the Settings panel and the runner log
+    // can say WHY the goals are what they are without a second read.
+    scope: {
+      may_run: mayRun === true,
+      goals: [...picks],
+      owner_paused: !!(scope && scope.owner_paused === true),
+      owner_paused_reason: (scope && scope.owner_paused_reason) || null,
+    },
+    // The unnarrowed project fence, for the owner's gate page.
+    project,
+  };
+}
+
 // normaliseFence — turn whatever the route returned into something decidable, or
 // null for "unreadable". Deliberately strict: a shape this does not recognise is
 // unreadable, never a permissive default.
@@ -81,9 +151,18 @@ function normaliseFence(raw) {
   // the old behaviour, not a refusal: the allowlist alone is still a safe answer.
   const p = Number(raw.priority_goal_id);
   const priorityGoal = raw.priority_goal_id != null && Number.isSafeInteger(p) && p > 0 && ids.includes(p) ? p : null;
+  // Which layer turned it off (task 1004501). Only the known codes are honoured;
+  // anything else, including a server that predates them, reads as the kill switch,
+  // which refuses just the same.
+  const stopCode = STOP_CODES.has(raw.stop_code) ? raw.stop_code : 'kill_switch';
+  // A builder who has picked nothing gets nothing (owner ruling, 2026-10-01). Said
+  // as its own refusal so the log does not blame an empty project allowlist.
+  const noScope = !!(raw.scope && Array.isArray(raw.scope.goals) && raw.scope.goals.length === 0);
   return {
     enabled: raw.enabled === true,
     pausedReason: typeof raw.paused_reason === 'string' ? raw.paused_reason : null,
+    stopCode,
+    noScope,
     goals: ids,
     priorityGoal,
   };
@@ -129,6 +208,11 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
   if (!fence) return { go: false, code: 'fence_unreadable', reason: REFUSALS.fence_unreadable, goals: [] };
 
   if (!fence.enabled) {
+    // The builder-level stops carry their full sentence already (effectiveFence
+    // wrote it); only the project switch is prefixed, as before.
+    if (fence.stopCode !== 'kill_switch') {
+      return { go: false, code: fence.stopCode, goals: [], reason: fence.pausedReason || REFUSALS[fence.stopCode] };
+    }
     return {
       go: false, code: 'kill_switch', goals: [],
       reason: fence.pausedReason ? `${REFUSALS.kill_switch}: ${fence.pausedReason}` : REFUSALS.kill_switch,
@@ -148,12 +232,13 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
 
   const { goals, refused } = allowedGoals(fence, requestedGoals);
   if (!goals.length) {
+    const code = refused.length ? 'goal_not_allowlisted' : (fence.noScope ? 'no_builder_scope' : 'no_allowlist');
     return {
       go: false, goals: [], refusedGoals: refused,
-      code: refused.length ? 'goal_not_allowlisted' : 'no_allowlist',
+      code,
       reason: refused.length
         ? `${REFUSALS.goal_not_allowlisted} (asked for ${refused.join(', ')})`
-        : REFUSALS.no_allowlist,
+        : REFUSALS[code],
     };
   }
   // priorityGoal is reported only when it survived the intersection, so a row can
@@ -191,4 +276,4 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, decideRun, decideTask };
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask };

package/modules/autonomy/migrations/autonomy_005_builder_scope.sql

@@ -0,0 +1,55 @@
+-- autonomy_005_builder_scope.sql — each builder's own runner scope, and the
+-- owner's per-builder pause (task 1004501).
+--
+-- Owner ruling, 2026-10-01: every builder says which work THEIR runner takes, and
+-- a builder who has said nothing gets NO autonomous work. Until now the fence was
+-- one switch and one list for every runner on the instance, so the owner could not
+-- stop one builder's machine without stopping all of them, and a builder could not
+-- narrow theirs to the goals they care about.
+--
+-- A NARROWING, NEVER A WIDENING. A builder's picks are a subset of the project
+-- allowlist, and the database holds that rather than a route remembering it:
+-- goal_id references autonomy_allowed_goals, so a goal that is not allowlisted
+-- cannot be picked at all. ON DELETE CASCADE is the safe direction: revoking a
+-- goal from the project removes it from every builder's picks, and re-allowing it
+-- later does NOT silently put it back. The runner's effective goals are
+-- project allowlist ∩ the caller's picks, computed on the server.
+--
+-- ON THE SERVER, for autonomy_001's reason. These rows bound what a machine nobody
+-- is watching may do; a pick list in a file on that machine would be writable by
+-- the very worker it bounds. The builder writes their own picks through an
+-- authenticated route keyed by their session, never by a body field.
+--
+-- autonomy_builder_scope holds the one row per builder that is not a list:
+--   owner_paused         the owner stopped THIS builder's runner. Written only by
+--                        the autonomy.fence.manage route; the builder cannot clear
+--                        it, because a pause the paused party can lift is not one.
+--   owner_paused_reason  why, shown to the builder and printed by their runner.
+--   owner_paused_by      who.
+--   updated_at           bumped on every pick or pause change. The route folds it
+--                        into the fence's updated_at, which is how a change wakes
+--                        a runner that is waiting for a signal.
+--
+-- No foreign key to builders, like autonomy_002: a row for a removed builder is
+-- inert, because no session can ever read it.
+--
+-- Additive and idempotent (ADR 0083 §Decision #5): safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS autonomy_builder_goals (
+  builder_id bigint NOT NULL,
+  goal_id    bigint NOT NULL REFERENCES autonomy_allowed_goals (goal_id) ON DELETE CASCADE,
+  added_at   timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (builder_id, goal_id)
+);
+
+CREATE TABLE IF NOT EXISTS autonomy_builder_scope (
+  builder_id          bigint PRIMARY KEY,
+  owner_paused        boolean NOT NULL DEFAULT false,
+  owner_paused_reason text,
+  owner_paused_by     bigint,
+  updated_at          timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -28,6 +28,7 @@ const auth = api;
 // neither core internals nor a sibling module, so importing it here is allowed.
 const autonomyGate = require('../../../scripts/gds/autonomy-gate');
 const db = require('../db');
+const fence = require('../fence');
 const runnerHealth = require('../runner-health');
 // The doorway's namespaced logger and strict body validator. Raw console.* is
 // ratcheted repo-wide (fitness.js console_call_count) and unstructured besides.
@@ -52,6 +53,49 @@ function runsLimit(raw) {
   return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
 }
 
+// holdsPermission — does this builder hold `key`? Asked of the government port
+// rather than mounted as a gate, because GET /autonomy/fence must answer EVERY
+// builder (a runner must always be able to learn it should stop); only the answer
+// changes. Fails closed: no port, or a resolver that throws, reads as "not held",
+// which turns the caller's fence off rather than on. The rot.js precedent.
+//
+// THE FOLD FIRST. This runs on the runner's read, every iteration of every runner,
+// so it must not add a query. requireBuilder already carries the session's grant
+// keys (`req.rawPermissionKeys`, the session-grants fold of task 1002556), and the
+// government port folds them into the held set in memory — the same path
+// requirePermission takes. The DB resolve is only the fallback for a session row
+// that did not carry the keys, exactly as in requirePermission.
+async function holdsPermission(req, key) {
+  try {
+    const governance = api.resolveOptional('government');
+    if (!governance) return false;
+    if (Array.isArray(req.rawPermissionKeys) && typeof governance.effectivePermissions === 'function') {
+      try {
+        return new Set(governance.effectivePermissions(req.rawPermissionKeys)).has(key);
+      } catch (err) {
+        log.error(`autonomy: permission fold failed for ${key} — falling back to the resolve: ${err && err.message}`);
+      }
+    }
+    if (typeof governance.builderHasPermissions !== 'function') return false;
+    return (await governance.builderHasPermissions(Number(req.builder.id), [key])) === true;
+  } catch (err) {
+    log.error(`autonomy: permission resolve failed for ${key} — denying fail-closed: ${err && err.message}`);
+    return false;
+  }
+}
+
+// goalIdsOrNull — a list of positive integer goal ids, or null for a malformed one.
+function goalIdsOrNull(v) {
+  if (!Array.isArray(v) || v.length > 200) return null;
+  const out = [];
+  for (const g of v) {
+    const n = Number(g);
+    if (!Number.isSafeInteger(n) || n <= 0) return null;
+    out.push(n);
+  }
+  return out;
+}
+
 // commitOrNull — a full lowercase commit sha, or null (task 1004407).
 function commitOrNull(v) {
   return typeof v === 'string' && /^[0-9a-f]{40}$/.test(v) ? v : null;
@@ -102,15 +146,24 @@ module.exports = function buildAutonomyRouter() {
   // you must stop should never require an elevated session, because the failure
   // mode of "could not read the fence" is a machine that keeps going. The body
   // carries no secret — it is a boolean, a reason string and a list of goal ids.
+  //
+  // THE CALLER'S fence, not the project's (task 1004501). The top-level `enabled`
+  // and `goals` are what THIS builder's runner may do: the project switch, then
+  // `autonomy.run`, then the owner's pause on this builder, and the allowlist
+  // narrowed to their own picks (fence.js effectiveFence). Computing it here keeps
+  // the runner dumb and means a runner that predates this change is narrowed too.
+  // The unnarrowed project fence rides along as `project` for the owner's page.
   router.get('/autonomy/fence', auth.requireBuilder, async (req, res) => {
     try {
-      const fence = await db.readFence();
+      const [project, scope, mayRun] = await Promise.all([
+        db.readFence(), db.readBuilderScope(req.builder.id), holdsPermission(req, 'autonomy.run'),
+      ]);
       // Null means the singleton row is missing, i.e. the migration has not run.
       // Say so rather than synthesising a default: a fabricated { enabled: false }
       // is indistinguishable from a real one, and an operator would chase a kill
       // switch nobody threw.
-      if (!fence) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
-      res.json(fence);
+      if (!project) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      res.json(fence.effectiveFence({ project, scope, mayRun }));
     } catch (err) {
       log.error('[gds] GET /autonomy/fence', err);
       // FAIL CLOSED, unlike the precheck above. That one is fail-open because an
@@ -202,6 +255,73 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // ── each builder's own runner scope (task 1004501) ─────────────────────────
+
+  // A builder picks which allowlisted goals THEIR runner works. Replaces the whole
+  // list; `[]` means "my runner takes no work". Keyed by the session, never the
+  // body, so nobody can set another builder's picks. Behind `autonomy.run`: a
+  // builder who may not run a runner has nothing to scope. A goal not on the
+  // project allowlist is refused with 409 and nothing is written — the pick can
+  // narrow the project fence and never widen it.
+  router.put('/autonomy/me/goals', auth.requireBuilder, auth.requirePermission('autonomy.run'), async (req, res) => {
+    if (validateOrRespond(req, res, { goal_ids: { required: true } })) return;
+    const goalIds = goalIdsOrNull(req.body && req.body.goal_ids);
+    if (!goalIds) return res.fail('goal_ids_required', { status: 400, message: 'pass { "goal_ids": [<number>, …] } — an empty list means no work' });
+    try {
+      const out = await db.setBuilderGoals({ builderId: req.builder.id, goalIds });
+      if (out.notAllowed) return res.fail('goal_not_allowlisted', { status: 409, message: `not on the project allowlist: ${out.notAllowed.join(', ')}` });
+      log.info(`[gds] autonomy scope: builder ${req.builder.id} picked goals [${out.goals.join(', ')}]`);
+      res.json({ goals: out.goals });
+    } catch (err) {
+      log.error('[gds] PUT /autonomy/me/goals', err);
+      res.fail('scope_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The owner pauses or resumes ONE builder's runner without throwing the master
+  // switch. Same atom as the kill switch: stopping a machine is the same act
+  // whether it is everyone's or one person's, and the paused builder must not be
+  // able to lift it (autonomy.run does not reach this route).
+  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      paused: { required: true, type: 'boolean' },
+      reason: { type: 'string', maxLength: 500 },
+    })) return;
+    const builderId = Number(req.params.builderId);
+    if (!Number.isSafeInteger(builderId) || builderId <= 0) return res.fail('bad_builder_id', 400);
+    const reason = typeof req.body.reason === 'string' ? req.body.reason : null;
+    try {
+      const row = await db.setBuilderPause({ builderId, paused: req.body.paused, reason, byBuilderId: req.builder.id });
+      if (!row) return res.fail('builder_not_found', { status: 404, message: `no builder ${builderId}` });
+      log.info(`[gds] autonomy: builder ${builderId}'s runner ${req.body.paused ? 'PAUSED' : 'RESUMED'} by builder ${req.builder.id} (${req.builder.rank})${reason ? `: ${reason}` : ''}`);
+      res.json(row);
+    } catch (err) {
+      log.error('[gds] POST /autonomy/builders/:builderId/pause', err);
+      res.fail('pause_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The owner's view of every builder's runners: who, which goals they picked,
+  // whether they are paused, and each runner's health — the server's verdict, as
+  // GET /autonomy/runners attaches it. Owner-only: a heartbeat names a machine
+  // and its hostname, which is each builder's own business (task 1003905), and the
+  // owner is the one person who needs every row to run the fence.
+  router.get('/autonomy/runners/all', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    try {
+      const rows = await db.readAllRunnerScopes();
+      const nowMs = Date.now();
+      res.json({
+        builders: rows.map((b) => ({
+          ...b,
+          runners: b.runners.map((r) => ({ ...r, health: runnerHealth.describeRunner(r, { nowMs }) })),
+        })),
+      });
+    } catch (err) {
+      log.error('[gds] GET /autonomy/runners/all', err);
+      res.fail('runners_unreadable', { status: 503, message: 'could not read the runner scopes' });
+    }
+  });
+
   // ── the runner heartbeat (task 1003905) ────────────────────────────────────
   //
   // A dead runner must be VISIBLE, not silent. The runner also writes a heartbeat

package/modules/government/catalog.js

@@ -119,7 +119,15 @@ const PERMISSIONS = [
   // suggestion. Deliberately NOT paired with a read permission: seeing whether the
   // runner is on is harmless, and GET /autonomy/fence is any-builder so the runner
   // itself does not need an elevated session merely to learn it must stop.
-  { key: 'autonomy.fence.manage', system: true, floor: 'archon', guards: 'POST /autonomy/fence (the kill switch), POST|DELETE /autonomy/fence/goals (the allowlist) — the Autobongos fence (ADR 0307 §6)' },
+  { key: 'autonomy.fence.manage', system: true, floor: 'archon', guards: 'POST /autonomy/fence (the kill switch), POST|DELETE /autonomy/fence/goals (the allowlist), POST /autonomy/builders/:id/pause (one builder\'s runner), GET /autonomy/runners/all — the Autobongos fence (ADR 0307 §6)' },
+  // autonomy.run (task 1004501) — WHO MAY RUN A RUNNER AT ALL. Held, a builder may
+  // pick which allowlisted goals their own runner works, and GET /autonomy/fence
+  // hands their runner those goals; not held, the fence they read is off. NOT
+  // system: it is operational, and an owner who wants a custom rank of
+  // "runner operators" should be able to compose one. It can never widen the fence
+  // — the project allowlist and the kill switch stay behind autonomy.fence.manage —
+  // so delegating it delegates only "whose machine may work the allowed goals".
+  { key: 'autonomy.run', system: false, floor: 'metic', guards: 'PUT /autonomy/me/goals (a builder\'s own runner scope); also decides whether GET /autonomy/fence answers enabled for the caller' },
   // BV1.R21 (task 1003608, goal 1000086). ADR 0250 §6 amends ADR 0157 for exactly
   // this key: `version.create` returns to the Archon floor.
   //

package/modules/government/migrations/government_022_autonomy_run.sql

@@ -0,0 +1,38 @@
+-- government_022_autonomy_run.sql — grant the new `autonomy.run` atom to Metic and
+-- Archon (task 1004501).
+--
+-- WHAT IT IS. Whether a builder may run an Autobongos runner at all: pick the
+-- allowlisted goals their own runner works, and be answered `enabled` when their
+-- runner reads GET /autonomy/fence. Without it, a builder's runner reads a fence
+-- that is off for them, whatever the project switch says.
+--
+-- METIC FLOOR. A runner spawns sessions with blanket bypassPermissions on the
+-- builder's own machine, and sub-Metic builders stay out of the build pipeline
+-- (ADR 0043). NOT system: an owner may add it to a custom rank. That delegates
+-- only whose machine may work the allowed goals — the allowlist and the kill
+-- switch stay behind the archon-only `autonomy.fence.manage`.
+--
+-- WHY THIS FILE EXISTS AT ALL. RANK_SEED is derived from the catalog's floors and
+-- tests/government_seed.mjs compares it against the run-once seed plus every later
+-- grant migration, per rank. A catalog row without this migration leaves the key
+-- held on paper and not in the database.
+--
+-- Additive only; idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'autonomy.run'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'autonomy.run'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/gate.html

@@ -51,12 +51,15 @@
                behind it are system:true/archon server-side regardless. -->
           <section class="scroll" id="fence-panel" aria-labelledby="fence-h" hidden>
             <h2 class="scroll__h" id="fence-h">Autobongos runner</h2>
-            <p class="scroll__lede">The unattended runner works only the goals listed here, and only while it is on. This is the switch — it lives on the server, so the machine can read it and cannot change it.</p>
+            <p class="scroll__lede">Runners work only the goals listed here, and only while this switch is on. Each builder then picks which of these goals their own runner takes, and you can pause any one builder's runner. All of it lives on the server, so a runner's machine can read it and cannot change it.</p>
             <!-- Liveness first (task 1003905): "is it running at all" is the
                  question before "is it allowed to run". -->
             <div id="fence-runner"><span class="kit-skel"></span></div>
             <div id="fence-state"><span class="kit-skel"></span></div>
             <div id="fence-goals"></div>
+            <!-- Every builder's runner (task 1004501): what each one picked to
+                 work, whether you paused it, and whether it is checking in. -->
+            <div id="fence-builders"></div>
           </section>
 
           <section class="scroll" aria-labelledby="gate-list-h">
@@ -81,6 +84,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/gate.js?v=2026-09-19-runner"></script>
+<script src="/builders/gate.js?v=2026-10-01-builder-runners"></script>
 </body>
 </html>

package/modules/hall-ui/public/gate.js

@@ -423,8 +423,77 @@
       document.getElementById('fence-goals').innerHTML = '';
       return;
     }
-    renderFenceState(fence);
-    renderFenceGoals(fence.goals, fence.priority_goal_id);
+    // GET /autonomy/fence answers with the CALLER'S fence (task 1004501): the
+    // project allowlist narrowed to the viewer's own picks. This panel is the
+    // project switch, so it draws the unnarrowed `project` the route carries
+    // alongside. A server that predates the split has no `project`, and then the
+    // top level IS the project fence.
+    const project = fence.project || fence;
+    renderFenceState(project);
+    renderFenceGoals(project.goals, project.priority_goal_id);
+  }
+
+  // ---- every builder's runner (task 1004501) --------------------------------
+  //
+  // One row per builder who has picked goals or whose runner has checked in:
+  // what they picked, whether the owner paused them, and each runner's health
+  // (the server's verdict, the same one loadRunners draws). Pause asks why, like
+  // the master switch, because a stopped machine is reconstructed weeks later.
+  function builderRowHtml(b) {
+    const name = b.display_name || b.github_login || `builder ${b.builder_id}`;
+    const goals = (b.goals || []).length
+      ? `works goal${b.goals.length === 1 ? '' : 's'} ${b.goals.map((g) => escapeHtml(String(g))).join(', ')}`
+      : 'has picked no goals, so their runner takes no work';
+    const beats = (b.runners || []).map((r) => {
+      const h = r.health || {};
+      const cls = HEALTH_CLASS[h.state] || 'fact-pill--info';
+      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in', restarting: 'Restarting' }[h.state] || 'Unknown';
+      return `<span class="fact-pill ${cls}">${escapeHtml(label)}</span><span class="ov-fact">${escapeHtml(h.host || r.host || '')}</span>`;
+    }).join('');
+    const paused = b.owner_paused === true;
+    return `
+      <li class="ov-row" style="display:flex;align-items:center;gap:12px;flex-wrap:wrap;">
+        <strong>${escapeHtml(name)}</strong>
+        ${b.rank ? `<span class="ov-fact">${escapeHtml(rankLabel(b.rank))}</span>` : ''}
+        ${paused ? '<span class="fact-pill fact-pill--warn">Paused</span>' : ''}
+        <span style="flex:1;">${goals}${paused && b.owner_paused_reason ? ` — paused: ${escapeHtml(b.owner_paused_reason)}` : ''}</span>
+        ${beats || '<span class="ov-fact">no runner has checked in</span>'}
+        <button type="button" class="btn" data-pause="${escapeHtml(String(b.builder_id))}" data-paused="${paused ? '1' : '0'}">${paused ? 'Resume' : 'Pause'}</button>
+      </li>`;
+  }
+
+  async function loadBuilderRunners() {
+    const el = document.getElementById('fence-builders');
+    if (!el) return;
+    let resp;
+    try {
+      resp = await fetchJson('/autonomy/runners/all');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      el.innerHTML = emptyStateHtml('Could not read each builder’s runner just now.');
+      return;
+    }
+    const builders = resp.builders || [];
+    el.innerHTML = `
+      <h3 class="scroll__h" style="font-size:1rem;margin-top:24px;">Each builder's runner</h3>
+      ${builders.length ? `<ul class="ov-rows">${builders.map(builderRowHtml).join('')}</ul>`
+        : emptyStateHtml('No builder has picked goals or run a runner yet.')}`;
+    for (const btn of el.querySelectorAll('[data-pause]')) {
+      btn.addEventListener('click', async () => {
+        const id = btn.getAttribute('data-pause');
+        const pausing = btn.getAttribute('data-paused') !== '1';
+        let reason = null;
+        if (pausing) {
+          reason = window.prompt('Why are you pausing this builder’s runner? (shown to them)');
+          if (reason === null) return;
+        }
+        try {
+          await sendJson('POST', `/autonomy/builders/${encodeURIComponent(id)}/pause`, { paused: pausing, reason: reason || undefined });
+          toast(pausing ? 'Runner paused.' : 'Runner resumed.');
+          await loadBuilderRunners();
+        } catch (err) { toast(err.message || 'Could not change that runner.'); }
+      });
+    }
   }
 
   async function init() {
@@ -449,8 +518,8 @@
     document.getElementById('gate-body').hidden = false;
     if (rank === 'archon') {
       document.getElementById('fence-panel').hidden = false;
-      // Independent reads, so one round trip rather than two.
-      await Promise.all([loadRunners(), loadFence()]);
+      // Independent reads, so one round trip rather than three.
+      await Promise.all([loadRunners(), loadFence(), loadBuilderRunners()]);
     }
     await load();
   }