@bongos/core 1.20.79 → 1.20.81

package/modules/hall-ui/public/settings-autobongos.js

@@ -0,0 +1,156 @@
+// modules/hall-ui/public/settings-autobongos.js — the "Your Autobongos runner"
+// panel on /builders/settings (task 1004501).
+//
+// WHY THE PANEL EXISTS. The fence used to be one switch and one goal list for
+// every runner on the instance. Owner ruling, 2026-10-01: each builder says which
+// work THEIR runner takes, and a builder who has said nothing gets no autonomous
+// work. This is where they say it.
+//
+// WHAT IT READS. GET /autonomy/fence answers with the caller's EFFECTIVE fence: the
+// project allowlist narrowed to their picks, plus `scope` (what they picked, whether
+// they may run a runner, whether the owner paused them) and `project` (the
+// unnarrowed allowlist they choose from). One read, so the panel cannot disagree
+// with what the builder's runner is told. The server decides every one of those
+// facts; this page only draws them.
+//
+// WHAT IT WRITES. PUT /autonomy/me/goals with the whole list, on Save. The route
+// refuses a goal that is not allowlisted (409), and it is behind `autonomy.run`, so
+// a builder who may not run a runner is told so here instead of shown a form that
+// would fail.
+//
+// Its own file on the settings-interaction.js precedent: settings.js sits against
+// the 1500-line ratchet, and this panel shares nothing with the rest of the page.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { escapeHtml, $ } = window.OTB;
+  const { emptyStateHtml } = window.OTBKit;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const toAuth = () => window.location.assign(`${API}/auth/web/start`);
+
+  // The lines above the form: each one says why the runner might be idle, in the
+  // order the server checks them, so the first line a builder reads is the reason.
+  function noticesHtml(fence) {
+    const project = fence.project || {};
+    const scope = fence.scope || {};
+    const out = [];
+    if (project.enabled !== true) {
+      out.push(`The project's runner switch is off right now${project.paused_reason ? `: ${escapeHtml(project.paused_reason)}` : ''}. Your choices are kept and apply when it is back on.`);
+    }
+    if (scope.owner_paused) {
+      out.push(`The owner paused your runner${scope.owner_paused_reason ? `: ${escapeHtml(scope.owner_paused_reason)}` : ''}. Only the owner can resume it.`);
+    }
+    return out.map((t) => `<p class="prow__hint">${t}</p>`).join('');
+  }
+
+  // Goal names, by id. The fence carries only ids and the owner's note, so the
+  // names come from GET /goals — the list the Goals page draws for this same
+  // builder, so it names only goals they can already see. Best-effort: a failed
+  // read leaves the map empty and a row falls back to its number.
+  let goalNames = new Map();
+  async function loadGoalNames() {
+    try {
+      const res = await api.request('GET', `${API}/goals`);
+      if (res.ok && res.data && Array.isArray(res.data.goals)) {
+        goalNames = new Map(res.data.goals.map((g) => [Number(g.id), g.title]));
+      }
+    } catch (_) { /* names are a nicety; the picker works without them */ }
+  }
+  const goalLabel = (id) => goalNames.get(Number(id)) || `Goal ${id}`;
+
+  function render(fence) {
+    const body = $('#autobongos-body');
+    if (!body) return;
+    const scope = fence.scope || {};
+    if (scope.may_run !== true) {
+      body.innerHTML = emptyStateHtml('Your rank cannot run an Autobongos runner on this project. Ask the owner if you need one.');
+      return;
+    }
+    const goals = (fence.project && Array.isArray(fence.project.goals)) ? fence.project.goals : [];
+    if (!goals.length) {
+      body.innerHTML = noticesHtml(fence) + emptyStateHtml('The project has not allowed any goals for runners yet, so there is nothing to choose from.');
+      return;
+    }
+    const picked = new Set((scope.goals || []).map(Number));
+    body.innerHTML = `${noticesHtml(fence)}
+      <form id="autobongos-form">
+        <div class="prows">
+          ${goals.map((g) => {
+            const id = `autobongos-goal-${escapeHtml(String(g.goal_id))}`;
+            return `<label class="prow prow--pick" for="${id}">
+              <input type="checkbox" id="${id}" name="autobongos-goal" value="${escapeHtml(String(g.goal_id))}"${picked.has(Number(g.goal_id)) ? ' checked' : ''}>
+              <span class="prow__main">
+                <span class="prow__label">${escapeHtml(goalLabel(g.goal_id))}</span>
+                <span class="prow__desc">${escapeHtml([goalNames.has(Number(g.goal_id)) ? `goal ${g.goal_id}` : '', g.note || ''].filter(Boolean).join(' · '))}</span>
+              </span>
+            </label>`;
+          }).join('')}
+        </div>
+        <div class="settings-card">
+          <button type="submit" class="settings-btn" id="autobongos-save">Save</button>
+          <span class="settings-card__hint">${picked.size ? `Your runner works ${picked.size} goal${picked.size === 1 ? '' : 's'}.` : 'Your runner takes no work until you choose at least one goal.'}</span>
+        </div>
+      </form>`;
+    $('#autobongos-form').addEventListener('submit', (e) => {
+      e.preventDefault();
+      const ids = [...e.target.querySelectorAll('input[name="autobongos-goal"]:checked')].map((i) => Number(i.value));
+      save(ids);
+    });
+  }
+
+  async function load() {
+    const res = await api.request('GET', `${API}/autonomy/fence`);
+    if (res.status === 401) { toAuth(); return null; }
+    if (!res.ok) throw new Error(`fence GET → ${res.status}`);
+    return res.data;
+  }
+
+  async function save(goalIds) {
+    const status = $('#autobongos-status');
+    const btn = $('#autobongos-save');
+    if (status) status.textContent = 'Saving…';
+    if (btn) btn.disabled = true;
+    try {
+      const res = await api.request('PUT', `${API}/autonomy/me/goals`, { body: { goal_ids: goalIds } });
+      if (res.status === 401) { toAuth(); return; }
+      if (!res.ok) {
+        const env = res.data && res.data.error;
+        throw new Error((env && env.message) || `could not save (${res.status})`);
+      }
+      const msg = goalIds.length ? `Saved — your runner works ${goalIds.length} goal${goalIds.length === 1 ? '' : 's'}.` : 'Saved — your runner takes no work.';
+      if (status) status.textContent = msg;
+      toast(msg);
+      const fence = await load();
+      if (fence) render(fence);
+    } catch (err) {
+      console.error('[settings] save autobongos goals failed', err);
+      if (status) status.textContent = `Could not save: ${err.message}`;
+      toast('Could not save your runner’s goals. Try again.');
+      if (btn) btn.disabled = false;
+    }
+  }
+
+  async function setup() {
+    const section = $('#autobongos-scroll');
+    if (!section) return;
+    try {
+      const [fence] = await Promise.all([load(), loadGoalNames()]);
+      if (!fence) return;
+      render(fence);
+      section.hidden = false;
+    } catch (err) {
+      // Its own try/catch, like every other panel: a failing read shows this
+      // panel's own error rather than taking the settings page down with it.
+      console.error('[settings] failed to load autobongos scope', err);
+      section.hidden = false;
+      $('#autobongos-body').innerHTML =
+        '<p class="voices-empty">Your runner settings could not be loaded. Reload the page to try again.</p>';
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.html

@@ -163,6 +163,23 @@
               <p class="section-note">Ending a session takes effect immediately; the token stops working on its very next request.</p>
             </section>
 
+            <!-- YOUR AUTOBONGOS RUNNER — which goals your own unattended runner
+                 works (task 1004501). Rendered by settings-autobongos.js against
+                 GET /autonomy/fence (your effective fence) and PUT
+                 /autonomy/me/goals. Picking nothing means your runner takes no
+                 work. The project allowlist and the master switch stay the
+                 owner's, on the Gate page. -->
+            <section class="scroll" id="autobongos-scroll" aria-labelledby="autobongos-h" data-group="access" hidden>
+              <h2 id="autobongos-h" class="scroll__h">Your Autobongos runner</h2>
+              <p class="scroll__lede">
+                Choose which goals your own runner works while you are away. You can
+                only choose from the goals the project allows. If you choose none, your
+                runner takes no work.
+              </p>
+              <div id="autobongos-body" aria-live="polite"></div>
+              <p class="settings-status" id="autobongos-status" role="status" aria-live="polite"></p>
+            </section>
+
             <!-- IMAGE KEY — per-builder Gemini key (task 1013 / ADR 0073).
                  GET/PUT/DELETE /api/bongos/me/art-key/own. Write-only (set/replace/
                  remove); the full key is never shown again after save (masked,
@@ -425,5 +442,7 @@
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
 <!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
 <script src="/builders/settings-software-update.js?v=2026-09-26-update"></script>
+<!-- task 1004501: Settings → Your Autobongos runner. Own file on the same precedent. -->
+<script src="/builders/settings-autobongos.js?v=2026-10-01-autobongos"></script>
 </body>
 </html>

package/modules/hall-ui/public/settings.js

@@ -1066,6 +1066,7 @@
     'privacy': 'account-hub-scroll',
     'disciplines': 'craft-scroll',
     'cli': 'cli-scroll',
+    'autobongos': 'autobongos-scroll',
     'art-key': 'art-key',
     'interaction': 'interaction-scroll',
     'wandering': 'wandering-scroll',

package/modules/lifecycle/module.json

@@ -41,7 +41,8 @@
   "provides": [
     "lifecycle",
     "lifecycle.kickoffSeed",
-    "lifecycle.removals"
+    "lifecycle.removals",
+    "lifecycle.workflowDispatch"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/lifecycle.js

@@ -53,6 +53,13 @@ function registerSeams() {
   if (!api.hasProvider('lifecycle')) {
     api.registerProvider('lifecycle', lifecycle);
   }
+  // The one GitHub act another module may borrow (task 1004298): start a workflow. The npm-release
+  // module's Release button runs publish.yml through it. A port of one function rather than the
+  // github-push module whole, so the borrower can start a workflow and do nothing else with the
+  // server's GitHub credential.
+  if (!api.hasProvider('lifecycle.workflowDispatch')) {
+    api.registerProvider('lifecycle.workflowDispatch', { dispatchWorkflow: (args) => require('../workflow-dispatch').dispatchWorkflow(args) });
+  }
   if (_cascadeListenerOff) _cascadeListenerOff();
   // Torn down with its sibling: the factory runs again every time a test rebuilds
   // the router, and a leaked subscription would fire this cascade twice.

package/modules/lifecycle/workflow-dispatch.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// modules/lifecycle/workflow-dispatch.js — the one GitHub act another module may borrow.
+// Lent through the `lifecycle.workflowDispatch` port (routes/lifecycle.js); see ADR 0361.
+// Kept beside github-push.js rather than in it: it shares that file's credential and headers,
+// and nothing else.
+
+const { resolveToken, ghHeaders, isSafeBranch } = require('./github-push');
+const { repoInfo: { loadRepoInfo } } = require('../../src/module-api');
+
+// dispatchWorkflow — start a GitHub Actions workflow on this repo (task 1004298, ADR 0361). The
+// Release button on /deploy uses it to run publish.yml's release job, so the npm credential never
+// leaves GitHub: the server holds only the GitHub App key it already holds, and the App needs
+// Actions: write for this one call. Returns { ok:true } on GitHub's 204, otherwise
+// { ok:false, code, status? } — UNCONFIGURED (no credential), NO_REPO_INFO, BAD_INPUT, REFUSED
+// (GitHub said no: 403 = the App lacks Actions: write, 404 = no such workflow or no access,
+// 422 = an input the workflow does not declare), UNREACHABLE. Never throws.
+//
+// ONLY THE WORKFLOWS NAMED HERE can be started. The port lends the server's GitHub credential to
+// another module; an allowlist keeps a buggy or future borrower from running any other workflow in
+// the repo. Adding one is a reviewed edit to this line.
+const DISPATCHABLE_WORKFLOWS = Object.freeze(['publish.yml']);
+async function dispatchWorkflow({ workflow, ref = 'main', inputs = {} }, deps = {}) {
+  if (!DISPATCHABLE_WORKFLOWS.includes(String(workflow || '')) || !isSafeBranch(ref)) return { ok: false, code: 'BAD_INPUT' };
+  let token;
+  try { token = await resolveToken(deps); } catch (_) { return { ok: false, code: 'UNCONFIGURED' }; }
+  if (!token) return { ok: false, code: 'UNCONFIGURED' };
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) return { ok: false, code: 'NO_REPO_INFO' };
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  try {
+    const res = await doFetch(`https://api.github.com/repos/${owner}/${repo}/actions/workflows/${workflow}/dispatches`, {
+      method: 'POST',
+      headers: { ...ghHeaders(token), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ref, inputs }),
+    });
+    if (res.status === 204 || res.ok) return { ok: true };
+    return { ok: false, code: 'REFUSED', status: res.status };
+  } catch (_) {
+    return { ok: false, code: 'UNREACHABLE' };
+  }
+}
+
+module.exports = { dispatchWorkflow };

package/modules/npm-release/module.json

@@ -16,7 +16,8 @@
     "routes": [
       "work",
       "task-where",
-      "preview"
+      "preview",
+      "release"
     ],
     "uiSections": [
       "task-where"

package/modules/npm-release/public/work.js

@@ -136,6 +136,77 @@
       </li>`;
   }
 
+  // ---- the Release button (task 1004298) ---------------------------------------------------
+  //
+  // Merges publish as candidates: this hall runs each one, no other project is offered it. Release
+  // makes a version the one every other project is offered. Beside each button, the evidence the
+  // owner decides on — how long the version has run here, and whether it was ever rolled back —
+  // read by the server from this hall's upgrade ledger.
+  let releasing = '';
+  let releaseNote = null;   // { ok, text } — the last press's answer, shown until the next read
+
+  function hoursText(h) {
+    if (h == null) return 'not in this hall\'s upgrade ledger';
+    if (h < 1) return 'under an hour';
+    if (h < 48) return `${Math.round(h)} hour${Math.round(h) === 1 ? '' : 's'}`;
+    return `${Math.round(h / 24)} days`;
+  }
+
+  function candidateRow(c) {
+    const ran = c.on_hall_since == null
+      ? 'This hall\'s upgrade ledger does not show it going in.'
+      : c.still_running ? `Running here for ${hoursText(c.hours_on_hall)}.` : `Ran here for ${hoursText(c.hours_on_hall)} before a newer version replaced it.`;
+    const facts = [];
+    if (c.rolled_back) facts.push('<span class="ov-fact"><b>was rolled back here</b></span>');
+    if (c.still_running) facts.push('<span class="ov-fact">running now</span>');
+    const busy = releasing === c.version;
+    return `<li class="ov-row ov-row--dense${c.rolled_back ? ' nr-upgrade--back' : ''}">
+        <div class="ov-row__main">
+          <span class="ov-row__title ov-key">${escapeHtml(c.version)}</span>
+          <p class="ov-row__sub">${escapeHtml(ran)}${c.rolled_back ? ' A move to it did not come back healthy at least once, and was undone.' : ''}</p>
+          ${facts.length ? `<div class="ov-row__facts">${facts.join('')}</div>` : ''}
+        </div>
+        <div class="ov-row__right"><button type="button" class="ov-toggle" data-release="${escapeHtml(c.version)}"${releasing ? ' disabled' : ''}>${busy ? 'Starting…' : 'Release'}</button></div>
+      </li>`;
+  }
+
+  function releaseHtml(d) {
+    const r = d.release;
+    if (!r) return '';
+    let body;
+    if (!r.ok) body = `<p class="ov-row__sub">${escapeHtml(r.error || 'The registry could not be read')}, so nothing can be released right now.</p>`;
+    else if (!r.candidates.length) body = `<p class="ov-row__sub">Nothing is waiting: every version this hall runs is already released${d.released ? ` (the release is ${escapeHtml(d.released)})` : ''}.</p>`;
+    else body = `<ul class="ov-rows">${r.candidates.map(candidateRow).join('')}</ul>`;
+    const note = releaseNote ? `<div class="ov-note${releaseNote.ok ? '' : ' ov-note--warn'}"><p>${escapeHtml(releaseNote.text)}</p></div>` : '';
+    const ledger = r.ok && r.ledger_error ? `<p class="ov-row__sub">${escapeHtml(r.ledger_error)}.</p>` : '';
+    return `<div class="ov-group" data-release-section>
+        <div class="ov-group__head">
+          <span class="ov-group__name">Release</span>
+          ${r.ok ? `<span class="ov-group__n">${r.candidates.length}</span>` : ''}
+        </div>
+        <p class="ov-row__sub">New versions run here first and are offered to no other project. Release makes a version, and everything merged before it, what every other project is offered: their Settings, their banner, their automatic updates.${d.released ? ` Released now: ${escapeHtml(d.released)}.` : ''}</p>
+        ${note}${ledger}${body}
+      </div>`;
+  }
+
+  async function release(version) {
+    if (releasing) return;
+    if (!window.confirm(`Release ${version} to every project?\n\nEvery other project will be offered ${version} and everything merged before it. This cannot be pressed back; a newer version can be released after it.`)) return;
+    releasing = version;
+    releaseNote = null;
+    paint();
+    try {
+      const res = await client.request('POST', `${API}/npm-release/release`, { body: { version } });
+      const msg = (res.data && (res.data.message || (res.data.error && res.data.error.message))) || `release → ${res.status}`;
+      releaseNote = { ok: res.ok, text: msg };
+    } catch (e) {
+      releaseNote = { ok: false, text: `Nothing was released: ${e.message || e}` };
+    } finally {
+      releasing = '';
+      paint();
+    }
+  }
+
   function upgradesHtml(d) {
     const u = d.upgrades;
     if (!u) return '';
@@ -322,6 +393,7 @@
       ${problemsHtml(data)}
       ${figsHtml(stages, data)}
       ${groups || '<p class="ov-row__sub">Nothing was finished in this window.</p>'}
+      ${releaseHtml(data)}
       ${upgradesHtml(data)}
       <p class="ov-foot">read ${escapeHtml(new Date(data.checked_at).toLocaleTimeString())} · ${escapeHtml(data.package)} · release notes from ${escapeHtml(data.notes.source ? `${data.notes.source.from === 'package' ? 'the published' : 'this hall\'s'} ${data.notes.source.version} package` : 'nowhere')}</p>`;
     work.hidden = false;
@@ -398,6 +470,8 @@
     const ex = t.closest('[data-expand]');
     if (ex) { expanded.add(ex.getAttribute('data-expand')); paint(); return; }
     if (t.closest('#nr-older')) { loadOlder(); return; }
+    const rel = t.closest('[data-release]');
+    if (rel) { release(rel.getAttribute('data-release')); return; }
     const pv = t.closest('[data-preview]');
     if (pv) { previewAct(() => previewCall('POST', { version: pv.getAttribute('data-preview') })); return; }
     if (t.closest('[data-preview-stop]')) previewAct(() => previewCall('DELETE'));

package/modules/npm-release/release.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// modules/npm-release/release.js — the Release button's half of the deploy page (task 1004298,
+// ADR 0361).
+//
+// Merges publish as CANDIDATES: on npm, run by this (the platform) hall, offered to no other project.
+// Release makes a version the one every other project is offered, by moving the registry's `latest`
+// label. The move itself happens in GitHub (publish.yml's release job), so the npm credential never
+// leaves GitHub; this server only asks GitHub to run it, through the lifecycle module's one-function
+// workflowDispatch port.
+//
+// TWO THINGS LIVE HERE:
+//   releaseCandidates — the evidence beside each button: how long the version has run on this hall,
+//                       and whether a move to it was ever rolled back here. Read from core_upgrades,
+//                       the ledger `bongos upgrade` writes on every move and rollback.
+//   requestRelease    — what the button does: the same rule the workflow applies (release-core.js,
+//                       imported, never restated), then the dispatch.
+
+const { releaseDecision } = require('../../scripts/gds/release-core.js');
+
+const VERSION_RE = /^\d+\.\d+\.\d+$/;
+// The ledger window the evidence reads. A candidate older than this has been superseded many
+// times over; the page shows the newest few.
+const LEDGER_DAYS = 60;
+const CANDIDATES_SHOWN = 5;
+const WORKFLOW = 'publish.yml';
+
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0);
+  return 0;
+}
+
+// The version a rollback row says it ATTEMPTED: "rolled_back: <why> (attempted A → B, restored C)".
+function attemptedIn(note) {
+  const m = /\(attempted\s+\S+\s*→\s*(\d+\.\d+\.\d+)/.exec(String(note || ''));
+  return m ? m[1] : null;
+}
+
+/**
+ * PURE. The versions Release can be pressed on, newest first, each with its evidence.
+ *
+ * A candidate is a published version newer than the release and no newer than what this hall runs
+ * (a version this hall never ran has no evidence, and the hall runs every candidate by design).
+ *
+ * `rows`: core_upgrades rows, any order, { to_version, applied_at, note }. A row whose note begins
+ * `rolled_back:` is a rollback; every other row is a move that went in.
+ *   on_hall_since — when the version first went in here (null: the ledger does not show it);
+ *   hours_on_hall — from then until this hall moved past it, or until now if it still runs it;
+ *   rolled_back   — a move to it was rolled back here at least once.
+ */
+function releaseCandidates({ rows, versions, released, live, now = Date.now() } = {}) {
+  if (!VERSION_RE.test(String(live || ''))) return [];
+  const list = (Array.isArray(versions) ? versions : [])
+    .filter((v) => VERSION_RE.test(v))
+    .filter((v) => compareVersions(v, live) <= 0)
+    .filter((v) => !released || compareVersions(v, released) > 0)
+    .sort(compareVersions)
+    .reverse()
+    .slice(0, CANDIDATES_SHOWN);
+  const ledger = (Array.isArray(rows) ? rows : [])
+    .map((r) => ({ to: r.to_version || null, at: r.applied_at ? Date.parse(r.applied_at) : NaN, note: r.note == null ? '' : String(r.note) }))
+    .filter((r) => Number.isFinite(r.at))
+    .sort((a, b) => a.at - b.at);
+  const moves = ledger.filter((r) => !/^rolled_back:/.test(r.note));
+  const rollbacks = ledger.filter((r) => /^rolled_back:/.test(r.note));
+  return list.map((v) => {
+    const i = moves.findIndex((r) => r.to === v);
+    const since = i >= 0 ? moves[i].at : null;
+    const next = i >= 0 ? moves.slice(i + 1).find((r) => r.to !== v) : null;
+    const until = next ? next.at : now;
+    return {
+      version: v,
+      on_hall_since: since == null ? null : new Date(since).toISOString(),
+      hours_on_hall: since == null ? null : Math.max(0, Math.round(((until - since) / 3600000) * 10) / 10),
+      still_running: v === live,
+      rolled_back: rollbacks.some((r) => attemptedIn(r.note) === v),
+    };
+  });
+}
+
+async function readReleaseLedger(pool) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT to_version, applied_at, note
+         FROM core_upgrades
+        WHERE applied_at > now() - ($1 || ' days')::interval
+        ORDER BY applied_at, id`,
+      [String(LEDGER_DAYS)]
+    );
+    return { ok: true, rows };
+  } catch (e) {
+    return { ok: false, error: e.message, rows: [] };
+  }
+}
+
+/**
+ * What the Release button does. Returns { status, body } for the route to send.
+ *
+ * The rule is release-core.js's releaseDecision — the one the workflow applies again before it
+ * moves anything, so the button cannot promise what the workflow would refuse. Refusals here save a
+ * GitHub run; they are not the gate (the workflow is).
+ */
+async function requestRelease({ version, registry, dispatch } = {}) {
+  if (!registry || !registry.ok) {
+    return { status: 503, body: { error: { code: 'registry_unreadable', message: 'The npm registry could not be read, so nothing was released. Try again in a minute.' } } };
+  }
+  const d = releaseDecision({ version, versions: registry.versions, latest: registry.latest });
+  if (d.noop) return { status: 200, body: { ok: true, noop: true, version, message: `${version} is already the release.` } };
+  if (!d.go) return { status: 409, body: { error: { code: 'not_releasable', message: `Not released: ${d.reason}. Pick a version from the Release list, which shows only the ones that can be released.` } } };
+  if (typeof dispatch !== 'function') {
+    return { status: 503, body: { error: { code: 'dispatch_unavailable', message: 'This hall cannot start GitHub workflows (the lifecycle module is not running), so nothing was released.' } } };
+  }
+  const r = await dispatch({ workflow: WORKFLOW, ref: 'main', inputs: { release_version: version } });
+  if (r && r.ok) {
+    return { status: 202, body: { ok: true, version, message: `Release of ${version} started. GitHub moves the label in a minute or two; other projects are offered it from then on.` } };
+  }
+  const why = !r ? 'no answer'
+    : r.code === 'UNCONFIGURED' ? 'this server has no GitHub credential'
+      : r.code === 'REFUSED' && r.status === 403 ? "GitHub refused: the server's GitHub App needs the Actions: write permission"
+        : r.code === 'REFUSED' && r.status === 404 ? 'GitHub could not find publish.yml, or the App cannot see this repository'
+          : r.code === 'REFUSED' ? `GitHub refused the request (${r.status})`
+            : r.code === 'UNREACHABLE' ? 'GitHub could not be reached'
+              : r.code;
+  return { status: 502, body: { error: { code: 'dispatch_failed', message: `Nothing was released: ${why}.` } } };
+}
+
+module.exports = { releaseCandidates, readReleaseLedger, requestRelease, WORKFLOW };

package/modules/npm-release/routes/release.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// modules/npm-release/routes/release.js — POST /npm-release/release, the deploy page's Release
+// button (task 1004298, ADR 0361). Body: { version }.
+//
+// It does not move anything itself. It asks GitHub to run publish.yml's release job, which checks
+// the same rule again and moves the registry's `latest` label — the version every project other
+// than the platform hall is offered. So the npm credential never leaves GitHub.
+//
+// GATED LIKE THE PAGE (`core.pin.move`), as an atom: the deploy page is served only to holders of
+// it, and a button wider than its page would be a door nobody sees. Never requireRank —
+// tests/government_require_permission.mjs fails the build on one in a modules/*/routes gate.
+//
+// Only the core's page releases: publish.yml publishes @bongos/core, and another package's
+// deploy page has no workflow here to run.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { requestRelease } = require('../release');
+
+const log = api.logger('npm-release');
+const CORE_PACKAGE = '@bongos/core';
+
+// The kernel validator checks presence, type and length; the x.y.z shape is checked by hand below.
+const releaseSchema = { version: { type: 'string', required: true, maxLength: 32 } };
+const VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
+module.exports = function buildNpmReleaseReleaseRouter({
+  pkg = () => process.env.NPM_RELEASE_PACKAGE || CORE_PACKAGE,
+  readRegistry = () => api.readPackageRegistry({ pkg: CORE_PACKAGE, haveNotesFor: () => true }),
+  port = () => api.resolveOptional && api.resolveOptional('lifecycle.workflowDispatch'),
+} = {}) {
+  const router = express.Router();
+
+  router.post(
+    '/npm-release/release',
+    api.requireBuilder,
+    api.requirePermission('core.pin.move'),
+    async (req, res) => {
+      if (api.validateOrRespond(req, res, releaseSchema, { strict: true })) return undefined;
+      if (!VERSION_RE.test(req.body.version)) {
+        return res.status(400).json({ error: { code: 'validation_failed', message: 'version must be x.y.z', details: [{ field: 'version', reason: 'bad_format' }] } });
+      }
+      if (pkg() !== CORE_PACKAGE) {
+        return res.status(409).json({ error: { code: 'not_the_core', message: 'Release runs only on the deploy page of the package this repository publishes (@bongos/core).' } });
+      }
+      const version = req.body.version;
+      try {
+        const { registry } = await readRegistry();
+        const p = port();
+        const dispatch = p && typeof p.dispatchWorkflow === 'function' ? (args) => p.dispatchWorkflow(args) : null;
+        const r = await requestRelease({ version, registry, dispatch });
+        const who = req.builder && req.builder.id;
+        if (r.status === 202) log.info(`release of core ${version} requested by builder ${who}`);
+        else log.warn(`release of core ${version} by builder ${who} not started: ${(r.body.error && r.body.error.code) || 'noop'}`);
+        return res.status(r.status).json(r.body);
+      } catch (e) {
+        log.error(`npm-release release failed: ${e && e.message}`);
+        return res.status(500).json({ error: { code: 'release_failed', message: 'Nothing was released: the request failed on this server.' } });
+      }
+    },
+  );
+
+  return router;
+};

package/modules/npm-release/work.js

@@ -30,6 +30,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const api = require('../../src/module-api');
+const { releaseCandidates, readReleaseLedger } = require('./release');
 
 // The package this server runs — the one whose "live" version is this process's own core.
 // Any other package has no "live on this hall" stage: nothing here runs it.
@@ -292,6 +293,18 @@ async function readVersions({ pkg, live, installedNotes, get, now, store }) {
   return { liveVersion, registry, versions, source, notesError, coversTo, published, released };
 }
 
+// The Release section's reading. Fail-soft like the ledger it reads: an unreadable ledger still
+// lists the candidates, with no evidence and the reason, rather than hiding the button.
+async function releaseReading({ pool, registry, released, live, now }) {
+  if (!registry.ok) return { ok: false, error: registry.error || 'the registry could not be read', candidates: [] };
+  const ledger = await readReleaseLedger(pool);
+  return {
+    ok: true,
+    ledger_error: ledger.ok ? null : `this hall's upgrade ledger could not be read (${ledger.error})`,
+    candidates: releaseCandidates({ rows: ledger.rows, versions: registry.versions, released, live, now }),
+  };
+}
+
 async function readWork({
   pool, pkg = configuredPackage(), live, days, before, limit,
   installedNotes = readInstalledNotes, get, now, store,
@@ -332,6 +345,9 @@ async function readWork({
     // Only the core's page has a "this hall" to have upgraded: another package is not what this
     // server runs.
     upgrades: isCore ? await recentUpgrades(pool) : null,
+    // THE RELEASE BUTTON'S EVIDENCE (task 1004298): each version this hall runs that is not yet
+    // released, with how long it has run here and whether a move to it was ever rolled back.
+    release: isCore ? await releaseReading({ pool, registry, released, live: liveVersion, now: at }) : null,
     waiting: isCore && registry.ok ? waitingHere({ live: liveVersion, versions: registry.versions, published, now: at }) : null,
   };
 }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.79",
+  "version": "1.20.81",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.79",
+      "version": "1.20.81",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.79",
+  "version": "1.20.81",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",