@bongos/core 1.20.80 → 1.20.82

package/modules/autonomy/cadence.js

@@ -161,6 +161,9 @@ function classifyEvent(row = {}) {
 
   if (event === 'fenced') {
     if (code === 'kill_switch') return { class: 'stopped', detail: row.reason || 'an owner stopped the runner' };
+    // The per-builder stops (task 1004501) are the same kind of fact as the project
+    // switch: a person decided, and probing will not change their mind.
+    if (code === 'builder_paused' || code === 'not_permitted') return { class: 'stopped', detail: row.reason || 'this builder’s runner is stopped' };
     if (code === 'grader_unavailable') return { class: 'transient', detail: 'the grader is unavailable, and it is the only review there is' };
     if (code === 'fence_unreadable') return { class: 'transient', detail: 'the fence could not be read' };
     // no_allowlist / goal_not_allowlisted / protected_path: the fence is working

package/modules/autonomy/db.js

@@ -157,6 +157,138 @@ async function disallowGoal(goalId) {
   return { removed: rowCount > 0 };
 }
 
+// ── each builder's runner scope (task 1004501) ───────────────────────────────
+//
+// The builder's half of the fence: which allowlisted goals THEIR runner works, and
+// whether the owner has paused it. The composition with the project fence is pure
+// and lives in ../fence.js (effectiveFence); these stay dumb.
+
+// readBuilderScope — one builder's picks and pause, or null when they have neither
+// (which effectiveFence reads as "no goals", by owner ruling). The picks join the
+// allowlist so a pick can never outlive its goal there, on top of the CASCADE.
+async function readBuilderScope(builderId) {
+  const [scope, goals] = await Promise.all([
+    pool.query('SELECT owner_paused, owner_paused_reason, owner_paused_by, updated_at FROM autonomy_builder_scope WHERE builder_id = $1', [builderId]),
+    pool.query(
+      `SELECT bg.goal_id FROM autonomy_builder_goals bg
+         JOIN autonomy_allowed_goals ag ON ag.goal_id = bg.goal_id
+        WHERE bg.builder_id = $1 ORDER BY bg.goal_id`,
+      [builderId]
+    ),
+  ]);
+  const row = scope.rows[0];
+  if (!row && !goals.rows.length) return null;
+  return {
+    goals: goals.rows.map((g) => Number(g.goal_id)),
+    owner_paused: !!(row && row.owner_paused === true),
+    owner_paused_reason: (row && row.owner_paused_reason) || null,
+    owner_paused_by: row && row.owner_paused_by ? String(row.owner_paused_by) : null,
+    updated_at: row ? row.updated_at : null,
+  };
+}
+
+// setBuilderGoals — replace one builder's picks with `goalIds`, in one transaction.
+// Every id must already be on the allowlist; if any is not, NOTHING is written and
+// `{ notAllowed: [...] }` says which, so the Settings page can name them. An empty
+// list is a valid answer and means "my runner takes no work".
+async function setBuilderGoals({ builderId, goalIds }) {
+  const ids = [...new Set((goalIds || []).map(Number))];
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    if (ids.length) {
+      const { rows } = await client.query('SELECT goal_id FROM autonomy_allowed_goals WHERE goal_id = ANY($1::bigint[])', [ids]);
+      const allowed = new Set(rows.map((r) => Number(r.goal_id)));
+      const notAllowed = ids.filter((g) => !allowed.has(g));
+      if (notAllowed.length) { await client.query('ROLLBACK'); return { notAllowed }; }
+    }
+    await client.query('DELETE FROM autonomy_builder_goals WHERE builder_id = $1', [builderId]);
+    if (ids.length) {
+      await client.query(
+        'INSERT INTO autonomy_builder_goals (builder_id, goal_id) SELECT $1, unnest($2::bigint[])',
+        [builderId, ids]
+      );
+    }
+    // Bump the scope row so the change reaches a waiting runner as a signal.
+    await client.query(
+      `INSERT INTO autonomy_builder_scope (builder_id, updated_at) VALUES ($1, now())
+       ON CONFLICT (builder_id) DO UPDATE SET updated_at = now()`,
+      [builderId]
+    );
+    await client.query('COMMIT');
+    return { goals: ids.slice().sort((a, b) => a - b) };
+  } catch (err) {
+    try { await client.query('ROLLBACK'); } catch (_) { /* the original error is the one to report */ }
+    throw err;
+  } finally {
+    client.release();
+  }
+}
+
+// setBuilderPause — the owner pauses or resumes ONE builder's runner. The reason
+// is kept only while paused, like the project switch. Returns null when no such
+// builder exists, so a typo in the id is a 404 rather than an inert orphan row.
+async function setBuilderPause({ builderId, paused, reason = null, byBuilderId = null }) {
+  const { rows } = await pool.query(
+    `INSERT INTO autonomy_builder_scope (builder_id, owner_paused, owner_paused_reason, owner_paused_by, updated_at)
+     SELECT $1, $2, $3, $4, now() WHERE EXISTS (SELECT 1 FROM builders WHERE id = $1)
+     ON CONFLICT (builder_id) DO UPDATE SET
+       owner_paused = EXCLUDED.owner_paused,
+       owner_paused_reason = EXCLUDED.owner_paused_reason,
+       owner_paused_by = EXCLUDED.owner_paused_by,
+       updated_at = now()
+     RETURNING builder_id, owner_paused, owner_paused_reason, updated_at`,
+    [builderId, paused === true, paused === true ? (reason || 'paused by the owner') : null, byBuilderId]
+  );
+  const r = rows[0];
+  return r ? { ...r, builder_id: String(r.builder_id) } : null;
+}
+
+// readAllRunnerScopes — the owner's view: every builder who has a runner scope or
+// has ever had a runner check in, with their picks, pause, and runners. Three
+// small reads joined here rather than one wide SQL join, so a builder with picks
+// but no runner and one with a runner but no picks both appear.
+async function readAllRunnerScopes() {
+  const [scopes, picks, beats] = await Promise.all([
+    pool.query('SELECT builder_id, owner_paused, owner_paused_reason, updated_at FROM autonomy_builder_scope'),
+    pool.query(
+      `SELECT bg.builder_id, bg.goal_id FROM autonomy_builder_goals bg
+         JOIN autonomy_allowed_goals ag ON ag.goal_id = bg.goal_id ORDER BY bg.goal_id`
+    ),
+    // Capped PER BUILDER, at readRunnerHeartbeats' own 20, so one builder's many
+    // hosts can never push a quieter builder out of the owner's view.
+    pool.query(
+      `SELECT builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id,
+              head, disk_head, main_head, claude_account, last_seen_at
+         FROM (SELECT h.*, row_number() OVER (PARTITION BY builder_id ORDER BY last_seen_at DESC) AS rn
+                 FROM autonomy_runner_heartbeat h) t
+        WHERE rn <= 20
+        ORDER BY last_seen_at DESC`
+    ),
+  ]);
+  const byId = new Map();
+  const entry = (id) => {
+    const k = String(id);
+    if (!byId.has(k)) byId.set(k, { builder_id: k, goals: [], owner_paused: false, owner_paused_reason: null, runners: [] });
+    return byId.get(k);
+  };
+  for (const s of scopes.rows) Object.assign(entry(s.builder_id), { owner_paused: s.owner_paused === true, owner_paused_reason: s.owner_paused_reason || null });
+  for (const p of picks.rows) entry(p.builder_id).goals.push(Number(p.goal_id));
+  for (const b of beats.rows) {
+    entry(b.builder_id).runners.push({
+      ...b, builder_id: undefined,
+      working_task_id: b.working_task_id ? String(b.working_task_id) : null,
+      working_goal_id: b.working_goal_id ? String(b.working_goal_id) : null,
+    });
+  }
+  const ids = [...byId.keys()];
+  if (ids.length) {
+    const { rows } = await pool.query('SELECT id, github_login, display_name, rank FROM builders WHERE id = ANY($1::bigint[])', [ids]);
+    for (const r of rows) Object.assign(byId.get(String(r.id)), { github_login: r.github_login, display_name: r.display_name, rank: r.rank });
+  }
+  return [...byId.values()];
+}
+
 // ── the runner heartbeat (task 1003905) ──────────────────────────────────────
 
 // recordRunnerHeartbeat — upsert one host's check-in. ON CONFLICT so the normal
@@ -225,4 +357,8 @@ module.exports = {
   allowGoal,
   disallowGoal,
   setPriorityGoal,
+  readBuilderScope,
+  setBuilderGoals,
+  setBuilderPause,
+  readAllRunnerScopes,
 };

package/modules/autonomy/fence.js

@@ -49,8 +49,78 @@ const REFUSALS = {
   goal_not_allowlisted: 'that goal is not on the allowlist',
   protected_path: 'the task declares work on a permission, migration, infrastructure or deploy-pipeline surface',
   grader_unavailable: 'the grader is bypassed, and it is the only review between an unattended worker and main',
+  not_permitted: 'your rank does not hold autonomy.run, so your runner may not work on this project',
+  builder_paused: 'the owner paused your runner',
+  no_builder_scope: 'you have not picked any goals for your runner — choose them in Settings',
 };
 
+// The stop codes effectiveFence may set, and the refusal each one becomes.
+const STOP_CODES = new Set(['kill_switch', 'not_permitted', 'builder_paused']);
+
+// effectiveFence — the fence ONE builder's runner reads (task 1004501).
+//
+// The project fence is one switch and one allowlist; each builder narrows it to the
+// goals they picked, and the owner can pause one builder without throwing the
+// master switch. This composes the three on the SERVER, so the runner stays dumb:
+// it reads `enabled` and `goals` exactly as before and cannot compute its own
+// widening, and a runner that predates this change gets the narrowing for free.
+//
+// The order is the order an operator asks "why is it idle": the project switch
+// first (it stops everyone), then whether this builder may run at all, then the
+// owner's pause on this builder. Each one wins over the ones after it.
+//
+// Empty picks mean NO goals, by owner ruling (2026-10-01): a builder who has set
+// nothing gets no autonomous work. Never "the whole allowlist".
+//
+// `project` is db.readFence()'s shape; `scope` is db.readBuilderScope()'s
+// ({ goals:[ids], owner_paused, owner_paused_reason, updated_at }) or null for a
+// builder with no row; `mayRun` is the autonomy.run answer, where anything but
+// `true` refuses. Returns null when the project fence is null (unreadable).
+function effectiveFence({ project, scope = null, mayRun = false } = {}) {
+  if (!project || typeof project !== 'object') return null;
+  const picks = new Set(((scope && scope.goals) || []).map(Number).filter((n) => Number.isSafeInteger(n) && n > 0));
+  const projectGoals = Array.isArray(project.goals) ? project.goals : [];
+  const goals = projectGoals.filter((g) => picks.has(Number(g && g.goal_id)));
+  const ids = goals.map((g) => Number(g.goal_id));
+  const priority = project.priority_goal_id != null && ids.includes(Number(project.priority_goal_id))
+    ? Number(project.priority_goal_id) : null;
+
+  let enabled = project.enabled === true;
+  let stopCode = enabled ? null : 'kill_switch';
+  let pausedReason = enabled ? null : (project.paused_reason || null);
+  if (enabled && mayRun !== true) {
+    enabled = false; stopCode = 'not_permitted'; pausedReason = REFUSALS.not_permitted;
+  } else if (enabled && scope && scope.owner_paused === true) {
+    enabled = false; stopCode = 'builder_paused';
+    pausedReason = scope.owner_paused_reason ? `${REFUSALS.builder_paused}: ${scope.owner_paused_reason}` : REFUSALS.builder_paused;
+  }
+
+  // The later of the two rows, so a pick or a pause wakes a runner that waits on
+  // the fence's updated_at exactly as a project change does.
+  const stamps = [project.updated_at, scope && scope.updated_at].filter(Boolean).map((t) => new Date(t).getTime()).filter(Number.isFinite);
+  const updatedAt = stamps.length ? new Date(Math.max(...stamps)).toISOString() : (project.updated_at || null);
+
+  return {
+    enabled,
+    paused_reason: pausedReason,
+    stop_code: stopCode,
+    priority_goal_id: priority,
+    updated_at: updatedAt,
+    updated_by: project.updated_by ?? null,
+    goals,
+    // What the caller chose and may do, so the Settings panel and the runner log
+    // can say WHY the goals are what they are without a second read.
+    scope: {
+      may_run: mayRun === true,
+      goals: [...picks],
+      owner_paused: !!(scope && scope.owner_paused === true),
+      owner_paused_reason: (scope && scope.owner_paused_reason) || null,
+    },
+    // The unnarrowed project fence, for the owner's gate page.
+    project,
+  };
+}
+
 // normaliseFence — turn whatever the route returned into something decidable, or
 // null for "unreadable". Deliberately strict: a shape this does not recognise is
 // unreadable, never a permissive default.
@@ -81,9 +151,18 @@ function normaliseFence(raw) {
   // the old behaviour, not a refusal: the allowlist alone is still a safe answer.
   const p = Number(raw.priority_goal_id);
   const priorityGoal = raw.priority_goal_id != null && Number.isSafeInteger(p) && p > 0 && ids.includes(p) ? p : null;
+  // Which layer turned it off (task 1004501). Only the known codes are honoured;
+  // anything else, including a server that predates them, reads as the kill switch,
+  // which refuses just the same.
+  const stopCode = STOP_CODES.has(raw.stop_code) ? raw.stop_code : 'kill_switch';
+  // A builder who has picked nothing gets nothing (owner ruling, 2026-10-01). Said
+  // as its own refusal so the log does not blame an empty project allowlist.
+  const noScope = !!(raw.scope && Array.isArray(raw.scope.goals) && raw.scope.goals.length === 0);
   return {
     enabled: raw.enabled === true,
     pausedReason: typeof raw.paused_reason === 'string' ? raw.paused_reason : null,
+    stopCode,
+    noScope,
     goals: ids,
     priorityGoal,
   };
@@ -129,6 +208,11 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
   if (!fence) return { go: false, code: 'fence_unreadable', reason: REFUSALS.fence_unreadable, goals: [] };
 
   if (!fence.enabled) {
+    // The builder-level stops carry their full sentence already (effectiveFence
+    // wrote it); only the project switch is prefixed, as before.
+    if (fence.stopCode !== 'kill_switch') {
+      return { go: false, code: fence.stopCode, goals: [], reason: fence.pausedReason || REFUSALS[fence.stopCode] };
+    }
     return {
       go: false, code: 'kill_switch', goals: [],
       reason: fence.pausedReason ? `${REFUSALS.kill_switch}: ${fence.pausedReason}` : REFUSALS.kill_switch,
@@ -148,12 +232,13 @@ function decideRun({ fence: rawFence, requestedGoals = [], graderBypassed = null
 
   const { goals, refused } = allowedGoals(fence, requestedGoals);
   if (!goals.length) {
+    const code = refused.length ? 'goal_not_allowlisted' : (fence.noScope ? 'no_builder_scope' : 'no_allowlist');
     return {
       go: false, goals: [], refusedGoals: refused,
-      code: refused.length ? 'goal_not_allowlisted' : 'no_allowlist',
+      code,
       reason: refused.length
         ? `${REFUSALS.goal_not_allowlisted} (asked for ${refused.join(', ')})`
-        : REFUSALS.no_allowlist,
+        : REFUSALS[code],
     };
   }
   // priorityGoal is reported only when it survived the intersection, so a row can
@@ -191,4 +276,4 @@ function decideTask({ task, goals = [], protectedHits = [] } = {}) {
   return { go: true, code: null, reason: null };
 }
 
-module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, decideRun, decideTask };
+module.exports = { REFUSALS, normaliseFence, prioritise, allowedGoals, effectiveFence, decideRun, decideTask };

package/modules/autonomy/migrations/autonomy_005_builder_scope.sql

@@ -0,0 +1,55 @@
+-- autonomy_005_builder_scope.sql — each builder's own runner scope, and the
+-- owner's per-builder pause (task 1004501).
+--
+-- Owner ruling, 2026-10-01: every builder says which work THEIR runner takes, and
+-- a builder who has said nothing gets NO autonomous work. Until now the fence was
+-- one switch and one list for every runner on the instance, so the owner could not
+-- stop one builder's machine without stopping all of them, and a builder could not
+-- narrow theirs to the goals they care about.
+--
+-- A NARROWING, NEVER A WIDENING. A builder's picks are a subset of the project
+-- allowlist, and the database holds that rather than a route remembering it:
+-- goal_id references autonomy_allowed_goals, so a goal that is not allowlisted
+-- cannot be picked at all. ON DELETE CASCADE is the safe direction: revoking a
+-- goal from the project removes it from every builder's picks, and re-allowing it
+-- later does NOT silently put it back. The runner's effective goals are
+-- project allowlist ∩ the caller's picks, computed on the server.
+--
+-- ON THE SERVER, for autonomy_001's reason. These rows bound what a machine nobody
+-- is watching may do; a pick list in a file on that machine would be writable by
+-- the very worker it bounds. The builder writes their own picks through an
+-- authenticated route keyed by their session, never by a body field.
+--
+-- autonomy_builder_scope holds the one row per builder that is not a list:
+--   owner_paused         the owner stopped THIS builder's runner. Written only by
+--                        the autonomy.fence.manage route; the builder cannot clear
+--                        it, because a pause the paused party can lift is not one.
+--   owner_paused_reason  why, shown to the builder and printed by their runner.
+--   owner_paused_by      who.
+--   updated_at           bumped on every pick or pause change. The route folds it
+--                        into the fence's updated_at, which is how a change wakes
+--                        a runner that is waiting for a signal.
+--
+-- No foreign key to builders, like autonomy_002: a row for a removed builder is
+-- inert, because no session can ever read it.
+--
+-- Additive and idempotent (ADR 0083 §Decision #5): safe to re-run.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS autonomy_builder_goals (
+  builder_id bigint NOT NULL,
+  goal_id    bigint NOT NULL REFERENCES autonomy_allowed_goals (goal_id) ON DELETE CASCADE,
+  added_at   timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (builder_id, goal_id)
+);
+
+CREATE TABLE IF NOT EXISTS autonomy_builder_scope (
+  builder_id          bigint PRIMARY KEY,
+  owner_paused        boolean NOT NULL DEFAULT false,
+  owner_paused_reason text,
+  owner_paused_by     bigint,
+  updated_at          timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -28,6 +28,7 @@ const auth = api;
 // neither core internals nor a sibling module, so importing it here is allowed.
 const autonomyGate = require('../../../scripts/gds/autonomy-gate');
 const db = require('../db');
+const fence = require('../fence');
 const runnerHealth = require('../runner-health');
 // The doorway's namespaced logger and strict body validator. Raw console.* is
 // ratcheted repo-wide (fitness.js console_call_count) and unstructured besides.
@@ -52,6 +53,49 @@ function runsLimit(raw) {
   return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
 }
 
+// holdsPermission — does this builder hold `key`? Asked of the government port
+// rather than mounted as a gate, because GET /autonomy/fence must answer EVERY
+// builder (a runner must always be able to learn it should stop); only the answer
+// changes. Fails closed: no port, or a resolver that throws, reads as "not held",
+// which turns the caller's fence off rather than on. The rot.js precedent.
+//
+// THE FOLD FIRST. This runs on the runner's read, every iteration of every runner,
+// so it must not add a query. requireBuilder already carries the session's grant
+// keys (`req.rawPermissionKeys`, the session-grants fold of task 1002556), and the
+// government port folds them into the held set in memory — the same path
+// requirePermission takes. The DB resolve is only the fallback for a session row
+// that did not carry the keys, exactly as in requirePermission.
+async function holdsPermission(req, key) {
+  try {
+    const governance = api.resolveOptional('government');
+    if (!governance) return false;
+    if (Array.isArray(req.rawPermissionKeys) && typeof governance.effectivePermissions === 'function') {
+      try {
+        return new Set(governance.effectivePermissions(req.rawPermissionKeys)).has(key);
+      } catch (err) {
+        log.error(`autonomy: permission fold failed for ${key} — falling back to the resolve: ${err && err.message}`);
+      }
+    }
+    if (typeof governance.builderHasPermissions !== 'function') return false;
+    return (await governance.builderHasPermissions(Number(req.builder.id), [key])) === true;
+  } catch (err) {
+    log.error(`autonomy: permission resolve failed for ${key} — denying fail-closed: ${err && err.message}`);
+    return false;
+  }
+}
+
+// goalIdsOrNull — a list of positive integer goal ids, or null for a malformed one.
+function goalIdsOrNull(v) {
+  if (!Array.isArray(v) || v.length > 200) return null;
+  const out = [];
+  for (const g of v) {
+    const n = Number(g);
+    if (!Number.isSafeInteger(n) || n <= 0) return null;
+    out.push(n);
+  }
+  return out;
+}
+
 // commitOrNull — a full lowercase commit sha, or null (task 1004407).
 function commitOrNull(v) {
   return typeof v === 'string' && /^[0-9a-f]{40}$/.test(v) ? v : null;
@@ -102,15 +146,24 @@ module.exports = function buildAutonomyRouter() {
   // you must stop should never require an elevated session, because the failure
   // mode of "could not read the fence" is a machine that keeps going. The body
   // carries no secret — it is a boolean, a reason string and a list of goal ids.
+  //
+  // THE CALLER'S fence, not the project's (task 1004501). The top-level `enabled`
+  // and `goals` are what THIS builder's runner may do: the project switch, then
+  // `autonomy.run`, then the owner's pause on this builder, and the allowlist
+  // narrowed to their own picks (fence.js effectiveFence). Computing it here keeps
+  // the runner dumb and means a runner that predates this change is narrowed too.
+  // The unnarrowed project fence rides along as `project` for the owner's page.
   router.get('/autonomy/fence', auth.requireBuilder, async (req, res) => {
     try {
-      const fence = await db.readFence();
+      const [project, scope, mayRun] = await Promise.all([
+        db.readFence(), db.readBuilderScope(req.builder.id), holdsPermission(req, 'autonomy.run'),
+      ]);
       // Null means the singleton row is missing, i.e. the migration has not run.
       // Say so rather than synthesising a default: a fabricated { enabled: false }
       // is indistinguishable from a real one, and an operator would chase a kill
       // switch nobody threw.
-      if (!fence) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
-      res.json(fence);
+      if (!project) return res.fail('fence_uninitialised', { status: 503, message: 'the autonomy fence row is missing — run the module migrations' });
+      res.json(fence.effectiveFence({ project, scope, mayRun }));
     } catch (err) {
       log.error('[gds] GET /autonomy/fence', err);
       // FAIL CLOSED, unlike the precheck above. That one is fail-open because an
@@ -202,6 +255,73 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // ── each builder's own runner scope (task 1004501) ─────────────────────────
+
+  // A builder picks which allowlisted goals THEIR runner works. Replaces the whole
+  // list; `[]` means "my runner takes no work". Keyed by the session, never the
+  // body, so nobody can set another builder's picks. Behind `autonomy.run`: a
+  // builder who may not run a runner has nothing to scope. A goal not on the
+  // project allowlist is refused with 409 and nothing is written — the pick can
+  // narrow the project fence and never widen it.
+  router.put('/autonomy/me/goals', auth.requireBuilder, auth.requirePermission('autonomy.run'), async (req, res) => {
+    if (validateOrRespond(req, res, { goal_ids: { required: true } })) return;
+    const goalIds = goalIdsOrNull(req.body && req.body.goal_ids);
+    if (!goalIds) return res.fail('goal_ids_required', { status: 400, message: 'pass { "goal_ids": [<number>, …] } — an empty list means no work' });
+    try {
+      const out = await db.setBuilderGoals({ builderId: req.builder.id, goalIds });
+      if (out.notAllowed) return res.fail('goal_not_allowlisted', { status: 409, message: `not on the project allowlist: ${out.notAllowed.join(', ')}` });
+      log.info(`[gds] autonomy scope: builder ${req.builder.id} picked goals [${out.goals.join(', ')}]`);
+      res.json({ goals: out.goals });
+    } catch (err) {
+      log.error('[gds] PUT /autonomy/me/goals', err);
+      res.fail('scope_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The owner pauses or resumes ONE builder's runner without throwing the master
+  // switch. Same atom as the kill switch: stopping a machine is the same act
+  // whether it is everyone's or one person's, and the paused builder must not be
+  // able to lift it (autonomy.run does not reach this route).
+  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      paused: { required: true, type: 'boolean' },
+      reason: { type: 'string', maxLength: 500 },
+    })) return;
+    const builderId = Number(req.params.builderId);
+    if (!Number.isSafeInteger(builderId) || builderId <= 0) return res.fail('bad_builder_id', 400);
+    const reason = typeof req.body.reason === 'string' ? req.body.reason : null;
+    try {
+      const row = await db.setBuilderPause({ builderId, paused: req.body.paused, reason, byBuilderId: req.builder.id });
+      if (!row) return res.fail('builder_not_found', { status: 404, message: `no builder ${builderId}` });
+      log.info(`[gds] autonomy: builder ${builderId}'s runner ${req.body.paused ? 'PAUSED' : 'RESUMED'} by builder ${req.builder.id} (${req.builder.rank})${reason ? `: ${reason}` : ''}`);
+      res.json(row);
+    } catch (err) {
+      log.error('[gds] POST /autonomy/builders/:builderId/pause', err);
+      res.fail('pause_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // The owner's view of every builder's runners: who, which goals they picked,
+  // whether they are paused, and each runner's health — the server's verdict, as
+  // GET /autonomy/runners attaches it. Owner-only: a heartbeat names a machine
+  // and its hostname, which is each builder's own business (task 1003905), and the
+  // owner is the one person who needs every row to run the fence.
+  router.get('/autonomy/runners/all', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+    try {
+      const rows = await db.readAllRunnerScopes();
+      const nowMs = Date.now();
+      res.json({
+        builders: rows.map((b) => ({
+          ...b,
+          runners: b.runners.map((r) => ({ ...r, health: runnerHealth.describeRunner(r, { nowMs }) })),
+        })),
+      });
+    } catch (err) {
+      log.error('[gds] GET /autonomy/runners/all', err);
+      res.fail('runners_unreadable', { status: 503, message: 'could not read the runner scopes' });
+    }
+  });
+
   // ── the runner heartbeat (task 1003905) ────────────────────────────────────
   //
   // A dead runner must be VISIBLE, not silent. The runner also writes a heartbeat

package/modules/economy/earnings.js

@@ -0,0 +1,117 @@
+'use strict';
+
+// modules/economy/earnings.js — WHAT EARNED A BUILDER'S CREDITS, DAY BY DAY
+// (task 1004436 / WA6.RP06, goal 1000095, criterion wa6-roles-read-true-in-public).
+//
+// WHY. The profile's earnings chart drew only for someone who had shipped a task
+// (profile-charts.js stopped at "No works shipped yet" before it read a credit),
+// and its line came from the itemised ledger, which another builder may read only
+// with builder.roster.read. So an artist or an ideator with a full credit history
+// got no chart at all, and a signed-in viewer below Metic got an estimate summed
+// from shipped tasks, which for those two crafts is nothing. The owner's decision
+// (a), 2026-09-30, is that earnings are a SIGNED-IN read, for everyone.
+//
+// This is that read: per day, per KIND of credit, summed. No row, no task, no
+// session and no description leaves here, so it carries none of the itemisation
+// the ledger route gates. The total already sits on the public leaderboard; what
+// this adds is when it was earned and by what kind of work.
+//
+// THE KINDS, per credit_log row (first match wins):
+//
+//   task.shipped · task.confirmed             task           Tasks shipped
+//   session.token_reward                      session        Session rewards
+//   tweak.page_approved:<task>                page           Pages approved
+//   idea.credit.task_ship: (a descent hop)    idea-descent   Work split from their ideas
+//   idea.credit.task_ship: · idea_promotion_  idea-ship      Ideas that became shipped work
+//     bonus
+//   idea.credit.full_pass:                    idea-full      Full Ideas passed
+//   idea.credit.governance_pass:              idea-board     Ratified by the board
+//   ship.net_negative                         net-negative   Simplification bonuses
+//   anything else                             other          achievements, rank, a grant
+//
+// A descent payment shares stream 1's reason key by design (credits.js: one
+// payment per origin per ship, however the descent is re-walked), so the reason
+// cannot tell it apart. Its description can: the descent writer, and only it,
+// says the task shipped "N hop(s) below idea #". DESCENT_MARK is that phrase, and
+// tests/profile_earnings.mjs holds it against the writer's own text.
+//
+// The words for each kind live with the picture (profile-charts.js); this file
+// owns only which kind a credit is.
+//
+// ONLY READS. Nothing here writes, and nothing is reachable from a ship path.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const { ARTIST_PAGE_REASON_PREFIX, IDEA_STREAM_REASON_PREFIXES } = require('./credits');
+
+const KINDS = Object.freeze([
+  'task', 'session', 'page', 'idea-ship', 'idea-descent', 'idea-full', 'idea-board', 'net-negative', 'other',
+]);
+
+const DESCENT_MARK = ' below idea #';
+
+// The prefixes go into the SQL as LIKE patterns, so their underscores (a LIKE
+// wildcard) are escaped. Checked at load: they are economy's own constants,
+// never a request value, and the check keeps it that way.
+function likePrefix(prefix) {
+  if (!/^[a-z0-9_.]+:$/i.test(prefix)) {
+    throw new Error(`economy/earnings: reason prefix is not a plain literal: ${prefix}`);
+  }
+  return prefix.replace(/([\\%_])/g, '\\$1') + '%';
+}
+const LIKE = Object.freeze({
+  page: likePrefix(ARTIST_PAGE_REASON_PREFIX),
+  ship: likePrefix(IDEA_STREAM_REASON_PREFIXES.task_ship),
+  full: likePrefix(IDEA_STREAM_REASON_PREFIXES.full_pass),
+  board: likePrefix(IDEA_STREAM_REASON_PREFIXES.governance_pass),
+});
+
+// One statement, one builder: idx_credit_log_builder (builder_id, recorded_at)
+// serves the WHERE, so the read is that person's rows, never the whole ledger.
+// The day is the UTC day, the one the page's axis and the ledger fixture use.
+const EARNINGS_SQL = `
+  SELECT to_char((recorded_at AT TIME ZONE 'UTC')::date, 'YYYY-MM-DD') AS day,
+         CASE
+           WHEN reason IN ('task.shipped', 'task.confirmed') THEN 'task'
+           WHEN reason = 'session.token_reward' THEN 'session'
+           WHEN reason LIKE $2 THEN 'page'
+           WHEN reason LIKE $3 AND COALESCE(description, '') LIKE $6 THEN 'idea-descent'
+           WHEN reason LIKE $3 OR reason = 'idea_promotion_bonus' THEN 'idea-ship'
+           WHEN reason LIKE $4 THEN 'idea-full'
+           WHEN reason LIKE $5 THEN 'idea-board'
+           WHEN reason = 'ship.net_negative' THEN 'net-negative'
+           ELSE 'other'
+         END AS kind,
+         SUM(delta)::float8 AS credits
+    FROM credit_log
+   WHERE builder_id = $1
+   GROUP BY 1, 2
+   ORDER BY 1, 2`;
+
+// foldEarnings — the grouped rows into the route's shape. Pure. Days ascending;
+// `totals` names every kind (0 where nothing was earned, so a reader never has
+// to guess whether a missing key means zero); `total` is the sum of the parts,
+// which is the ledger's own sum for this builder.
+function foldEarnings(rows) {
+  const totals = {};
+  for (const k of KINDS) totals[k] = 0;
+  const days = [];
+  for (const r of rows || []) {
+    const kind = KINDS.includes(r.kind) ? r.kind : 'other';
+    const credits = Math.round(Number(r.credits) || 0);
+    if (!r.day || credits === 0) continue;
+    days.push({ day: String(r.day), kind, credits });
+    totals[kind] += credits;
+  }
+  days.sort((a, b) => (a.day < b.day ? -1 : a.day > b.day ? 1 : KINDS.indexOf(a.kind) - KINDS.indexOf(b.kind)));
+  const total = Object.values(totals).reduce((a, b) => a + b, 0);
+  return { days, totals, total };
+}
+
+async function readEarnings(builderId, { client = null } = {}) {
+  const q = client || pool;
+  const { rows } = await q.query(EARNINGS_SQL, [builderId, LIKE.page, LIKE.ship, LIKE.full, LIKE.board, `%${DESCENT_MARK}%`]);
+  return foldEarnings(rows);
+}
+
+module.exports = { readEarnings, foldEarnings, KINDS, DESCENT_MARK, EARNINGS_SQL };

package/modules/economy/module.json

@@ -6,7 +6,7 @@
   "coreVersion": "^1.7.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["cost", "credits", "leaderboard", "reward"] },
+  "contributes": { "routes": ["cost", "credits", "earnings", "leaderboard", "reward"] },
   "provides": ["reward"],
   "consumes": []
 }