@bongos/core 1.21.105 → 1.21.107

package/migrations/core_275_claims_auto_pickup.sql

@@ -0,0 +1,24 @@
+-- core_275 a claim can carry the auto_pickup mark
+-- Applied under task 1004677 (BV2.TW19a, ADR 0371 D5/D6).
+--
+-- WHY. The Autobongos tweak lane picks up a submitted page round with nobody at a
+-- terminal, and each pickup costs the project a grade nobody chose to spend. So the
+-- lane claims with a mark, and the SERVER counts marked claims at claim time:
+-- tweak.autopickup_monthly_cap per calendar month, and at most two per round. The
+-- count is read from these rows (the ledger), never from a stored counter.
+--
+-- SHAPE. One nullable boolean. NULL and false both mean "an ordinary claim"; only
+-- true is counted. Nullable with no default, so the column is additive and an
+-- older release that never names it keeps inserting exactly as before.
+--
+-- The partial index serves the two counts (this month's marked claims, and one
+-- round's marked claims), and stays tiny: only marked rows are in it.
+
+ALTER TABLE claims ADD COLUMN IF NOT EXISTS auto_pickup boolean;
+
+CREATE INDEX IF NOT EXISTS idx_claims_auto_pickup
+  ON claims (claimed_at, task_id)
+  WHERE auto_pickup IS TRUE;
+
+INSERT INTO schema_migrations (version) VALUES ('core_275_claims_auto_pickup')
+  ON CONFLICT (version) DO NOTHING;

package/modules/government/decision-rules.js

@@ -66,6 +66,7 @@ const AREAS = Object.freeze([
     today: 'whoever may change the project settings', acts: Object.freeze([
       'PATCH /project-settings/rot-days',
       'PATCH /project-settings/ship-mode',
+      'PATCH /project-settings/tweak-autopickup',
       'PATCH /work-categories/:id',
     ]) }),
   Object.freeze({ key: 'disputes', name: 'Disputes', gate: 'security.report.adjudicate',

package/modules/lifecycle/autopickup.js

@@ -0,0 +1,94 @@
+'use strict';
+
+// modules/lifecycle/autopickup.js — the server's half of tweak auto-pickup
+// (task 1004677 / BV2.TW19a, ADR 0371 D3, D5, D6).
+//
+// The Autobongos tweak lane claims a submitted page round with an `auto_pickup`
+// mark (claims.auto_pickup, migration core_275). The runner is a builder's own
+// process, so the limits on it are NOT left to the runner: claimTask calls
+// autoPickupRefusal inside its transaction and the claim is refused when
+//
+//   - the claim is marked but the task is not a page-tweak round  (AUTO_PICKUP_NOT_A_TWEAK)
+//   - the project has tweak.autopickup off                         (AUTO_PICKUP_OFF)
+//   - this calendar month already holds `cap` marked claims        (AUTO_PICKUP_CAP_REACHED)
+//   - this round already has two marked claims                     (AUTO_PICKUP_ROUND_LIMIT)
+//
+// THE LOCK. The count and the claim insert must not interleave with another
+// runner's, or two runners racing for the last slot both read cap-1 and both
+// insert. So the count runs after pg_advisory_xact_lock('page-tweak/autopickup'),
+// one project-wide key, held to the end of claimTask's transaction (the insert
+// commits under it). Only marked claims take the lock; an ordinary claim never
+// waits on it.
+//
+// COUNTED FROM THE LEDGER, never a counter: a stored number drifts the first time
+// a write fails between the claim and the bump. A released claim still counts —
+// the pickup happened and the grade may already have been spent.
+//
+// The mark is a cost brake on a runner the owner chose to run, not a security
+// boundary: a claim without it is an ordinary claim its builder could make by hand.
+
+const api = require('../../src/module-api');
+
+const PAGE_TWEAK_SOURCE = 'page-tweak';
+const LOCK_KEY = 'page-tweak/autopickup';
+// D6.2: one apply plus one try at the artist's note; a round sent back twice is a
+// disagreement a person should read.
+const MAX_AUTO_APPLIES_PER_ROUND = 2;
+
+// The two counts, on any executor (the claim transaction's client, or the pool).
+// Month boundaries are the database's, so every runner and every reader agree.
+const MONTH_COUNT_SQL = `
+  SELECT count(*)::int AS n
+    FROM claims c JOIN tasks t ON t.id = c.task_id
+   WHERE c.auto_pickup IS TRUE
+     AND t.source = '${PAGE_TWEAK_SOURCE}'
+     AND c.claimed_at >= date_trunc('month', now())`;
+const ROUND_COUNT_SQL = `
+  SELECT count(*)::int AS n FROM claims WHERE task_id = $1 AND auto_pickup IS TRUE`;
+
+async function countThisMonth(exec = api.pool) {
+  const { rows } = await exec.query(MONTH_COUNT_SQL);
+  return Number(rows[0] && rows[0].n) || 0;
+}
+
+async function countForRound(exec, taskId) {
+  const { rows } = await exec.query(ROUND_COUNT_SQL, [taskId]);
+  return Number(rows[0] && rows[0].n) || 0;
+}
+
+// autoPickupRefusal(client, task, settings) — null when the marked claim may
+// proceed, else the refusal object claimTask throws. `settings` is the resolved
+// { mode, cap }, read BEFORE the transaction opens (the claimPermissionsFor
+// precedent: a settings read is not part of the claim's consistency).
+async function autoPickupRefusal(client, task, settings) {
+  if (!task || task.source !== PAGE_TWEAK_SOURCE) {
+    return { code: 'AUTO_PICKUP_NOT_A_TWEAK', message: 'Only a page tweak round can be claimed with the auto_pickup mark.' };
+  }
+  const s = settings || {};
+  if (s.mode !== 'on') {
+    return { code: 'AUTO_PICKUP_OFF', message: 'Tweak auto-pickup is off for this project, so a submitted page waits for a person.' };
+  }
+  await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [LOCK_KEY]);
+  const forRound = await countForRound(client, task.id);
+  if (forRound >= MAX_AUTO_APPLIES_PER_ROUND) {
+    return {
+      code: 'AUTO_PICKUP_ROUND_LIMIT', applied: forRound, limit: MAX_AUTO_APPLIES_PER_ROUND,
+      message: `This page round was already applied automatically ${forRound} times, so it waits for a person.`,
+    };
+  }
+  const used = await countThisMonth(client);
+  if (used >= s.cap) {
+    return {
+      code: 'AUTO_PICKUP_CAP_REACHED', used, cap: s.cap,
+      message: `Auto-pickup has used this month's ${s.cap} rounds, so submitted pages wait for a person until next month.`,
+    };
+  }
+  return null;
+}
+
+module.exports = {
+  LOCK_KEY,
+  MAX_AUTO_APPLIES_PER_ROUND,
+  countThisMonth,
+  autoPickupRefusal,
+};

package/modules/lifecycle/db-claims.js

@@ -37,6 +37,7 @@ const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeNa
 const { sealSessionLog } = require('./db-shared.js');
 const { gatingRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
+const { autoPickupRefusal } = require('./autopickup.js');
 
 // -------------------------------------------------------------------------
 // Claims (atomic)
@@ -99,8 +100,11 @@ function isRebaseGateExempt(task) {
   return Boolean(task) && task.kind === 'infra' && Number(task.priority) === 1;
 }
 
-async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false }) {
+async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false, autoPickup = false }) {
   const heldPermissions = await claimPermissionsFor(builderId); // BV1.R106 — before the tx opens
+  // ADR 0371 D5: a marked claim needs the project's switch and cap, read before the
+  // tx like the permissions above; the COUNT runs inside it, under the lock.
+  const autoPickupSettings = autoPickup ? await api.projectSettings.resolveTweakAutopickup() : null;
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -142,7 +146,7 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     }
 
     const { rows: taskRows } = await client.query(
-      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind, goal_id FROM tasks WHERE id = $1 FOR UPDATE`,
+      `SELECT id, status, touches, newcomer_friendly, requires_rank, needs_migration, module_key, credits_reward, reward_gate_exempt, est_minutes, kind, goal_id, source FROM tasks WHERE id = $1 FOR UPDATE`,
       [taskId]
     );
     if (taskRows.length === 0) {
@@ -350,6 +354,14 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
       }
     }
 
+    // ADR 0371 D5/D6 (task 1004677): the auto_pickup mark. The cap and the per-round
+    // limit are counted under a project-wide advisory lock that this transaction
+    // holds through the insert below, so two runners cannot both take the last slot.
+    if (autoPickup) {
+      const refusal = await autoPickupRefusal(client, task, autoPickupSettings);
+      if (refusal) throw refusal;
+    }
+
     // Pre-allocate a migration number if the task signals it'll add one.
     // Trigger: the tasks.needs_migration boolean (migration 081, touches[]
     // cleanup [1/8] / task 876). Replaced the old touches[]-contains-'migrations/'
@@ -396,9 +408,11 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
       finalWorktreeName = disambiguateWorktreeName(finalWorktreeName, taken);
     }
 
+    // The column is named only on a marked claim, so an ordinary claim's insert is
+    // byte-identical to before core_275.
     const insertClaim = await client.query(
-      `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)
+      `INSERT INTO claims (task_id, builder_id, worktree_name, requested_worktree_name, head_sha, reserved_migration_number, creator_session_id${autoPickup ? ', auto_pickup' : ''})
+       VALUES ($1, $2, $3, $4, $5, $6, $7${autoPickup ? ', TRUE' : ''})
        RETURNING id, task_id, builder_id, worktree_name, requested_worktree_name, claimed_at, head_sha, reserved_migration_number`,
       [taskId, builderId, finalWorktreeName, requestedWorktreeName, headSha ?? null, reservedMigrationNumber, creatorSessionId ?? null]
     );

package/modules/lifecycle/routes/claims.js

@@ -276,8 +276,12 @@ module.exports = function buildClaimsRouter() {
       // an interactive single-human claim only WARNS (git merge is the real
       // collision detector — ADR 0017).
       enforce_touches: { type: 'boolean' },
+      // ADR 0371 D5 (task 1004677): the Autobongos tweak lane's mark. The server
+      // counts marked claims against the project's monthly cap and the per-round
+      // limit; see modules/lifecycle/autopickup.js.
+      auto_pickup: { type: 'boolean' },
     })) return;
-    const { task_id: taskId, worktree_name: worktreeName, head_sha: headSha, bind_session: bindSession, enforce_touches: enforceTouches } = req.body || {};
+    const { task_id: taskId, worktree_name: worktreeName, head_sha: headSha, bind_session: bindSession, enforce_touches: enforceTouches, auto_pickup: autoPickup } = req.body || {};
     // Belt-and-braces — task_id must coerce to a finite number. Older calls
     // sent string ints (Number.isFinite passes both); reject NaN/garbage.
     if (!Number.isFinite(Number(taskId))) {
@@ -291,6 +295,7 @@ module.exports = function buildClaimsRouter() {
         headSha: headSha ?? null,
         creatorSessionId: resolveCreatorSessionId(bindSession, req.gdsSession?.session_id),
         enforceOverlap: enforceTouches === true,
+        autoPickup: autoPickup === true,
       });
       const { just_unlocked: justUnlocked, overlap_warning: overlapWarning, sibling_overlap_warning: siblingOverlapWarning, ...claim } = claimResult;
       const task = await db.getTask(Number(taskId));
@@ -375,6 +380,12 @@ module.exports = function buildClaimsRouter() {
           // block, not an authorization refusal). The refusal object already
           // carries `message` + `hint`, so no extra hint-building step needed.
           err.code === 'RELEVANCE_REVIEW_PENDING' ? 409 :
+          // ADR 0371 D5/D6: a marked auto-pickup claim the project's switch, monthly
+          // cap or per-round limit refuses. The round waits for a person.
+          err.code === 'AUTO_PICKUP_NOT_A_TWEAK' ? 409 :
+          err.code === 'AUTO_PICKUP_OFF' ? 409 :
+          err.code === 'AUTO_PICKUP_CAP_REACHED' ? 409 :
+          err.code === 'AUTO_PICKUP_ROUND_LIMIT' ? 409 :
           500;
         // V4.R14 (#952): a TASK_NOT_READY 409 names the way forward instead of
         // leaving the caller to discover the promote route by spelunking (#506).

package/modules/lifecycle/routes/project-settings.js

@@ -31,6 +31,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const goalCategory = require('../goal-category');
+const autopickup = require('../autopickup');
 
 const log = api.logger('lifecycle');
 
@@ -380,6 +381,64 @@ module.exports = function buildProjectSettingsRouter() {
     }
   });
 
+  // --- tweak auto-pickup (task 1004677, ADR 0371 D3/D5) ----------------------
+  //
+  // GET /project-settings/tweak-autopickup — the switch, the monthly cap, and how
+  // many rounds the lane has picked up this calendar month (counted from marked
+  // claims, never a stored counter).
+  //
+  // rank: any signed-in builder. The runner reads it before it tries a round, and
+  // the studio shows the count; it carries no reward internals or file paths.
+  async function autopickupBody() {
+    const resolved = await api.projectSettings.resolveTweakAutopickup();
+    const used = await autopickup.countThisMonth();
+    return {
+      mode: resolved.mode,
+      cap: resolved.cap,
+      used_this_month: used,
+      remaining_this_month: Math.max(0, resolved.cap - used),
+      per_round_limit: autopickup.MAX_AUTO_APPLIES_PER_ROUND,
+      source: resolved.source,
+      invalid: resolved.invalid,
+      sentence: api.projectSettings.describeTweakAutopickup(resolved),
+    };
+  }
+
+  router.get('/project-settings/tweak-autopickup', api.requireBuilder, async (req, res) => {
+    try {
+      res.set('Cache-Control', 'no-store');
+      res.json(await autopickupBody());
+    } catch (err) {
+      log.error(`GET /project-settings/tweak-autopickup: ${err && err.message}`);
+      res.fail('project_settings_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // PATCH /project-settings/tweak-autopickup — body { mode?: 'off' | 'on', cap?: n }.
+  //
+  // rank: project.settings.manage (metic+, government_010), the same atom as the
+  // other writes on this page. Each field is validated by the resolver's own parser,
+  // and both are checked before either is written, so a half-valid body writes nothing.
+  router.patch('/project-settings/tweak-autopickup', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
+    if (api.validateOrRespond(req, res, { mode: { type: 'string' }, cap: { type: 'number' } })) return;
+    const body = req.body || {};
+    if (body.mode == null && body.cap == null) {
+      return res.fail('bad_tweak_autopickup', { status: 400, message: 'send mode, cap, or both' });
+    }
+    const mode = body.mode == null ? null : api.projectSettings.parseAutopickup(body.mode);
+    if (mode && !mode.mode) return res.fail('bad_tweak_autopickup', { status: 400, message: `mode: ${mode.reason}` });
+    const cap = body.cap == null ? null : api.projectSettings.parseAutopickupCap(body.cap);
+    if (cap && cap.cap == null) return res.fail('bad_tweak_autopickup', { status: 400, message: `cap: ${cap.reason}` });
+    try {
+      if (mode) await api.projectSettings.set(api.projectSettings.KEYS.TWEAK_AUTOPICKUP, mode.mode, req.builder.id);
+      if (cap) await api.projectSettings.set(api.projectSettings.KEYS.TWEAK_AUTOPICKUP_CAP, cap.cap, req.builder.id);
+      res.json({ ok: true, ...(await autopickupBody()) });
+    } catch (err) {
+      log.error(`PATCH /project-settings/tweak-autopickup: ${err && err.message}`);
+      res.fail('project_settings_write_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };
 

package/modules/public-landing/public/projects-hall-live.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The create wizard done panel once the hall answers (task 1004503): the same walk as projects.states.json in-new-done, with the instance list aliased so the project just filed (id 102) is live and verified up. The invite box opens only now; in-new-done in the main file pictures it shut while the project is set up. Rendered by name: node modules/ui-design/kit/render.js --states modules/public-landing/public/projects-hall-live.states.json",
+  "_": "The create wizard done panel once the hall answers (task 1004503): the same walk as projects.states.json in-new-done, with the instance list aliased so the project just filed (id 102) is live and verified up, with its GitHub app approved, installed and signed in (since task 1004683 part 03 says it is alive only once every required fact is done). The invite box and the Enter Genesis door open only now; in-new-done in the main file pictures it shut while the project is set up. Rendered by name: node modules/ui-design/kit/render.js --states modules/public-landing/public/projects-hall-live.states.json",
   "page": "/projects",
   "surface": "public-landing",
   "modes": [
@@ -131,7 +131,8 @@
           "#panel-done",
           "#wizInvite",
           "#wizInviteWho",
-          "#humanSteps"
+          "#doneAlive",
+          "#enterGenesis"
         ],
         "hidden": [
           "#hop",

package/modules/public-landing/public/projects-setup.states.json

@@ -0,0 +1,91 @@
+{
+  "_": "Part 03 after Create, the five scenarios of the design of record docs/design/mocks/day-night-rooms/setup-status.html (task 1004683): the same page and stub, the instance list aliased to one project per scenario, each opened by URL the way the GitHub return route lands a founder (?view=new&id=<project>). The GitHub halves of each owner read come from the REAL projections (see the fixture's note). The room follows the viewer's clock, so these renders picture whichever room the machine's clock gives, and the stub serves a local address with no apex base, so the Approve fact pictures its local-platform branch (GitHub cannot reach a local platform) rather than Connect GitHub. The day and night shots attached to the task were taken with the browser's timezone moved and the apex stamped. Rendered by name: node modules/ui-design/kit/render.js --states modules/public-landing/public/projects-setup.states.json",
+  "page": "/projects",
+  "surface": "public-landing",
+  "modes": [
+    "dark"
+  ],
+  "modeQuery": false,
+  "stub": {
+    "fixtures": {
+      "provisioning-instances": "provisioning-instances-setup"
+    }
+  },
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/my-projects",
+    "/github/orgs",
+    "/env-manifest$"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/me",
+    "\\b401\\b",
+    "\\b404\\b",
+    "Unauthorized"
+  ],
+  "ignoreControls": [
+    ".skip",
+    ".vh"
+  ],
+  "states": {
+    "setup-just-created": {
+      "auth": true,
+      "url": "/projects?view=new&id=201",
+      "actions": [["wait", 1500]],
+      "expect": {
+        "visible": ["#panel-done", "#setupNow", "#homeFacts", "#ghFacts", "#hopLink", "#homeFacts [data-fact=\"server\"].now"],
+        "hidden": ["#wizParts", "#hop", "#doneAlive", "#aaPick"],
+        "text": [["#donePartT", "Getting kestrel ready"], ["#ghState", "1 of 6 done"]]
+      }
+    },
+    "setup-waiting-on-github": {
+      "auth": true,
+      "url": "/projects?view=new&id=202",
+      "actions": [["wait", 1500]],
+      "expect": {
+        "visible": ["#panel-done", "#homeFacts [data-fact=\"answers\"].now"],
+        "hidden": ["#hop", "#doneAlive", "#aaPick"],
+        "text": [["#ghState", "2 of 6 done"]]
+      }
+    },
+    "setup-installing": {
+      "auth": true,
+      "url": "/projects?view=new&id=203",
+      "actions": [["wait", 1500]],
+      "expect": {
+        "visible": ["#panel-done", "#ghFacts [data-fact=\"install\"].you"],
+        "hidden": ["#hop", "#doneAlive"],
+        "text": [["#ghState", "4 of 6 done"]]
+      }
+    },
+    "setup-stopped": {
+      "auth": true,
+      "url": "/projects?view=new&id=204",
+      "actions": [["wait", 1500]],
+      "expect": {
+        "visible": ["#panel-done", "#ghFacts [data-fact=\"install\"].bad [data-action=\"pick-up\"]"],
+        "hidden": ["#hop", "#doneAlive"],
+        "text": [["#ghState", "5 of 6 done"]]
+      }
+    },
+    "setup-all-done": {
+      "auth": true,
+      "url": "/projects?view=new&id=205",
+      "actions": [["wait", 1500]],
+      "expect": {
+        "visible": ["#panel-done", "#doneAlive", "#enterGenesis"],
+        "hidden": ["#hop", "#hopLink"],
+        "text": [["#ghState", "ready ✓"], ["#done-h", "wren is alive."], ["#enterGenesis", "Enter Genesis"]]
+      }
+    },
+    "setup-cloud-hop-open": {
+      "auth": true,
+      "url": "/projects?view=new&id=201",
+      "actions": [["wait", 1200], ["click", "#hopLink"], ["wait", 600]],
+      "expect": {
+        "visible": ["#hop", "#hopCanvas"],
+        "attr": [["#hopLink", "aria-expanded", "true"]]
+      }
+    }
+  }
+}