@bongos/core 1.21.112 → 1.21.114

package/modules/ui-design/kit/serve.js

@@ -567,6 +567,19 @@ function ownedRequests() {
   return Object.values(guildsHeld()).filter((g) => g.members && g.members.you.membership_kind === 'owner')
     .flatMap((g) => ((g.requests && g.requests.incoming) || []).map((r) => ({ ...r, guild: { slug: g.members.guild.slug, name: g.members.guild.name } })));
 }
+// GET /me/guilds (the account page's guild notice, task 1004260; ADR 0337 D4.4): the guilds
+// the builder is in, each with their own two switches, derived from the SAME held set the
+// guild page reads and writes — so a switch flipped there reads back here, as on the server.
+// The route's own row shape (guilds.listMyGuilds): slug, name, visibility, membership_kind,
+// shown_publicly, counted_in_totals, joined_at; count is the array's length.
+function myGuilds(res) {
+  const mine = Object.values(guildsHeld()).filter((g) => g.members && g.members.you).map((g) => ({
+    slug: g.members.guild.slug, name: g.members.guild.name, visibility: g.members.guild.visibility,
+    membership_kind: g.members.you.membership_kind, shown_publicly: g.members.you.shown_publicly,
+    counted_in_totals: g.members.you.counted_in_totals, joined_at: g.members.you.joined_at || null,
+  }));
+  return json(res, 200, { guilds: mine, count: mine.length });
+}
 function myGuildRequests(res) {
   const q = heldFixture('me__guild-requests');
   const owner = ownedRequests();
@@ -598,6 +611,79 @@ function guildEngagementLive(slug, origin) {
   return (heldFixture('me__guild-engagements').engagements || []).some((e) => e.guild && e.guild.slug === slug.toLowerCase() && e.project && sameOrigin(e.project.origin, origin));
 }
 
+// The connections page (task 1004278): GET /connections, /connections/requests and
+// /connections/suggestions answered from ONE graph held for the run (connections.json, or
+// the file a states file's stub.fixtures names), so an accept, decline, withdraw, remove or
+// ask the page re-reads comes back changed. The routes' answers are mirrored
+// (modules/platform-identity/routes/connections.js): a sent ask is the bare
+// 201 { status: 'pending' } with no id, a decline a silent 204, a row the caller may not
+// act on one 404, an open pair 409, your own handle 400, and an unknown handle the same 404
+// a private or inactive one gets. "inactive": true in the graph answers every route 403,
+// the provisional-profile refusal. The caps are copied (a kit module may not import one).
+// FAIL=connections makes the two load-bearing reads 500; FAIL=connection-suggestions only
+// the suggestions read, which the page treats as additive.
+let GRAPH = null;
+function graph() {
+  if (!GRAPH) GRAPH = stamp(heldFixture('connections'));
+  return GRAPH;
+}
+const STUB_CONN_HANDLE_MAX = 39;
+const STUB_CONN_NOTE_MAX = 280;
+let STUB_CONN_NEXT_ID = 900;
+function withAvatar(row, origin) {
+  return typeof row.avatar_url === 'string' && row.avatar_url.startsWith('/') ? { ...row, avatar_url: origin + row.avatar_url } : row;
+}
+function connInactive(res) { return refuse(res, 403, 'profile_provisional', 'sign in to the platform once to activate your profile before connecting'); }
+function connRead(res, which, origin) {
+  const g = graph();
+  if (g.inactive) return connInactive(res);
+  if (which !== 'suggestions' && FAIL.has('connections')) return json(res, 500, { error: { code: 'stub_failure', message: 'FAIL=connections' } });
+  if (which === 'suggestions' && FAIL.has('connection-suggestions')) return json(res, 500, { error: { code: 'stub_failure', message: 'FAIL=connection-suggestions' } });
+  const rows = (k) => (g[k] || []).map((r) => withAvatar(r, origin));
+  if (which === 'list') { const connections = rows('connections'); return json(res, 200, { connections, count: connections.length }); }
+  if (which === 'requests') {
+    const incoming = rows('incoming');
+    const outgoing = rows('outgoing').map(({ seen_at, ...r }) => r);
+    return json(res, 200, { incoming, outgoing, incoming_count: incoming.length, outgoing_count: outgoing.length });
+  }
+  const suggestions = rows('suggestions');
+  return json(res, 200, { suggestions, count: suggestions.length });
+}
+function connAsk(res, body) {
+  const g = graph();
+  if (g.inactive) return connInactive(res);
+  if (typeof body.handle !== 'string' || body.handle.length < 1 || body.handle.length > STUB_CONN_HANDLE_MAX) return refuse(res, 400, 'validation_failed', 'handle must be 1-39 characters');
+  if (body.note !== undefined && (typeof body.note !== 'string' || body.note.length > STUB_CONN_NOTE_MAX)) return refuse(res, 400, 'validation_failed', 'note must be at most 280 characters');
+  const h = body.handle.toLowerCase();
+  if (h === String(account().handle).toLowerCase()) return refuse(res, 400, 'cannot_connect_to_self', 'that is your own account');
+  const same = (r) => String(r.handle).toLowerCase() === h;
+  if (['connections', 'incoming', 'outgoing'].some((k) => (g[k] || []).some(same))) return refuse(res, 409, 'connection_already_open', 'there is already a request or a connection between you');
+  const who = (g.suggestions || []).find(same) || (g.directory || []).find(same);
+  if (!who) return refuse(res, 404, 'connection_target_not_found', 'connection_target_not_found');
+  g.outgoing = (g.outgoing || []).concat([{ id: String(STUB_CONN_NEXT_ID++), note: body.note || null, created_at: new Date().toISOString(), handle: who.handle, display_name: who.display_name || null, avatar_url: who.avatar_url || null }]);
+  g.suggestions = (g.suggestions || []).filter((r) => !same(r));
+  return json(res, 201, { status: 'pending' });
+}
+function connAnswer(res, id, verb) {
+  const g = graph();
+  if (g.inactive) return connInactive(res);
+  const r = /^\d{1,19}$/.test(id) && (g.incoming || []).find((x) => x.id === id);
+  if (!r) return refuse(res, 404, 'connection_request_not_found', 'connection_request_not_found');
+  g.incoming = g.incoming.filter((x) => x !== r);
+  if (verb === 'decline') { res.writeHead(204, { 'cache-control': 'no-store' }); return res.end(); }
+  g.connections = [{ id: r.id, connected_at: new Date().toISOString(), handle: r.handle, display_name: r.display_name, avatar_url: r.avatar_url }].concat(g.connections || []);
+  return json(res, 200, { status: 'accepted' });
+}
+function connRemove(res, id) {
+  const g = graph();
+  if (g.inactive) return connInactive(res);
+  for (const [k, outcome] of [['connections', 'removed'], ['outgoing', 'cancelled']]) {
+    const r = /^\d{1,19}$/.test(id) && (g[k] || []).find((x) => x.id === id);
+    if (r) { g[k] = g[k].filter((x) => x !== r); return json(res, 200, { outcome }); }
+  }
+  return refuse(res, 404, 'connection_not_found', 'connection_not_found');
+}
+
 const server = http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -624,7 +710,16 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/guilds' && req.method === 'GET') return AUTH ? myGuilds(res) : json(res, 401, UNAUTH);
     if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
+    if (rest === '/connections' && req.method === 'GET') return AUTH ? connRead(res, 'list', origin) : json(res, 401, UNAUTH);
+    if (rest === '/connections/requests' && req.method === 'GET') return AUTH ? connRead(res, 'requests', origin) : json(res, 401, UNAUTH);
+    if (rest === '/connections/suggestions' && req.method === 'GET') return AUTH ? connRead(res, 'suggestions', origin) : json(res, 401, UNAUTH);
+    if (rest === '/connections' && req.method === 'POST') return AUTH ? readBody(req, (body) => connAsk(res, body)) : json(res, 401, UNAUTH);
+    const connAct = rest.match(/^\/connections\/([^/]+)\/(accept|decline)$/);
+    if (connAct && req.method === 'POST') return AUTH ? connAnswer(res, connAct[1], connAct[2]) : json(res, 401, UNAUTH);
+    const connDel = rest.match(/^\/connections\/([^/]+)$/);
+    if (connDel && req.method === 'DELETE') return AUTH ? connRemove(res, connDel[1]) : json(res, 401, UNAUTH);
     const answer = rest.match(/^\/guild-requests\/([^/]+)\/(accept|decline)$/);
     if (answer && req.method === 'POST') return AUTH ? readBody(req, (body) => guildRequestAnswer(res, answer[1], answer[2], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.112",
+  "version": "1.21.114",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.112",
+      "version": "1.21.114",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.112",
+  "version": "1.21.114",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9530,5 +9530,133 @@
       "id": "1004669",
       "text": "The security record for the main branch now says what is actually true. It used to say anyone with access could push straight to the main code line. That stopped being true in August: now every change from a regular collaborat"
     }
+  ],
+  "1.21.113": [
+    {
+      "id": "1004679",
+      "text": "When a project turns automatic pickup on, the background runner now picks up the oldest page an artist submitted and applies it, before its other work, then leaves it waiting for the artist. It stops at the monthly limit, leav"
+    }
+  ],
+  "1.21.114": [
+    {
+      "id": "1004722",
+      "text": "New core releases can be cut again. Since the living-city prototype merged, every merge to main failed its release check, so no new core version went out and cloudbongos.com stayed on an old build. The cause was one security t"
+    },
+    {
+      "id": "1004728",
+      "text": "Shipping work from a project that keeps its Bongos core in a downloaded package no longer gets stuck at the final merge step."
+    },
+    {
+      "id": "1004702",
+      "text": "Decisions now open as light glass panels right where they belong, built to the mocks you approved. The deck no longer hides the street: each question sits beside the building that asks, with a thin line to its pin, the rest of"
+    },
+    {
+      "id": "1002846",
+      "text": "The ship-news channel is back on: it now gets one plain headline for each new feature or bug fix, while the builders' ship-feed keeps logging every ship."
+    },
+    {
+      "id": "1004260",
+      "text": "When you make your account private or hide your numbers, your account page now tells you that your guilds still count your numbers in their rounded totals, and links to each guild's page where you can switch that off."
+    },
+    {
+      "id": "1004673",
+      "text": "When a project's owner reviews people asking to join, a confirmed applicant's platform name now shows even if the platform is down, and the Discord approval prompt is re-posted with the real applicant's words when they take ov"
+    },
+    {
+      "id": "1003649",
+      "text": "The landing's dark mode now loads its chrome artwork about 200 KB lighter (447 KB down to 247 KB on first paint) with no visible change, so the page appears faster on slow connections."
+    },
+    {
+      "id": "1003639",
+      "text": "The onboarding diagrams now match the builders' hall in dark mode instead of sitting there as a bright white box, and they still look the same in light mode."
+    },
+    {
+      "id": "1002536",
+      "text": "Builders get a new #ai-news Discord channel for AI-tooling news from a short, curated list of feeds, at no running cost to us. An Archon switches it on by following the new setup guide."
+    },
+    {
+      "id": "1003645",
+      "text": "A check in the project page's test kit now really proves that \"Let the platform choose again\" resets a project's planet, instead of passing either way."
+    },
+    {
+      "id": "1004279",
+      "text": "On a project's hall, your profile's Connections tab now shows only the people you're connected with who also build on that project. Your requests and everyone else are one click away on your Connections page on the hub."
+    },
+    {
+      "id": "1004278",
+      "text": "You can now manage your connections on cloudbongos.com: a new Connections page (in your profile menu) shows who wants to connect, the builders you know across every project, and builders you may know, and lets you ask anyone b"
+    },
+    {
+      "id": "1004590",
+      "text": "The Projects menu now says \"Your projects: the ones you own\". The projects you help build moved to your Account page, so the old \"own or build on\" was only half true."
+    },
+    {
+      "id": "1004720",
+      "text": "The guide to your project's government now tells the whole story in plain words. It opens with the idea behind it: government is how a project steers its AI. A one-minute overview names the five parts: laws (the standing order"
+    },
+    {
+      "id": "1004719",
+      "text": "The government walk now proves the new government end to end: 169 checks, all passing, up from 123. It goes through the real routes for laws (passed by a vote, handed to every AI session, a locked setting refused and read back"
+    },
+    {
+      "id": "1004718",
+      "text": "The street and the city got their polish pass. On a wide screen the street now sits right on its six readings with no empty black sky above the skyline. Inside a building, the floor you pick is drawn in ink, not salmon, so sal"
+    },
+    {
+      "id": "1004717",
+      "text": "The city and the street now run on your project's real government only. The sample data the prototype leaned on is deleted: no invented Leads, laws, pots, building work or reworded questions, and no \"prototype\" tags or keys an"
+    },
+    {
+      "id": "1004716",
+      "text": "The government numbers now come from one place on the server. \"To do\", \"wait on others\", \"to decide\", \"agents working\" and \"moving\" are counted once by a new server read, and the city, the street header, the decision deck and"
+    },
+    {
+      "id": "1004715",
+      "text": "Strictness presets are real. A project can now pick how strict its AI agents run: Open workshop (one law: land only, going live waits for a person), Guild (the standard set: also \"stuck? note it and move on\" and agents stay on"
+    },
+    {
+      "id": "1004714",
+      "text": "When an AI agent needs a person to decide something, it now has to ask like a person: one short question, two or three answers to tap, its pick and why, who it waits on, and what happens if nobody answers. The server refuses a"
+    },
+    {
+      "id": "1004712",
+      "text": "The treasury is real. Whoever runs the Treasury (its Lead, or you while it has none) can give a goal a monthly pot. Each pot fills from the project's real AI spend on that goal's work this month. The reserve is last month's sp"
+    },
+    {
+      "id": "1004711",
+      "text": "Whoever holds a building (its Lead, or the owner when it has none) can now really grow it: a committee room, a new floor, an annex, or a district. If the form of government allows it, it goes up at once and the city shows scaf"
+    },
+    {
+      "id": "1004713",
+      "text": "Governing is now a seat you hold, not a craft you pick. The server works out which government seats each builder holds: the owner seat, a building Lead, a seat on a building's own sitting, or a board seat. It sends that list w"
+    },
+    {
+      "id": "1004705",
+      "text": "Every question an agent puts to a person now waits on a real seat. The server decides who each open matter is for: the building's Lead if it has one, the owner when it has none, the voters for a board vote, or whoever the agen"
+    },
+    {
+      "id": "1004710",
+      "text": "Whether a building can be built out without a vote now comes from your form of government, not from anything a Lead's charter says. Under a Monarchy whoever holds a building builds a room, floor or annex at once; under a Timoc"
+    },
+    {
+      "id": "1004709",
+      "text": "Each of the nine buildings in your project's city can now have a real Lead: one person in charge, with a one-line charter saying what they answer for. A Lead is appointed, replaced or removed only by a vote (a People matter)."
+    },
+    {
+      "id": "1004704",
+      "text": "AI agents now have to ask you things the way a person would. When an agent files something that is stuck on you, it must send a short card: one question of twelve words or fewer, two or three answers to tap, the answer it reco"
+    },
+    {
+      "id": "1004707",
+      "text": "Every AI session on your project now reads the project's laws first, before anyone's own settings. The server writes the words, so nobody's local files can change or drop them, and passing or repealing a law changes what the n"
+    },
+    {
+      "id": "1004706",
+      "text": "Your project can now have laws: short one-line rules every AI agent follows, like \"Ask like a human\". A law can also lock a personal setting it overrides. Laws change only the way the constitution does: someone proposes one (o"
+    },
+    {
+      "id": "1004701",
+      "text": "The living city is now the hall's base: the city, the street with depth, the decision deck, the government inside each building, and My agents. On a real project it shows only what the real data supports: no invented Leads, la"
+    }
   ]
 }

package/scripts/discord/README.md

@@ -45,8 +45,11 @@ node scripts/discord/post.js --channel ship_feed "shipped #607"        # -> #shi
 echo "hello team" | node scripts/discord/post.js
 ```
 
-`scripts/gds/ship.js` calls this automatically with the task `--summary` once a
-ship is live on the droplet. The call is best-effort: a Discord failure logs a
-warning and never blocks the deploy. The broadcast runs on the operator's
-machine during `/builder-ship`, so the secret only needs to exist locally — the
-droplet never needs the webhook URL.
+Ship announcements do **not** come through this CLI any more (task 1749): the
+server posts them once the deploy lands, from
+`modules/discord/ship-broadcast.js` — every ship to `#ship-feed`, and a plain
+headline to `#ship-news` only for a feature or a bug fix (task 1002846). This
+CLI carries the project's other news, which defaults to `#ship-news` (a builder
+graduating, a rank change, an outage heads-up); builder housekeeping passes
+`--channel ship_feed`. Every call is best-effort: a Discord failure logs a
+warning and never blocks anything.

package/scripts/discord/post.js

@@ -9,7 +9,18 @@
 //
 // Default channel: ship_news — the plain-language, business-facing feed that
 // replaced the Google Chat broadcast. Exits non-zero on failure so callers can
-// treat the post as best-effort (ship.js does).
+// treat the post as best-effort.
+//
+// The default stays ship_news on purpose (task 1002846). SHIP announcements
+// never pass through here: the server posts them from
+// modules/discord/ship-broadcast.js, whose kind filter decides which ships are
+// news. What does pass through here is the project's own news in plain words,
+// which is what #ship-news promises: a builder graduating
+// (modules/onboarding/onboarding-state.js), a rank change
+// (src/bongos/routes/builders.js), an outage heads-up
+// (modules/provisioning/pollers/liveness-notify.js) and the style-guide audit
+// (scripts/cron/style_guide_audit.sh). Builder housekeeping names its channel:
+// scripts/gds/pulse.js's reclaim nudge passes --channel ship_feed.
 
 const fs = require('node:fs');
 const { postWebhook } = require('./lib');

package/scripts/gds/artifact-audit.js

@@ -55,6 +55,7 @@
 const { execFileSync } = require('node:child_process');
 const { apiCall, arg, hasFlag } = require('./cli-lib');
 const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
+const { postWithAsk } = require('./ask.js');
 
 // The statuses where a claimed artifact is supposed to already exist. `shipped` is the one the
 // reconciler never revisits, and the reason this file exists.
@@ -172,7 +173,7 @@ module.exports = {
   auditArtifacts, declaresArtifact, taskIdsIn,
   AUDITED_STATUSES, ASSURANCE_GATE_DATE, TASK_REF,
   messageEvidence, contentEvidence, fetchAuditedTasks,
-  blockerSourceRef, blockerBody, fileBlocker,
+  blockerSourceRef, blockerBody, blockerAsk, fileBlocker,
 };
 
 // ---- the human surface ------------------------------------------------------------------
@@ -206,14 +207,30 @@ function blockerBody(stranded) {
   return lines.join('\n');
 }
 
+// The card a person answers (task 1004704): the finding as an ask, short enough
+// to decide at a glance; the body above carries the list.
+function blockerAsk(stranded) {
+  const n = stranded.length;
+  return {
+    question: `Check by hand the ${n} shipped task${n === 1 ? '' : 's'} nothing on main names?`,
+    options: [
+      { key: 'check', label: 'Check each', result: 'Someone reads each by hand before anything is reopened.', act: 'go ahead' },
+      { key: 'accept', label: 'Accept them', result: 'They stay shipped and credited as they are.', act: 'not now' },
+    ],
+    recommend: { key: 'check', why: 'A credited task with no code may be paid work that does not exist.' },
+    waits_on: 'lead:review',
+    if_nobody_answers: 'They stay shipped and credited, unchecked.',
+  };
+}
+
 async function fileBlocker(stranded, { call = apiCall } = {}) {
   if (!stranded.length) return { filed: false, reason: 'nothing to report' };
-  const r = await call('POST', '/api/bongos/blockers', {
+  const r = await postWithAsk((body) => call('POST', '/api/bongos/blockers', body), {
     title: `${stranded.length} shipped task(s) claim an artifact nothing on main names`,
     body_md: blockerBody(stranded),
     source: 'artifact-audit',
     source_ref: blockerSourceRef(stranded),
-  });
+  }, blockerAsk(stranded));
   if (!r || !r.ok) return { filed: false, reason: `POST /blockers → ${r && r.status}` };
   if (r.data && r.data.skipped) return { filed: false, reason: 'already filed for this exact finding set' };
   return { filed: true, id: r.data && r.data.blocker && r.data.blocker.id };

package/scripts/gds/ask.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/ask.js — the rewrite helper an agent runs BEFORE it asks a person
+// anything (task 1004704, goal 1000111: "agents must ask like humans").
+//
+// WHY. The owner's ruling: an AI agent asks a person the way a person would —
+// short, decidable, no slop. The shape is the ask (modules/government/asks.js,
+// task 1004703): one question of at most twelve words, two or three tap answers
+// each with a one-line result, a pick and why, the seat it waits on, what
+// happens if nobody answers; the long text rides along as `detail`. The server
+// refuses anything else, and a blocker an AI session files by hand without one
+// is refused too (`ask_required`). This helper is the loop that turns prose into
+// a card: write the card, check it, read every fix the server names, rewrite,
+// check again — and only then file it, or print it.
+//
+//   node scripts/gds/ask.js template            a blank card to fill in
+//   node scripts/gds/ask.js check <file|->      the server's verdict; on a pass,
+//                                               the card as a person reads it
+//
+// `check` asks the server (POST /government/asks/check, the dry run: nothing is
+// stored). With no session, or a server that cannot answer, it checks with the
+// same rules locally and says so. The file holds the ask bare or as { ask }, so
+// the body you will POST to /blockers can be checked as it is.
+//
+// The printed card is also what an agent puts in CHAT for an ask that is not a
+// stored matter: the "please confirm" list at the end of a run, a review
+// request, a help request. Same shape everywhere a person reads it.
+//
+// For scripts that file templated blockers: `checkedAsk` and `postWithAsk`
+// below. A templated card is checked here before it is sent, and a filing whose
+// card is refused is re-sent without it — a script's blocker always files.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const asks = require(path.join(__dirname, '..', '..', 'modules', 'government', 'asks.js'));
+
+const TEMPLATE = Object.freeze({
+  question: 'One question, twelve words at most?',
+  options: [
+    { key: 'yes', label: 'Do it', result: 'One line: what happens if they pick this.' },
+    { key: 'no', label: 'Leave it', result: 'One line: what happens if they pick this.' },
+  ],
+  recommend: { key: 'yes', why: 'One line: why you would pick it.' },
+  waits_on: 'owner',
+  if_nobody_answers: 'One line: what happens if nobody answers.',
+  detail: 'Optional. The long text rides along here; it is never the ask.',
+});
+
+// The ask in a body: bare, or as { ask } (the shape POST /blockers takes).
+function askOf(body) {
+  return body && typeof body === 'object' && !Array.isArray(body) && body.ask !== undefined ? body.ask : body;
+}
+
+// A templated card, checked with the server's own rules. → the stored form, or
+// null when it breaks a rule (the caller files without it rather than not at all).
+function checkedAsk(ask) {
+  const r = asks.checkAsk(ask);
+  return r.ok ? r.ask : null;
+}
+
+// File a blocker with its card. `post(body)` → { ok, status, data } (the shape
+// cli-lib's apiCall and the generated client both answer). A card that breaks a
+// rule is never sent; a server that refuses the card or cannot check it gets the
+// same blocker again without it, so the filing never depends on the card.
+const CARD_REFUSALS = new Set(['ask_refused', 'asks_unavailable', 'validation_failed']);
+async function postWithAsk(post, body, ask) {
+  const card = ask ? checkedAsk(ask) : null;
+  if (!card) return post(body);
+  const r = await post({ ...body, ask: card });
+  const code = r && r.data && r.data.error && r.data.error.code;
+  if (r && !r.ok && (r.status === 400 || r.status === 503) && CARD_REFUSALS.has(code)) return post(body);
+  return r;
+}
+
+// The verdict as plain lines. ok → the card; refused → the refusal and each fix.
+function verdictLines({ ok, ask, message, errors, where }) {
+  const out = [];
+  if (ok) {
+    out.push(`✓ This ask has the shape${where === 'local' ? ' (checked here; the server could not be asked)' : ''}. As a person reads it:`);
+    out.push('');
+    out.push(asks.cardText(ask));
+    return out;
+  }
+  out.push(`✗ ${message || asks.refusalLine(errors)}`);
+  if (where === 'local') out.push('  (checked here; the server could not be asked)');
+  const list = Array.isArray(errors) ? errors : [];
+  if (list.length) {
+    out.push('');
+    out.push('Fix each, then check again:');
+    for (const e of list) out.push(`  - ${e.field}: ${e.message}`);
+  }
+  return out;
+}
+
+function readJson(file) {
+  const raw = file === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(file, 'utf8');
+  return JSON.parse(raw.replace(/^/, ''));
+}
+
+// The server's verdict, or null when it could not give one (no session, offline,
+// no government module, not allowed) — the caller then checks locally.
+async function serverVerdict(ask, { client } = {}) {
+  let api = client;
+  try {
+    if (!api) {
+      const lib = require('./cli-lib');
+      if (!lib.readSessionToken()) return null;
+      api = await lib.cliClient({ allowUnauthenticated: true });
+    }
+    const r = await api.request('POST', '/government/asks/check', { body: { ask } });
+    if (r && r.ok && r.data && r.data.ok) return { ok: true, ask: r.data.ask, where: 'server' };
+    const err = r && r.data && r.data.error;
+    if (r && r.status === 400 && err && err.code === 'ask_refused') {
+      return { ok: false, message: err.message, errors: (err.details && err.details.errors) || [], where: 'server' };
+    }
+    return null;
+  } catch (_) {
+    return null;
+  }
+}
+
+async function check(file, deps = {}) {
+  let body;
+  try { body = readJson(file); } catch (e) {
+    return { code: 2, lines: [`ask: could not read the card as JSON (${e.message}). Start from: node scripts/gds/ask.js template`] };
+  }
+  const ask = askOf(body);
+  let v = deps.local ? null : await serverVerdict(ask, deps);
+  if (!v) {
+    const r = asks.checkAsk(ask);
+    v = { ok: r.ok, ask: r.ask, errors: r.errors, where: 'local' };
+  }
+  return { code: v.ok ? 0 : 1, lines: verdictLines(v) };
+}
+
+const USAGE = [
+  'usage:',
+  '  node scripts/gds/ask.js template          print a blank card to fill in',
+  '  node scripts/gds/ask.js check <file|->    check a card; on a pass, print it as a person reads it',
+  '      --local                               check with the rules here, without the server',
+].join('\n');
+
+async function main(argv = process.argv.slice(2)) {
+  const cmd = argv[0];
+  if (cmd === 'template') {
+    console.log(JSON.stringify(TEMPLATE, null, 2));
+    return 0;
+  }
+  if (cmd === 'check' && argv[1]) {
+    const r = await check(argv[1], { local: argv.includes('--local') });
+    console.log(r.lines.join('\n'));
+    return r.code;
+  }
+  console.error(USAGE);
+  return 2;
+}
+
+if (require.main === module) {
+  main().then((code) => { process.exitCode = code; }, (e) => { console.error(`ask: ${e && e.message}`); process.exitCode = 1; });
+}
+
+module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, main };

package/scripts/gds/autobongos-run.js

@@ -45,6 +45,7 @@ const {
 const { verifyShip, failureReason, recheckLands, pendingLandIds } = require('./autobongos-verify.js');
 const gradeCap = require('./autobongos-grade-cap.js');
 const fence = require('../../modules/autonomy/fence.js');
+const tweakLane = require('./autobongos-tweak-lane.js');
 // The ADR 0043 protected-path registry, reused rather than re-derived. scripts/
 // sits outside the kernel boundary, so this direct core require is allowed here
 // where it would not be inside modules/ — which is exactly why fence.js takes the
@@ -346,13 +347,13 @@ async function gradeCapReader({ api, taskId, ledger }) {
 
 // spawnWorker — one headless session, bounded by WALL CLOCK, in the task's own
 // working tree.
-async function spawnWorker({ task, model, timeoutMs, cwd, gradeLedger = null, capCheck = null, deps = {} }) {
+async function spawnWorker({ task, model, timeoutMs, cwd, gradeLedger = null, capCheck = null, prompt: givenPrompt = null, deps = {} }) {
   const spawnFn = deps.spawn || spawn;
   const sessionId = deps.sessionId || crypto.randomUUID();   // pinned, so the session can be resumed
   const { bin, shell: workerShell } = deps.resolveBin ? deps.resolveBin() : resolveWorkerBin();
   const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
   const args = buildWorkerArgs({ sessionId, model, isRoot });
-  const prompt = buildWorkerPrompt({ task });
+  const prompt = givenPrompt || buildWorkerPrompt({ task });   // the tweak lane names its own (task 1004679)
 
   return new Promise((resolve) => {
     let child;
@@ -547,9 +548,13 @@ async function iteration(opts, deps = {}) {
   // always injected deps.run. Caught by the grader on task 1003908; the test that
   // now drives iteration() with no deps is the actual fix — this rename is half.
   const gate = fence.decideRun({ fence: raw, requestedGoals: opts.goals, graderBypassed });
-  if (!gate.go) {
-    return log({ event: 'fenced', code: gate.code, reason: gate.reason, refused_goals: gate.refusedGoals || [] });
-  }
+  // ADR 0371 D3 (task 1004679): the tweak lane's own setting replaces the GOAL
+  // ALLOWLIST for that lane only, so a fence that refused on goals alone still lets
+  // the lane run below; the kill switch and the grader stop refuse it here.
+  const fencedRow = () => log({ event: 'fenced', code: gate.code, reason: gate.reason, refused_goals: gate.refusedGoals || [] });
+  const goalsOnly = !gate.go && tweakLane.GOAL_ONLY_CODES.has(gate.code)
+    && await (deps.laneSwitchOn || tweakLane.laneSwitchOn)(deps.api);
+  if (!gate.go && !goalsOnly) return fencedRow();
 
   // 1. The gauge. Never start a task we cannot pay for out of the window.
   const g = readGauge();
@@ -588,6 +593,16 @@ async function iteration(opts, deps = {}) {
   }
   for (const [id, until] of state.setAside) if (until <= now) state.setAside.delete(id);
 
+  // 1d. THE TWEAK LANE (task 1004679, ADR 0371 D1): before ordinary work, the
+  // oldest submitted page round the lane may take. Null means it took none.
+  const laneRow = await (deps.tweakLaneStep || tweakLane.tweakLaneStep)({ opts, state }, {
+    api: deps.api || await (require('./cli-lib').cliClient)(), log, matchProtected, runCmd, spawnWork,
+    worktreeName: deps.worktreeName || worktreeName, spawnDeps: deps, gradeCapReader,
+    gradeLedgerPath: deps.gradeLedgerPath || gradeLedgerPath, ...(deps.laneDeps || {}),
+  });
+  if (laneRow) return laneRow;
+  if (goalsOnly) return fencedRow();
+
   // 2–4, up to MAX_CLAIM_ATTEMPTS times: pick, fence, tree, claim. A task refused
   // on its own is set aside and the NEXT one is tried in the same pass.
   let task = null; let picked = null; let wtName = null; let wtPath = null;