@bongos/core 1.21.112 → 1.21.114

package/src/bongos/routes/me.js

@@ -122,7 +122,9 @@ const discordIsLinked = (builderId) =>
 // `idea.triage` (task 1004231): the sky's panel draws "nod — make it claimable"
 // on a thought awaiting a nod only for a builder who may triage ideas; the nod
 // itself runs the existing POST /tasks/:id/promote, which stays the wall.
-const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage']);
+// `board.item.open` (task 1004714): My agents offers 'Make it a law' — a laws vote,
+// POST /government/board/laws — only to a builder who may open a board item.
+const NAV_PERMISSION_ATOMS = Object.freeze(['board.vote.cast', 'core.pin.move', 'idea.triage', 'board.item.open']);
 
 // navPermissionsFor(builderId) → { '<atom>': boolean } over NAV_PERMISSION_ATOMS,
 // or null when authority could not be established (government off, port missing,
@@ -187,7 +189,7 @@ module.exports = function buildMeRouter() {
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
-      navPermissions, foundingMode,
+      navPermissions, foundingMode, sessionLaws, govPositions,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -318,7 +320,44 @@ module.exports = function buildMeRouter() {
           return await onboarding.foundingModeFor();
         } catch (_) { return null; }
       })(),
+      // task 1004707: the project's LAWS — what every AI session on the project
+      // reads, via the `government` port (core imports no module, ADR 0093).
+      // Read per request, uncached, so a law passed a moment ago is in the next
+      // session. null when the module is off or the read failed: the session then
+      // gets no laws block, and the settings slices resolve without locks.
+      (async () => {
+        try {
+          const government = seams.resolveOptional('government');
+          if (!government || typeof government.lawsForSession !== 'function') return null;
+          return await government.lawsForSession();
+        } catch (err) {
+          log.error({ err: err && err.message }, 'GET /me laws');
+          return null;
+        }
+      })(),
+      // task 1004713: the government POSITIONS this builder holds (owner, Lead,
+      // a building's sitting, the board), via the `government` port. Read per
+      // request, uncached. null when the module is off or a read failed.
+      (async () => {
+        try {
+          const government = seams.resolveOptional('government');
+          if (!government || typeof government.positionsFor !== 'function') return null;
+          return await government.positionsFor(req.builder.id);
+        } catch (err) {
+          log.error({ err: err && err.message }, 'GET /me positions');
+          return null;
+        }
+      })(),
     ]);
+    // task 1004707: a law's LOCKS bite on the three settings slices below
+    // (interaction, wandering, model allocation): their effective values and
+    // injected contracts are resolved with every lock applied, server-side —
+    // the builder-settings port's describeWithLaws is the SSOT. A builder's own
+    // stored choice is still reported as theirs.
+    const instanceModels = (() => { try { return branding().models || {}; } catch { return {}; } })();
+    const lawed = settings && typeof settings.describeWithLaws === 'function'
+      ? settings.describeWithLaws(behaviorPrefs, (sessionLaws && sessionLaws.laws) || [], { rank: builder && builder.rank, instanceModels })
+      : null;
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
     // profile banner read it without a follow-up call; the ship + art-pipeline
@@ -401,6 +440,14 @@ module.exports = function buildMeRouter() {
       // floor. null when authority could not be established, which the shell
       // reads as nothing-visible. Cosmetic only — ADR 0016, the server enforces.
       permissions: navPermissions,
+      // task 1004713 (owner ruling 2026-10-09: governance is a HELD POSITION, not a
+      // picked craft): { held: [{ kind, seat, building, title }], title,
+      // has_position, from } — the seats this builder holds, resolved server-side
+      // (modules/government/positions.js). The hall shows the governing surfaces
+      // and names the Governing mode by `title` only for a holder. null when it
+      // could not be read, which the hall reads as unknown (today's nav), never
+      // "holds none". Cosmetic only — every governing page keeps its own gate.
+      positions: govPositions,
       unlocked,
       locked_with_progress: lockedWithProgress,
       streak: {
@@ -469,13 +516,27 @@ module.exports = function buildMeRouter() {
       // level (clamped by rank) + its behavior contract. The Conductor + the
       // /settings UI read this; the builder-settings port's describeWandering is
       // the SSOT (BV1.R80). null when the prefs module is off.
-      wandering: settings ? settings.describeWandering(behaviorPrefs, builder.rank) : null,
+      wandering: lawed ? lawed.wandering : (settings ? settings.describeWandering(behaviorPrefs, builder.rank) : null),
       // task 2010: the per-builder interaction profile (tone / technical level /
       // toolchain familiarity), resolved to an effective profile + an injectable
       // contract. The old §2 "The Prompter" owner-defaults, now per-builder. The
       // session-start injection + /settings UI read this; describeInteraction is
       // the SSOT (builder-settings port). null when the prefs module is off.
-      interaction: settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null,
+      interaction: lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null),
+      // task 1004707: the project's LAWS, read into every AI session. The
+      // Conductor hook relays `contract` verbatim beside the interaction profile
+      // (inject:false, and no block, when no law is in force). `laws` is the book
+      // as the session reads it, numbered; `locks` is what each law's lock did to
+      // THIS builder's settings ({ setting, law_id, enforced, from, to } — a lock on
+      // a setting no table holds yet is enforced:false, its law's words still
+      // apply). The server writes all of it; nothing local can change it. null when
+      // the laws could not be read.
+      laws: sessionLaws ? {
+        inject: !!sessionLaws.inject,
+        contract: sessionLaws.contract || '',
+        laws: Array.isArray(sessionLaws.laws) ? sessionLaws.laws : [],
+        locks: lawed ? lawed.locks : [],
+      } : null,
       // task 1003855: the builder's ACTIVE specialities, one per craft at most
       // (the speciality_adoptions partial unique index enforces that). Each entry
       // carries its own injectable contract; the Conductor picks the one matching
@@ -491,9 +552,9 @@ module.exports = function buildMeRouter() {
       // task 2011: the resolved subagent model allocation (main + subagent tiers),
       // builder override → instance default (branding.models) → code default. The
       // agent consults `effective` when spawning subagents; §2 links here.
-      model_allocation: settings && settings.describeModelAllocation
-        ? settings.describeModelAllocation(behaviorPrefs, (() => { try { return branding().models || {}; } catch { return {}; } })())
-        : null,
+      model_allocation: lawed ? lawed.model_allocation : (settings && settings.describeModelAllocation
+        ? settings.describeModelAllocation(behaviorPrefs, instanceModels)
+        : null),
       // task 1279: the per-builder "render widgets" knob (shares behavior_prefs).
       // { widgets_enabled } tells the start/claim/ship CLIs whether to emit the
       // rich HTML card or the cheap text fallback. No rank cap (cost/taste, not

package/src/bongos/serve-internal.js

@@ -1245,8 +1245,12 @@ function mountInternalSurfaces(app) {
   // task 1004473: `commands`, the Commands page — every skill and every bongos CLI
   // verb. Both reads behind it are requireBuilder, so it sits on this tier;
   // reading the list grants nothing (ADR 0310 §1).
+  // task 1004685 (the living-city prototype): `my-agents` — how the viewer's own
+  // Claude works for them. Every read behind it is the viewer's own and
+  // requireBuilder (GET /me and its /me/* prefs, /specialities), so sign-in is the
+  // whole gate; the governing reads it adds are gated by their own routes.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|settings|atlas|modules|goals|goal-map|roadmap|copy-desk|studio|tweak-editor|ideas|thinking|collab|task|idea|primer(?:\.md)?|diagrams|commands)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|settings|atlas|modules|goals|goal-map|roadmap|copy-desk|studio|tweak-editor|ideas|thinking|collab|task|idea|primer(?:\.md)?|diagrams|my-agents|commands)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.112'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.114'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -473,6 +473,12 @@ module.exports = {
     get SHIP_MODES() { return require('./bongos/project-settings').SHIP_MODES; },
     get parseShipMode() { return require('./bongos/project-settings').parseShipMode; },
     get resolveShipMode() { return require('./bongos/project-settings').resolveShipMode; },
+    // The spend cap (task 1004712, ADR 0379): off by default (no limit, the owner's
+    // ruling). The treasury reads it; PATCH /project-settings/spend-cap writes it.
+    get parseSpendCap() { return require('./bongos/project-settings').parseSpendCap; },
+    get resolveSpendCap() { return require('./bongos/project-settings').resolveSpendCap; },
+    get setSpendCap() { return require('./bongos/project-settings').setSpendCap; },
+    get describeSpendCap() { return require('./bongos/project-settings').describeSpendCap; },
     get describeShipMode() { return require('./bongos/project-settings').describeShipMode; },
     // Tweak auto-pickup (task 1004677, ADR 0371 D3/D5): the switch and the monthly cap.
     get AUTOPICKUP_MODES() { return require('./bongos/project-settings').AUTOPICKUP_MODES; },

package/src/platform-server.js

@@ -316,6 +316,16 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
+  // THE CONNECTIONS PAGE (task 1004278, ADR 0337 D5.4): the hub is the primary
+  // home for connections — your connections across every project, the requests
+  // in both directions, and "Builders you may know". Hub-only for the /account
+  // reason: every read and write it makes is a platform-identity route.
+  app.get('/connections', (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    const html = landingPage('connections.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // THE GUILD PAGE (task 1002301, R25; ADR 0336 D4/D6): /g/<slug>, the namespace
   // D6 reserved. Hub-only for the /account reason — every read it makes is a
   // platform-identity route. ONE shell for every slug: the page reads the public

package/tests/application_lifecycle.mjs

@@ -310,12 +310,12 @@ const pool = {
 
     // A vouched re-application taking over an unvouched pending row (ADR 0333 D4).
     // The SET list is matched exactly, like the resolve's below.
-    if ((m = /^UPDATE access_requests SET display_name = \$2, note = \$3, applicant_github_id = \$4, applicant_handle = \$5, vouched_at = \$6 WHERE (.+?)$/.exec(sql))) {
+    if ((m = /^UPDATE access_requests SET display_name = \$2, note = \$3, applicant_github_id = \$4, applicant_handle = \$5, vouched_at = \$6 WHERE (.+?) RETURNING id, github_login, status, created_at$/.exec(sql))) {
       const hit = rows.filter(predicateFor(m[1], params));
       for (const r of hit) {
         [r.display_name, r.note, r.applicant_github_id, r.applicant_handle, r.vouched_at] = params.slice(1, 6);
       }
-      return { rows: [], rowCount: hit.length };
+      return { rows: hit.map((r) => ({ id: r.id, github_login: r.github_login, status: r.status, created_at: r.created_at })), rowCount: hit.length };
     }
 
     // The resolve — one UPDATE, one WHERE, and that WHERE is the whole rule.
@@ -354,11 +354,13 @@ const poolPath = require.resolve('../src/bongos/pool.js');
 require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
 
 // Discord broadcast is fire-and-forget on the public write; stubbed so the suite
-// is hermetic (it is best-effort in production and never affects the queue).
+// is hermetic (it is best-effort in production and never affects the queue), and
+// recorded so a test can see which #member-approvals lines would have gone out.
+let broadcasts = [];
 const broadcastPath = require.resolve('../modules/onboarding/approval-broadcast.js');
 require.cache[broadcastPath] = {
   id: broadcastPath, filename: broadcastPath, loaded: true,
-  exports: { postMemberApprovalRequest: async () => ({ posted: false, skipped: 'test' }) },
+  exports: { postMemberApprovalRequest: async (request) => { broadcasts.push(request); return { posted: false, skipped: 'test' }; } },
 };
 
 // The hub's side of the vouch, for real: a generated Ed25519 keypair, the real
@@ -452,7 +454,7 @@ function call(method, pathname, body, extraHeaders = {}) {
     req.end(payload);
   });
 }
-const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; hubViews = {}; hubAsked = []; };
+const reset = (rank = 'archon') => { seed(); actingRank = rank; actingId = 42; notices = []; hubViews = {}; hubAsked = []; broadcasts = []; };
 
 // ===========================================================================
 // The interpreter is the instrument, so it is calibrated first
@@ -618,6 +620,19 @@ test('a vouched re-application takes over an UNVOUCHED pending row for its own l
   assert.equal(row(1).status, 'pending', 'and it decides nothing');
 });
 
+// The first #member-approvals line still quotes the words the row held before the
+// takeover, and a webhook cannot edit it; so the takeover posts the row's words now.
+test('a vouched takeover re-posts the #member-approvals line with the words the row holds now', async () => {
+  reset();
+  await applyAs('ada', { [VOUCH_HEADER]: vouchFor('ada', { githubId: 8001, handle: 'ada-h' }) });
+  assert.equal(broadcasts.length, 1, 'one line, for the takeover — the duplicate INSERT posts nothing');
+  const [line] = broadcasts;
+  assert.equal(line.id, 1, 'the same request, so a 👍 on either line resolves the one row');
+  assert.equal(line.refiled, true);
+  assert.equal(line.display_name, 'New');
+  assert.match(line.note, /via platform My Projects/);
+});
+
 test('a re-application never re-stamps an ALREADY vouched row, and an unvouched one changes nothing', async () => {
   reset();
   const bo = { ...row(2) };
@@ -626,6 +641,33 @@ test('a re-application never re-stamps an ALREADY vouched row, and an unvouched
   const ada = { ...row(1) };
   await applyAs('ada');
   assert.deepEqual(row(1), ada, 'an unvouched re-apply is the idempotent success it always was');
+  assert.deepEqual(broadcasts, [], 'and neither re-posts a line: nothing on the row changed');
+});
+
+// END TO END: a row written by the REAL vouch writer is the row the queue resolves
+// from the hub. The profile tests below seed their vouched rows; this one proves the
+// link between the two halves — the id the writer stores is the id the read asks for.
+test('list-pending: the real vouch writer’s row resolves its profile and guild from the hub', async () => {
+  reset();
+  const profile = { view: 'public', account: { handle: 'newcomer-h', bio: 'hi' }, cross_project: null };
+  hubViews['7001'] = { profile, guild: { slug: 'lantern-works', name: 'Lantern Works' } };
+  await applyAs('Newcomer', { [VOUCH_HEADER]: vouchFor('newcomer') });
+  const r = await call('GET', '/api/gds/access-requests');
+  const got = r.json.requests.find((x) => x.github_login === 'Newcomer');
+  assert.ok(hubAsked.includes('7001'), 'the hub was asked about the id the vouch carried');
+  assert.deepEqual(got.profile, profile);
+  assert.deepEqual(got.guild, { slug: 'lantern-works', name: 'Lantern Works' });
+});
+
+test('list-pending: a vouched TAKEOVER resolves the vouched applicant, not whoever filed first', async () => {
+  reset();
+  hubViews['8001'] = { profile: { view: 'sliver', sliver: { disciplines: ['engineer'] } }, guild: null };
+  await applyAs('ada', { [VOUCH_HEADER]: vouchFor('ada', { githubId: 8001, handle: 'ada-h' }) });
+  const r = await call('GET', '/api/gds/access-requests');
+  const ada = r.json.requests.find((x) => x.github_login === 'ada');
+  assert.equal(ada.vouched, true);
+  assert.deepEqual(ada.profile, hubViews['8001'].profile);
+  assert.ok(hubAsked.includes('8001'));
 });
 
 test('list-pending: the queue carries the handle the vouch brought, beside the vouch mark', async () => {

package/tests/autobongos_tweak_lane.mjs

@@ -0,0 +1,208 @@
+// tests/autobongos_tweak_lane.mjs — the Autobongos tweak lane (task 1004679 /
+// BV2.TW19c, ADR 0371 D1, D2, D4, D6, D7).
+//
+// The REAL picker (pickRound) and the REAL fence (modules/autonomy/fence.js +
+// the protected-path matcher) over a fake server, one fixture per rule: off, at
+// the cap, a protected page file, a round applied twice, a failed apply, a runner
+// below Metic. Then the REAL iteration(): a round is worked before ordinary work,
+// with a marked claim and the unattended prompt; with nothing for the lane, an
+// ordinary task is still picked; and a goal-only fence lets the lane run while the
+// kill switch and the grader stop do not.
+//
+// Run:  node --test tests/autobongos_tweak_lane.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const lane = require('../scripts/gds/autobongos-tweak-lane.js');
+const runner = require('../scripts/gds/autobongos-run.js');
+const { matchProtected } = require('../src/bongos/permission-path-check');
+
+const INV = { pages: [
+  { id: 'landing:index', files: ['modules/public-landing/public/index.html'], states_files: [] },
+  { id: 'landing:other', files: ['modules/public-landing/public/other.html'], states_files: [] },
+  { id: 'builders:core', files: ['CLAUDE.md'], states_files: [] },
+] };
+const ON = { mode: 'on', cap: 20, used_this_month: 3, remaining_this_month: 17 };
+const round = (id, over = {}) => ({ task: { id, title: `Tweak ${id}`, status: 'ready', source: 'page-tweak', goal_id: 1000095, description: 'Apply the round.', updated_at: 't1', ...over }, claims: [], grade: null });
+
+// A fake server: the setting, the page list, and each round's task + claims.
+function fakeApi({ settings = ON, rank = 'metic', pages, rounds = {} } = {}) {
+  return {
+    projectSettings: { getProjectSettingsTweakAutopickup: async () => (settings ? { ok: true, data: settings } : { ok: false }) },
+    me: { getMe: async () => ({ ok: true, data: { builder: { rank }, grader_bypass: false } }) },
+    copyDesk: { getCopyDeskPages: async () => ({ ok: true, data: { pages } }) },
+    tasks: { getTasksId: async ({ id }) => (rounds[id] ? { ok: true, data: { task: rounds[id].task, claims: rounds[id].claims, grade: rounds[id].grade } } : { ok: false }) },
+  };
+}
+const submitted = (id, taskId) => ({ id, open_round: { task_id: String(taskId), state: 'submitted' } });
+const pick = (api, state = {}) => lane.pickRound({ api, state, matchProtected, readInventory: () => INV });
+
+test('the oldest submitted round is picked, by task id, and only submitted ones', async () => {
+  const api = fakeApi({
+    pages: [submitted('landing:other', 902), submitted('landing:index', 901), { id: 'x:y', open_round: { task_id: '900', state: 'drafting' } }],
+    rounds: { 901: round(901), 902: round(902) },
+  });
+  const got = await pick(api);
+  assert.equal(got.round.task.id, 901);
+  assert.equal(got.round.pageId, 'landing:index');
+  assert.deepEqual(got.round.files, ['modules/public-landing/public/index.html'], 'the page\'s files are the touches');
+});
+
+test('OFF: the lane is silent and takes nothing', async () => {
+  const got = await pick(fakeApi({ settings: { ...ON, mode: 'off' }, pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }));
+  assert.equal(got.code, 'lane_off');
+  assert.equal(got.quiet, true);
+});
+
+test('AT THE CAP: refused, and it says the rounds wait for a person', async () => {
+  const got = await pick(fakeApi({ settings: { ...ON, used_this_month: 20, remaining_this_month: 0 }, pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }));
+  assert.equal(got.code, 'lane_at_cap');
+  assert.match(got.reason, /wait for a person/);
+});
+
+test('A PROTECTED PAGE FILE: the round is left for a person and the next one is taken', async () => {
+  const got = await pick(fakeApi({
+    pages: [submitted('builders:core', 900), submitted('landing:index', 901)],
+    rounds: { 900: round(900), 901: round(901) },
+  }));
+  assert.equal(got.round.task.id, 901);
+  const d = lane.decideRound({ task: round(900).task, claims: [], files: ['CLAUDE.md'], matchProtected });
+  assert.equal(d.code, 'protected_path', 'the fence\'s own refusal, over the page\'s files');
+});
+
+test('HOST ACCESS: the fence\'s host check runs on the round too', () => {
+  const t = { ...round(1).task, automation_tag: 'live-only' };
+  assert.equal(lane.decideRound({ task: t, claims: [], files: ['modules/public-landing/public/index.html'], matchProtected }).code, 'needs_host_access');
+});
+
+test('SENT BACK TWICE: after two applies by this runner the round waits for a person', async () => {
+  const runnerClaim = (n) => ({ worktree_name: `autobongos-901-${n}` });
+  const twice = round(901); twice.claims = [runnerClaim('aaaaaa'), runnerClaim('bbbbbb')];
+  const got = await pick(fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: twice } }));
+  assert.equal(got.none, true);
+  assert.deepEqual(got.skipped.map((s) => s.code), ['round_waits_for_person']);
+  // A person's claims, or one runner apply, do not count against it.
+  const once = round(901); once.claims = [runnerClaim('aaaaaa'), { worktree_name: null }, { worktree_name: 'fix-copy-12ab' }];
+  assert.equal((await pick(fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: once } }))).round.task.id, 901);
+});
+
+test('A FAILED APPLY: skipped until the round\'s updated_at moves', async () => {
+  const state = { tweakFailed: new Map([['901', 't1']]) };
+  const api = (updated) => fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901, { updated_at: updated }) } });
+  const same = await pick(api('t1'), state);
+  assert.deepEqual(same.skipped.map((s) => s.code), ['round_failed_unchanged']);
+  assert.equal((await pick(api('t2'), state)).round.task.id, 901, 'the artist edited or resubmitted it');
+});
+
+test('BELOW METIC: reported once, then quiet', async () => {
+  const state = {};
+  const api = fakeApi({ rank: 'thetes', pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } });
+  const first = await pick(api, state);
+  assert.equal(first.code, 'lane_rank_too_low');
+  assert.equal(first.quiet, false);
+  const second = await pick(api, state);
+  assert.equal(second.code, 'lane_rank_too_low');
+  assert.equal(second.quiet, true, 'the lane stops saying it');
+});
+
+test('the outcome is read from the ledger: a held pass is the success, a released round a halt', () => {
+  assert.equal(lane.tweakOutcome({ task: { status: 'completed' }, grade: { passed: true } }).shape, 'waiting_for_artist');
+  assert.equal(lane.tweakOutcome({ task: { status: 'ready' }, grade: null }).failed, true);
+  assert.equal(lane.tweakOutcome({ task: { status: 'completed' }, grade: { passed: false } }).ok, false);
+});
+
+// ---- the real iteration() ---------------------------------------------------
+
+const goodGauge = () => ({ decision: { go: true, unknown: false, sleepUntil: null, reason: 'headroom' } });
+const openFence = (goals = [{ goal_id: 1000119 }]) => ({ raw: { enabled: true, paused_reason: null, goals }, graderBypassed: false });
+const aTask = { id: 4242, title: 'Do the thing', kind: 'feature', description: 'd'.repeat(300), goal_id: 1000119, touches: [] };
+const opts = { goals: [1000119], maxTasks: 1, dryRun: false, model: 'm', timeoutMs: 1000 };
+
+function harness({ api, fenceRead = openFence(), afterStatus = 'completed', afterGrade = { passed: true } } = {}) {
+  const calls = []; const rows = []; let picked = 0;
+  const after = { ...round(901, { status: afterStatus, updated_at: 't9' }), grade: afterGrade };
+  const deps = {
+    gauge: goodGauge, readFence: async () => fenceRead, api, state: runner.newRunnerState(),
+    record: (r) => { rows.push(r); return r; },
+    worktreeName: (id) => `autobongos-${id}-abc123`,
+    pickTask: async () => { picked++; return { task: aTask, goalId: 1000119, skipped: [] }; },
+    run: async (bin, args, o = {}) => { calls.push({ script: String(args[0]).split(/[\\/]/).pop(), args: args.slice(1), cwd: o.cwd || null }); return { ok: true, code: 0, stdout: '', stderr: '' }; },
+    spawnWorker: async (a) => { calls.push({ script: 'WORKER', prompt: a.prompt }); return { envelope: { structured_output: { outcome: 'shipped' } }, exitCode: 0, sessionId: 's' }; },
+    laneDeps: { readInventory: () => INV, readRound: async (_api, id) => (String(id) === '901' ? after : null) },
+    verifyDeps: { task: { id: 4242, status: 'shipped', updated_at: new Date().toISOString() }, probeArtifact: async () => ({ checked: true, onMain: true }), fileBlocker: async () => ({ filed: true }) },
+  };
+  return { deps, calls, rows, pickedCount: () => picked };
+}
+
+test('iteration: a submitted round is worked BEFORE ordinary work — marked claim, unattended prompt', async () => {
+  const h = harness({ api: fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'worked');
+  assert.equal(row.lane, 'tweak');
+  assert.equal(row.outcome, 'waiting_for_artist');
+  assert.equal(h.pickedCount(), 0, 'ordinary work waits for the next pass');
+  const claim = h.calls.find((c) => c.script === 'claim.js');
+  assert.deepEqual(claim.args, ['901', '--auto-pickup']);
+  const worker = h.calls.find((c) => c.script === 'WORKER');
+  assert.match(worker.prompt, /\/tweak --page landing:index --unattended/);
+  assert.match(worker.prompt, /Never pass --skip-grade/);
+});
+
+test('iteration: a halted round is remembered as failed at its new updated_at, with no blocker', async () => {
+  const h = harness({ api: fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }), afterStatus: 'ready', afterGrade: null });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.outcome, 'tweak_halted');
+  assert.equal(h.deps.state.tweakFailed.get('901'), 't9');
+});
+
+test('iteration: with nothing for the lane, an ordinary task is still picked', async () => {
+  const h = harness({ api: fakeApi({ pages: [] }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(h.pickedCount(), 1);
+  assert.equal(row.task_id, 4242);
+  assert.equal(row.lane, undefined);
+});
+
+test('iteration: a fence refusing on GOALS alone still lets the lane run; the kill switch does not', async () => {
+  const api = fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } });
+  const goalsOnly = harness({ api, fenceRead: openFence([]) });
+  assert.equal((await runner.iteration(opts, goalsOnly.deps)).lane, 'tweak');
+
+  const empty = harness({ api: fakeApi({ pages: [] }), fenceRead: openFence([]) });
+  const r2 = await runner.iteration(opts, empty.deps);
+  assert.equal(r2.event, 'fenced', 'no round: the goal refusal is reported as before');
+  assert.equal(empty.pickedCount(), 0);
+
+  const killed = harness({ api, fenceRead: { raw: { enabled: false }, graderBypassed: false } });
+  const r3 = await runner.iteration(opts, killed.deps);
+  assert.equal(r3.code, 'kill_switch');
+  assert.deepEqual(killed.calls, []);
+
+  const offLane = harness({ api: fakeApi({ settings: { ...ON, mode: 'off' }, pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }), fenceRead: openFence([]) });
+  assert.equal((await runner.iteration(opts, offLane.deps)).event, 'fenced', 'lane off: exactly the old fenced row');
+});
+
+test('iteration: the grade cap holds on a tweak worker — two failed grades release the round to a person', async () => {
+  const h = harness({ api: fakeApi({ pages: [submitted('landing:index', 901)], rounds: { 901: round(901) } }), afterGrade: { passed: false } });
+  let capGiven = null;
+  h.deps.gradeLedgerPath = () => null;
+  h.deps.laneDeps.gradeCapReader = async () => async () => ({ graded: 2, fails: 2, outages: 0, exhausted: true });
+  const spawn = h.deps.spawnWorker;
+  h.deps.spawnWorker = async (a) => { capGiven = a.capCheck; return spawn(a); };
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(typeof capGiven, 'function', 'the worker is handed the cap check');
+  const halt = h.calls.find((c) => c.script === 'tweak-halt.js');
+  assert.deepEqual(halt && halt.args, ['901', '--code', 'grade_failed']);
+  assert.equal(row.grade_cap_reached, true);
+});
+
+test('a backlog of rounds the lane must skip costs at most ten reads a pass', async () => {
+  let reads = 0;
+  const pages = Array.from({ length: 25 }, (_, i) => submitted('builders:core', 1000 + i));
+  const api = fakeApi({ pages });
+  await lane.pickRound({ api, state: {}, matchProtected, readInventory: () => INV, readRound: async () => { reads++; return round(1); } });
+  assert.equal(reads, 10);
+});

package/tests/conductor_main_e2e.mjs

@@ -128,4 +128,25 @@ await test('outside any claimed worktree no craft is guessed', async () => {
   assert.ok(r.out.includes(INTERACTION), 'and the rest of the hook still runs');
 });
 
+// task 1004707: the project's LAWS, built by the SERVER's own helper (what the
+// government port hands GET /me), run through the real hook.
+const lawsLib = require('../modules/government/laws.js');
+const LAW_BOOK = lawsLib.forSession([
+  { id: 11, text: 'Ask like a human', effect_on_ai: 'One short card with tap answers.', locks: [{ setting: 'verbosity', value: 'concise' }], repealed_at: null },
+]);
+
+await test('a session on a project with laws is told the laws, first, in the server\'s own words', async () => {
+  const r = await runHook({ ...mePayload(), laws: { inject: LAW_BOOK.inject, contract: LAW_BOOK.contract, laws: LAW_BOOK.laws, locks: [] } });
+  assert.equal(r.code, 0);
+  assert.ok(r.out.includes('1. Ask like a human — One short card with tap answers.'), `the law reaches the session; stdout was: ${JSON.stringify(r.out.slice(0, 400))}`);
+  assert.ok(r.out.indexOf('Project laws') < r.out.indexOf(INTERACTION), 'ahead of the builder\'s own profile');
+});
+
+await test('a project with no laws sends no laws block', async () => {
+  const none = lawsLib.forSession([]);
+  const r = await runHook({ ...mePayload(), laws: { inject: none.inject, contract: none.contract, laws: [], locks: [] } });
+  assert.ok(!r.out.includes('Project laws'));
+  assert.ok(r.out.includes(INTERACTION), 'and the rest of the hook still runs');
+});
+
 summary();

package/tests/connections_api.mjs

@@ -309,6 +309,24 @@ test('list: my connections, the count IS the array length, and paging is real',
     "…and applying the PUBLIC predicate here would erase your own connections from your own list");
 });
 
+test('list: ?here=1 is the project cut — the same read, narrowed to this instance’s active builders', async () => {
+  expect(meActive(), result([]));
+  await call('GET', '/api/bongos/connections?here=1&limit=2&offset=4');
+  assert.ok(calls[1].text.includes(conn.HERE_SQL),
+    'the hall tab’s cut (ADR 0337 D5.4): connections who also build on this project, joined on github_id');
+  assert.match(conn.HERE_SQL, /b\.status = 'active'/, 'a deactivated seat is not building here');
+  assert.deepEqual(calls[1].params, [ME.github_id, 2, 4],
+    'a literal term with no new parameter — paging and the FANOUT_1 cap are the full list’s');
+  assert.match(calls[1].text, /\(pa\.profile_state = 'active' AND pa\.terms_accepted_at IS NOT NULL\)/,
+    'still own scope on the consent floor — the cut narrows, it never swaps the predicate');
+
+  for (const q of ['', '?here=0', '?here=true', '?here=']) {
+    expect(meActive(), result([]));
+    await call('GET', `/api/bongos/connections${q}`);
+    assert.doesNotMatch(calls[1].text, /\bbuilders\b/, `"${q}" is the full list, unchanged`);
+  }
+});
+
 test('list: the limit is clamped to FANOUT_1 however large a caller asks', async () => {
   expect(meActive(), result([]));
   await call('GET', '/api/bongos/connections?limit=999999');

package/tests/craft_mode_nav.mjs

@@ -128,8 +128,10 @@ const CRAFTS = ['building', 'artistry', 'ideating', 'governing'];
 
 test('THE ALWAYS-PRESENT LIST: one shared list, Builders first, then Collab and Profile, inside every mode', () => {
   const { craft } = boot();
-  assert.deepEqual([...craft.ALWAYS_TABS], ['roster', 'collab', 'profile'],
-    'Builders (NAV id roster) heads the list (owner, 2026-10-01); Collab and Profile join it (owner, 2026-10-03)');
+  // task 1004685 (the living-city prototype): My agents joins as a PROPOSAL for the
+  // owner — every craft has agents, and round-3 board 6 pairs it with the city.
+  assert.deepEqual([...craft.ALWAYS_TABS], ['roster', 'collab', 'profile', 'my-agents'],
+    'Builders (NAV id roster) heads the list (owner, 2026-10-01); Collab and Profile join it (owner, 2026-10-03); My agents (prototype, task 1004685)');
   for (const m of CRAFTS) {
     const tabs = craft.tabsFor(m);
     assert.ok(Array.isArray(tabs), `${m} has a named tab list`);
@@ -187,7 +189,7 @@ test('a mode never shows a tab the gate hid, and a later gate pass keeps the mod
   p.signIn('thetes');
   assert.ok(!p.showing().includes('watch'), 'a thetes in Governing does not get the metic-floored Watch tab');
   assert.ok(!p.headShowing('government'), 'nor its group head');
-  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'city', 'profile', 'collab', 'roster'], 'what a thetes board member in Governing sees');
+  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'city', 'profile', 'my-agents', 'collab', 'roster'], 'what a thetes board member in Governing sees');
   p.signIn('archon');
   assert.ok(p.showing().includes('watch'), 'promoted, the gate lets it through and the mode keeps it');
   assert.ok(p.headShowing('government'), 'and its group head comes back with it, which only a mode pass after the gate can know');