@bongos/core 1.21.176 → 1.21.178

package/docs/recipes/ops-gotchas.md

@@ -216,11 +216,13 @@ Inside the namespace the file lists as `---------- 1 root root 0`. The runner un
 
 ## Bongos build pipeline
 
-### Two deterministic routines run as in-process server timers, not external cron
+### The deterministic routines run as in-process server timers, not external cron
 
 - **What:** `peer-vote-tally` (weekly) runs inside the always-on Node process via the autonomy module's poller `modules/autonomy/pollers/routine-timers.js` (ADR 0078 amendment, task 1382; carved into `modules/autonomy/` at BV1.R83) — no `claude -p`, no external cron, no token. The loader's `startModulePollers` starts it from `src/platform-server.js` at boot (task 1002419 — before that fix the call site had been lost with the retired `server.js` and no module poller started at all); it reaches `tallyPeerVotes` through the doorway. It's a no-op anywhere the DB is unreachable (builder machines), so it only does work on the prod droplet.
 - **Disable / move it out-of-process:** set `ROUTINE_TIMERS_DISABLED=1` in `/etc/example/web-source.env` and restart. Also set it on any **second** always-on instance that shares the `example` DB so the tally can't double-fold (the `FOR UPDATE OF pv` row lock is the hard guard if you forget).
 - **Run it manually now:** `node scripts/bongos/run-routine.js peer-vote-tally` (the dispatcher front door still works). The cadence is boot-anchored ("~90s after boot, then weekly"), not a wall-clock Monday job — frequent deploys re-anchor it, which is harmless (the tally is idempotent).
+- **The daily checks** (task 1004878): `rank-roles-audit` and `dep-audit-nightly` run from the sibling poller `modules/autonomy/pollers/daily-checks.js`. Unlike peer-vote it is **not** boot-anchored — deploys restart the server many times a day — so it ticks hourly and runs a check only when that check's last `autonomy_runs` row is ~a day old. Findings go to the idea inbox, once per distinct set (the row stores a fingerprint; an identical result is recorded `unchanged`). See what ran without SSH: `GET /autonomy/runs?routine=dep-audit-nightly`. Same kill switch (`ROUTINE_TIMERS_DISABLED=1`). Which routines the server fires, and how often, is ONE table — `modules/autonomy/server-schedule.js` — read by both the pollers and the merge-gate check `scripts/bongos/routine-schedule.js`.
+- **`dep-audit-nightly` audits the INSTANCE root** (`resolveInstanceRoot()`, the service's working directory), so it needs `npm` on the service's PATH and a `package-lock.json` there. Without either it records a `no-go` row with the reason — never a clean pass.
 
 ### A ship was graded FAIL but the work is genuinely good (grader false-negative)
 

package/modules/autonomy/db.js

@@ -62,6 +62,14 @@ async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
   return rows.map((r) => ({ ...r, id: String(r.id) }));
 }
 
+// readRankRoster — every builder's id, login, rank and status, for the daily
+// rank-roles check (task 1004878). No WHERE on purpose: an INACTIVE builder on a
+// legacy rank is exactly the row a future CHECK-narrowing migration would fail on.
+async function readRankRoster() {
+  const { rows } = await pool.query('SELECT id, github_login, rank, status FROM builders ORDER BY id');
+  return rows;
+}
+
 // ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
 //
 // These back the one control surface the runner host cannot write to. Everything
@@ -350,6 +358,7 @@ module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
   readAutonomyRuns,
+  readRankRoster,
   recordRunnerHeartbeat,
   readRunnerHeartbeats,
   readFence,

package/modules/autonomy/module.json

@@ -1,7 +1,7 @@
 {
   "key": "autonomy",
   "title": "Autonomy & MAS (conductor · architect · gate · routine timers)",
-  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
+  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller, and since task 1004878 the daily rank-roles and dependency-audit checks). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "category": { "parent": "work" },
@@ -9,7 +9,7 @@
   "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["autonomy"],
-    "pollers": ["routine-timers"]
+    "pollers": ["routine-timers", "daily-checks"]
   },
   "provides": [],
   "consumes": []

package/modules/autonomy/pollers/daily-checks.js

@@ -0,0 +1,262 @@
+'use strict';
+
+// modules/autonomy/pollers/daily-checks.js — the deterministic daily checks, fired
+// by the always-on server itself (task 1004878).
+//
+// WHY IN-PROCESS. Every one of these routines declared a cadence and nothing fired
+// it: the repo's only scheduler was .github/workflows/, whose minutes are billable
+// and already oversubscribed, and the operator-side cron the SKILL.md files kept
+// asking for was never written. The routine-timers poller beside this one solved
+// the same problem for peer-vote-tally (ADR 0078 amendment) — an in-process timer
+// costs nothing and cannot be forgotten by an operator. This is that pattern for
+// the daily checks.
+//
+// THE CHECKS (the rows of ../server-schedule.js with poller 'daily-checks'):
+//   - rank-roles-audit  — every builder on one of the live ranks (task 1002873).
+//                         Reads the roster straight from this instance's DB, so it
+//                         needs no CLI session — the reason the script never ran
+//                         unattended.
+//   - dep-audit-nightly — `npm audit` of the DEPLOYED instance (its own root and
+//                         lockfile, not a repo checkout), high/critical only.
+//
+// DAILY BY THE CLOCK, NOT BY THE BOOT. The server restarts on every deploy, and a
+// boot-anchored timer would re-run (and re-file) on each one. So the timer only
+// ticks hourly and asks the ledger: a check runs when its last `autonomy_runs` row
+// is (nearly) a day old. The same rows are what GET /autonomy/runs shows, so
+// "did the daily check run, and what did it find" is answerable from a laptop.
+//
+// ONE IDEA PER DISTINCT FINDING SET. A finding is filed into the idea inbox once;
+// the run row stores a fingerprint of what was found, and the next day's identical
+// result is recorded as `unchanged` instead of filed again. A changed set (a new
+// vulnerability, a second bad rank) files again. A clean run clears it, so a
+// regression after a fix is a fresh idea.
+//
+// Mirrors routine-timers.js (but logs through api.logger, not console): kill switch ROUTINE_TIMERS_DISABLED, unref'd timers,
+// best-effort (a throw logs and waits for the next tick — never crashes the
+// server), pure w.r.t. injected deps so it unit-tests without a database, and a
+// quiet no-op anywhere the database is unreachable (builder laptops).
+
+const { execFile } = require('node:child_process');
+const crypto = require('node:crypto');
+const api = require('../../../src/module-api');
+const autonomyDb = require('../db');
+const rankRoles = require('../rank-roles');
+const depAudit = require('../../../scripts/security/dep-audit');
+const { SERVER_ROUTINES, periodMs } = require('../server-schedule');
+
+const log = api.logger('autonomy');
+
+const ROUTINES = SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine);
+
+const TICK_MS = Number(process.env.ROUTINE_DAILY_CHECKS_TICK_MS) || 60 * 60_000;
+// Later than peer-vote's 90s so the two first ticks never land together.
+const FIRST_MS = Number(process.env.ROUTINE_DAILY_CHECKS_FIRST_MS) || 3 * 60_000;
+const JITTER_MS = 60_000;
+// A check is due this long BEFORE a full period has passed. Hourly ticks land up to
+// an hour late; without the slack each day's run would slide an hour later than the
+// last. With it, runs stay between 23.5 and 24.5 hours apart.
+const DUE_SLACK_MS = 30 * 60_000;
+// npm audit is a network call to the registry; one stuck call must not hold the
+// next day's check hostage.
+const NPM_AUDIT_TIMEOUT_MS = 5 * 60_000;
+
+// ── the checks ─────────────────────────────────────────────────────────────────
+// Each returns { keys, idea } — `keys` identify the findings (empty = clean) and
+// feed the fingerprint; `idea` is what gets filed. A check that cannot run THROWS:
+// "could not check" must never be recorded as clean.
+
+async function checkRankRoles(deps) {
+  const rows = await deps.db.readRankRoster();
+  const offenders = rankRoles.findRanksWithoutRoles(rows, deps.liveRanks || api.LIVE_RANK_LADDER);
+  return {
+    keys: offenders.map((o) => `${o.id}:${o.rank}`),
+    idea: { ...rankRoles.ideaFor(offenders, { filedBy: "the server's daily rank-roles check" }), kind: 'bug' },
+  };
+}
+
+// The async spawn. execFile reports npm's own exit 1 (findings present) as an error
+// too, so only a missing binary or a timeout counts as "could not run".
+function npmAudit(cwd) {
+  return new Promise((resolve) => {
+    execFile('npm', depAudit.NPM_AUDIT_ARGS, { cwd, maxBuffer: 32 * 1024 * 1024, timeout: NPM_AUDIT_TIMEOUT_MS },
+      (err, stdout, stderr) => {
+        const failed = err && (err.code === 'ENOENT' || err.killed);
+        resolve({ stdout, stderr, error: failed ? (err.code === 'ENOENT' ? 'npm not found' : 'npm audit timed out') : null });
+      });
+  });
+}
+
+async function checkDepAudit(deps) {
+  const cwd = deps.cwd || api.resolveInstanceRoot();
+  const out = await (deps.npmAudit || npmAudit)(cwd);
+  if (out.error) throw new Error(out.error);
+  const res = depAudit.parseNpmAudit(out.stdout, out.stderr);
+  if (!res.ok) throw new Error(res.raw_error);
+  const f = res.findings;
+  return {
+    keys: f.map((x) => `${x.package}:${x.id || x.summary}`),
+    idea: {
+      kind: 'infra',
+      title: `[dep-audit] ${f.length} high/critical ${f.length === 1 ? 'vulnerability' : 'vulnerabilities'} in this instance's dependencies`,
+      bodyMd: [
+        `The server's daily \`npm audit\` of this instance (${cwd}) found ${f.length} high/critical advisory(ies):`,
+        '',
+        ...f.map((x) => `- **${x.package}** (${x.severity}) — ${x.summary}${x.url ? ` — ${x.url}` : ''}. Fix: ${x.fix}.`),
+        '',
+        'Most of these arrive through the core package, so the fix is usually a core release',
+        'that bumps the dependency, then moving this instance onto it.',
+        '',
+        'Filed by modules/autonomy/pollers/daily-checks.js (task 1004878). The same set is not',
+        're-filed tomorrow; a changed set is.',
+      ].join('\n'),
+    },
+  };
+}
+
+const CHECKS = {
+  'rank-roles-audit': checkRankRoles,
+  'dep-audit-nightly': checkDepAudit,
+};
+
+// ── the ledger half ────────────────────────────────────────────────────────────
+
+const fingerprint = (keys) =>
+  crypto.createHash('sha1').update([...keys].sort().join('\n')).digest('hex').slice(0, 12);
+
+// The fingerprint the last DELIVERED finding carried, or null. Only a `go` row
+// counts: an error or an undelivered filing in between must not make tomorrow's
+// identical result look new, and must not make it look delivered either.
+function lastFiledFingerprint(rows) {
+  const go = (rows || []).find((r) => r.decision === 'go');
+  const m = go && /\bfp=([0-9a-f]+)/.exec(go.reason || '');
+  return m ? m[1] : null;
+}
+
+function isDue(rows, routine, now) {
+  const last = (rows || [])[0];
+  if (!last) return true;
+  const at = new Date(last.created_at).getTime();
+  if (!Number.isFinite(at)) return true;
+  return now - at >= periodMs(routine) - DUE_SLACK_MS;
+}
+
+// One routine, once: run it if it is due, file what it found if that is new, and
+// write the row that says so. NEVER throws.
+async function runCheck(routine, deps = {}) {
+  const db = deps.db || autonomyDb;
+  const logFn = deps.log || ((m) => log.info(m));
+  const errFn = deps.error || ((m) => log.error(m));
+  const now = deps.now ? deps.now() : Date.now();
+  const record = (decision, reason) =>
+    db.recordAutonomyRun({ routine, decision, reason }).catch((e) =>
+      errFn(`[daily-checks] ${routine}: could not record the run (${e && e.message})`));
+
+  let rows;
+  try {
+    rows = await db.readAutonomyRuns({ routine, limit: 10 });
+  } catch (e) {
+    return { skipped: 'db_unreachable', error: e && e.message };
+  }
+  if (!isDue(rows, routine, now)) return { skipped: 'not_due' };
+
+  let result;
+  try {
+    result = await CHECKS[routine]({ ...deps, db });
+  } catch (e) {
+    const msg = (e && e.message) || String(e);
+    errFn(`[daily-checks] ${routine}: could not run (${msg})`);
+    await record('no-go', `error: ${msg}`.slice(0, 500));
+    return { outcome: 'error', error: msg };
+  }
+
+  if (!result.keys.length) {
+    await record('go', 'clean');
+    return { outcome: 'clean' };
+  }
+  const fp = fingerprint(result.keys);
+  const n = result.keys.length;
+  if (fp === lastFiledFingerprint(rows)) {
+    await record('go', `findings n=${n} fp=${fp} unchanged`);
+    return { outcome: 'unchanged', fingerprint: fp };
+  }
+  const capture = deps.captureIdea || api.resolveOptional('ideas.capture');
+  if (typeof capture !== 'function') {
+    errFn(`[daily-checks] ${routine}: ${n} finding(s) and no idea inbox to file them in (ideas module off)`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: no ideas.capture`);
+    return { outcome: 'undelivered', fingerprint: fp };
+  }
+  try {
+    const idea = await capture({ ...result.idea, filedVia: 'api' });
+    logFn(`[daily-checks] ${routine}: ${n} finding(s) filed as idea ${idea && idea.id}`);
+    await record('go', `findings n=${n} fp=${fp} idea=${idea && idea.id}`);
+    return { outcome: 'filed', fingerprint: fp, ideaId: idea && idea.id };
+  } catch (e) {
+    const msg = (e && (e.message || e.code)) || String(e);
+    errFn(`[daily-checks] ${routine}: ${n} finding(s), filing failed (${msg})`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: ${msg}`.slice(0, 500));
+    return { outcome: 'undelivered', fingerprint: fp, error: msg };
+  }
+}
+
+// One tick: every daily routine in turn. Sequential on purpose — npm audit is the
+// heavy one and nothing here is urgent enough to run two at once.
+let running = false;
+let warnedUnreachable = false;
+async function tick(deps = {}) {
+  if (running) return [];
+  running = true;
+  try {
+    const out = [];
+    for (const routine of ROUTINES) {
+      const r = await runCheck(routine, deps);
+      if (r.skipped === 'db_unreachable' && !warnedUnreachable) {
+        warnedUnreachable = true;
+        log.info(`[daily-checks] skipped — database unreachable (${r.error}); a builder machine has nothing to check`);
+      }
+      out.push({ routine, ...r });
+    }
+    return out;
+  } finally {
+    running = false;
+  }
+}
+
+let firstTimer = null;
+let interval = null;
+
+function start(deps = {}) {
+  if (process.env.ROUTINE_TIMERS_DISABLED === '1') {
+    log.info('[daily-checks] disabled (ROUTINE_TIMERS_DISABLED=1)');
+    return;
+  }
+  if (firstTimer || interval) return; // already started
+  const fire = () => tick(deps).catch((e) => log.error(`[daily-checks] tick crashed: ${e && e.message}`));
+  firstTimer = setTimeout(() => {
+    fire();
+    interval = setInterval(fire, TICK_MS);
+    if (interval.unref) interval.unref();
+  }, FIRST_MS + Math.floor(Math.random() * JITTER_MS));
+  if (firstTimer.unref) firstTimer.unref();
+  log.info(`[daily-checks] started — ${ROUTINES.join(', ')} once a day (checked hourly against the run ledger)`);
+}
+
+function stop() {
+  if (firstTimer) clearTimeout(firstTimer);
+  if (interval) clearInterval(interval);
+  firstTimer = interval = null;
+}
+
+module.exports = {
+  start,
+  stop,
+  tick,
+  runCheck,
+  isDue,
+  fingerprint,
+  lastFiledFingerprint,
+  checkRankRoles,
+  checkDepAudit,
+  ROUTINES,
+  TICK_MS,
+  DUE_SLACK_MS,
+};

package/modules/autonomy/pollers/routine-timers.js

@@ -38,9 +38,9 @@
 //     so over-/under-firing is harmless and a second instance can't double-fold.
 //
 // (diagram-drift was intentionally NOT made a timer: all five onboarding diagrams
-// already auto-regenerate from live facts on every deploy, so a daily drift check
-// is near-redundant; the manual `node scripts/bongos/run-routine.js diagram-drift`
-// remains for on-demand use. See the ADR 0078 amendment.)
+// already auto-regenerate from live facts on every deploy. Task 1004878 retired
+// the routine outright. The daily checks that ARE timed live beside this file, in
+// daily-checks.js.)
 //
 // Mirrors the publish-reconciler contract: env-overridable interval, an UNREF'd
 // timer (never holds the process open across a systemd restart), best-effort (a
@@ -57,9 +57,11 @@
 // core load at module-discovery time, and so tests that pass deps.db bypass it.
 const api = require('../../../src/module-api');
 
-const WEEK_MS = 7 * 24 * 60 * 60_000;
+// The period comes from ../server-schedule.js, the table the merge-gate cadence check
+// (scripts/bongos/routine-schedule.js) also reads — so the two cannot disagree.
+const { periodMs } = require('../server-schedule');
 
-const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || WEEK_MS;
+const PEER_VOTE_INTERVAL_MS = Number(process.env.ROUTINE_PEER_VOTE_MS) || periodMs('peer-vote-tally');
 // First-fire delay: let the server finish binding + the other in-process pollers
 // settle before the first tally. Jitter spreads first-fire across a minute so a
 // crash-loop / deploy storm doesn't synchronize every restart's first run.

package/modules/autonomy/rank-roles.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// modules/autonomy/rank-roles.js — which builders hold a rank the governance
+// backfill cannot match? (task 1002873; moved here from
+// scripts/bongos/audit-rank-roles.js in task 1004878 so the server's daily check and
+// the CLI share ONE definition).
+//
+// Pure: no I/O, no core require. The live ladder is an ARGUMENT — the poller passes
+// api.LIVE_RANK_LADDER, the CLI passes db-kernel's — because a module file reaches
+// core only through the doorway.
+
+// findRanksWithoutRoles — given roster rows and the live ladder, which builders hold
+// a rank that `governance_002`'s INNER JOIN cannot match?
+//
+// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
+// legacy value does, and reads as "fine" in every UI that renders a blank.
+function findRanksWithoutRoles(rows, liveRanks) {
+  const live = new Set(liveRanks || []);
+  return (Array.isArray(rows) ? rows : [])
+    .filter((b) => b && !live.has(b.rank))
+    .map((b) => ({
+      id: b.id != null ? String(b.id) : null,
+      // The login is what an operator needs to act; it is already visible to any
+      // caller authorised to read the roster, so this adds no exposure.
+      github_login: b.github_login || null,
+      rank: b.rank === undefined ? null : b.rank,
+      status: b.status || null,
+    }));
+}
+
+// summarize — the rank histogram, so a CLEAN run still says what it looked at.
+// A green check that prints nothing is indistinguishable from one that read
+// nothing, which is the failure mode this whole check is about.
+function summarize(rows) {
+  const counts = new Map();
+  for (const b of Array.isArray(rows) ? rows : []) {
+    const key = b && b.rank ? b.rank : '(none)';
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+// ideaFor — the one idea a finding becomes, filed by either caller.
+function ideaFor(offenders, { filedBy = 'scripts/bongos/audit-rank-roles.js' } = {}) {
+  return {
+    title: `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
+    bodyMd: [
+      `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
+      '',
+      'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
+      'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
+      '',
+      ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
+      '',
+      'Fix: move each to a live rank through the normal rank-change path, which rotates',
+      'the governance role in the same transaction. Not auto-repaired: changing a rank is',
+      'an authority decision, and a sweep is the wrong actor for it.',
+      '',
+      `Filed by ${filedBy} (task 1002873).`,
+    ].join('\n'),
+  };
+}
+
+module.exports = { findRanksWithoutRoles, summarize, ideaFor };

package/modules/autonomy/server-schedule.js

@@ -0,0 +1,37 @@
+'use strict';
+
+// modules/autonomy/server-schedule.js — which routines the always-on server fires
+// itself, and how often (task 1004878).
+//
+// ONE TABLE, TWO READERS THAT MUST AGREE. The pollers in ./pollers/ take their
+// periods from here, and scripts/bongos/routine-schedule.js reads the same rows to
+// decide whether a routine's declared `cadence:` has something that fires it. Before
+// this table the only scheduler that check could see was .github/workflows/, so a
+// routine fired in-process (peer-vote-tally) read as "manual only", and the routines
+// nothing fired at all read the same way — the two cases were indistinguishable.
+//
+// Deliberately dependency-free: the merge-gate check requires this file in a plain
+// checkout with no database and no module loader.
+
+const DAY_MS = 24 * 60 * 60_000;
+const WEEK_MS = 7 * DAY_MS;
+
+// The cadence names a server row may use, and the period each one means. A subset of
+// routine-schedule.js's vocabulary: nothing in-process runs more often than daily.
+const CADENCE_MS = Object.freeze({ daily: DAY_MS, weekly: WEEK_MS });
+
+const SERVER_ROUTINES = Object.freeze([
+  { routine: 'peer-vote-tally', cadence: 'weekly', poller: 'routine-timers' },
+  { routine: 'rank-roles-audit', cadence: 'daily', poller: 'daily-checks' },
+  { routine: 'dep-audit-nightly', cadence: 'daily', poller: 'daily-checks' },
+].map(Object.freeze));
+
+// periodMs('rank-roles-audit') → 86400000. Throws on a routine the table does not
+// carry, so a poller can never quietly fall back to a period nobody declared.
+function periodMs(routine) {
+  const row = SERVER_ROUTINES.find((r) => r.routine === routine);
+  if (!row) throw new Error(`server-schedule: '${routine}' is not a server-fired routine`);
+  return CADENCE_MS[row.cadence];
+}
+
+module.exports = { SERVER_ROUTINES, CADENCE_MS, periodMs, DAY_MS, WEEK_MS };

package/modules/government/catalog.js

@@ -166,7 +166,11 @@ const PERMISSIONS = [
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },
   { key: 'government.manage', system: true, floor: 'archon', guards: 'the Government tab routes (ranks/perms/assignments CRUD, reads included — R110) — meta-escalation' },
-  { key: 'gate_approval.decide', system: true, floor: 'archon', guards: 'POST /gate-approvals/:pr/approve — CI deploy-gate override' },
+  // RETIRED (task 1004859): both gate-approval routes and the held-PR list on the /gate
+  // page were removed, because the gate-review CI check they waited on never ran. The key stays only
+  // because grant rows may still name it; dropping it from this list needs a migration
+  // that deletes those rows (the government_019 precedent, task 1003894). It guards nothing.
+  { key: 'gate_approval.decide', system: true, floor: 'archon', guards: 'nothing since task 1004859 removed POST /gate-approvals/:pr/approve; the key is retired and awaits a grant-row cleanup' },
   { key: 'deploy.push_main', system: true, substrate: true, floor: 'archon', guards: 'git push origin main / the deploy — substrate-enforced (pre-push, main-audit)' },
   { key: 'path.protected.modify', system: true, substrate: true, floor: 'archon', guards: 'modifying a PROTECTED_GLOBS path below the Metic floor — substrate (ADR 0043)' },
   { key: 'infra.ssh', system: true, substrate: true, floor: 'archon', guards: 'ssh to the droplet / operator surface — substrate (credential placement)' },
@@ -305,11 +309,10 @@ const PERMISSIONS = [
   { key: 'session.search', system: false, floor: 'metic', guards: 'GET /sessions/search (ADR 0157, was archon)' },
   { key: 'memory.read.any', system: false, floor: 'metic', scope: 'any', resource: 'memory', verb: 'read', guards: 'GET /memory/builders/:id/file[s] — cross-builder memory read (ADR 0157, was archon)' },
   { key: 'audit_log.read', system: false, floor: 'metic', guards: 'GET /audit-log (ADR 0157, was archon)' },
-  // ADR 0157 §4. Split from `gate_approval.decide` (system, archon) so the Gate PAGE
-  // can open to Metic while APPROVING a held PR stays Archon. Without the split, a
-  // Metic could reach /gate via `page.view.government` and then 403 on its only data
-  // endpoint — a page that renders nothing but an error.
-  { key: 'gate_approval.read', system: false, floor: 'metic', guards: 'GET /gate-approvals — the Gate page read side (approve = gate_approval.decide, archon)' },
+  // RETIRED (task 1004859), with `gate_approval.decide` above: GET /gate-approvals and
+  // the held-PR list it fed are gone. Kept for the same reason — grant rows may name it,
+  // and removing the key needs a migration that deletes them. It guards nothing.
+  { key: 'gate_approval.read', system: false, floor: 'metic', guards: 'nothing since task 1004859 removed GET /gate-approvals and the held-PR list it fed; the key is retired and awaits a grant-row cleanup' },
 
   // ── ownership-scoped + baseline own-work (floor thetes / xenos) ───────────────
   { key: 'task.claim.any', system: false, floor: 'thetes', guards: 'claim the general queue (per-task requires_rank floor still applies)' },
@@ -391,7 +394,7 @@ const PERMISSIONS = [
   // `requireGovernmentPage`) once the floor moved. Viewing is all this grants: every
   // write those pages reach is its own atom, and `government.manage` (the
   // ranks/permissions tab) stayed archon.
-  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /gate, /government (requireGovernmentPage; write = government.manage, archon)' },
+  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /gate (the Autobongos panel), /government (requireGovernmentPage; write = government.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────

package/modules/government/decision-board.js

@@ -246,7 +246,6 @@ const MATTER_ACTIONS = Object.freeze({
   }),
   release: Object.freeze({
     approve_override: Object.freeze({ request_id: 'id' }),
-    approve_gate: Object.freeze({ pr: 'id' }),
   }),
   review: Object.freeze({
     satisfy_criterion: Object.freeze({ criterion_id: 'id' }),

package/modules/government/decision-rules.js

@@ -105,7 +105,6 @@ const AREAS = Object.freeze([
     ]) }),
   Object.freeze({ key: 'release', name: 'Release', gate: 'core.pin.move',
     today: 'whoever may put a release live', acts: Object.freeze([
-      'POST /gate-approvals/:pr/approve',
       'POST /override-requests/:id/decide',
       'POST /provisioning/instances/:id/core-upgrade',
       'POST /provisioning/instances/:id/update-channel',

package/modules/government/docket.js

@@ -108,7 +108,6 @@ const EXPECTED_SOURCES = Object.freeze([
   Object.freeze({ source: 'redteam_reports', building: 'disputes', label: 'red-team reports' }),
   Object.freeze({ source: 'criteria_uat', building: 'review', label: 'criteria awaiting UAT' }),
   Object.freeze({ source: 'core_update', building: 'release', label: 'core update' }),
-  Object.freeze({ source: 'gate_approvals', building: 'release', label: 'CI gate approvals' }),
   Object.freeze({ source: 'autobongos_fence', building: 'automation', label: 'the Autobongos fence' }),
   Object.freeze({ source: 'module_rechecks', building: 'release', label: 'module re-checks' }),
   // task 1004712: a dry pot's borrow from the reserve, a treasury matter (treasury.js)

package/modules/government/protected-surfaces.js

@@ -13,7 +13,7 @@
 //
 //   THE OUT-OF-BAND SUBSTRATE STAYS THE ENFORCER. Nothing here enforces
 //   anything. The enforcers are the git pre-push hook, the grader pre-pass, the
-//   post-push main audit, gate-review.js and the goal-scope check — they read
+//   post-push main audit and the goal-scope check — they read
 //   the registry with no DB, no server and no HTTP, and they are what actually
 //   blocks a sub-floor change (ADR 0043). Re-mapping a floor here changes what
 //   the substrate protects; it can never make the request path the authority.

package/modules/government/protected-surfaces.json

@@ -7,7 +7,7 @@
     "",
     "POLICY OWNS / SUBSTRATE ENFORCES. Editing this file re-maps POLICY. It does NOT move",
     "enforcement into the app: the pre-push git hook, the grader pre-pass, main-audit.js,",
-    "gate-review.js and the goal-scope check all read this registry OUT OF BAND (no DB, no",
+    "and the goal-scope check all read this registry OUT OF BAND (no DB, no",
     "server, no HTTP) and remain the enforcers (ADR 0043). A government-tab edit can widen or",
     "narrow the protected set and re-map a floor; it can never make the request path the",
     "authority.",
@@ -82,13 +82,12 @@
     { "glob": "scripts/bongos/ship-visual.js", "group": "pipeline", "why": "task 1004024. The 2026-08-23 carve of ship.js (task 1003205): the land path, the ship state machine, the grade gate steps, the merge and pushVia, about 6,200 lines behind a 373-line protected entry point." },
     { "glob": "scripts/bongos/confirm.js", "group": "pipeline", "why": "the confirm step" },
     { "glob": "scripts/bongos/merge-mode.js", "group": "pipeline", "why": "the manual land fallback" },
-    { "glob": "scripts/bongos/ci-grade.js", "group": "pipeline", "why": "CI grade-gate driver — steers the grade check (ADR 0058)" },
     { "glob": "scripts/bongos/grade-smoke.js", "group": "pipeline", "why": "grade-smoke driver (ADR 0058)" },
     { "glob": "scripts/bongos/conductor-dispatch.js", "group": "pipeline", "why": "mid-flight grader dispatch (ADR 0058)" },
     { "glob": "scripts/bongos/main-audit.js", "group": "pipeline", "why": "the post-push audit — the authoritative substrate layer (self-protect)" },
     { "glob": "scripts/bongos/push-main.js", "group": "pipeline", "why": "the sanctioned main-push (carries the override)" },
     { "glob": "scripts/bongos/run-unit-tests.js", "group": "pipeline", "why": "the unit-gate test SELECTOR — muting tests here blunts the CI gate (ADR 0058)" },
-    { "glob": "scripts/bongos/gate-review.js", "group": "pipeline", "why": "the automatic gatekeeper itself (self-protect, ADR 0058)" },
+    { "glob": "scripts/bongos/hard-floor.js", "group": "pipeline", "why": "task 1004859. The trust-boundary hard-floor list (self-protect). It moved here from scripts/bongos/gate-review.js when that never-run CI classifier was removed; publish-manifest.js and adopt-preflight.js read it." },
     { "glob": "scripts/bongos/setup.js", "group": "pipeline", "why": "/builder-setup — installs the pre-push hook" },
     { "glob": "scripts/bongos/install-git-hooks.js", "group": "pipeline", "why": "the hook installer (self-protect)" },
     { "glob": "scripts/bongos/hooks/", "group": "pipeline", "why": "the git hooks themselves (self-protect)" },

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -53,7 +53,7 @@
      chrome exists before the page script runs. -->
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/city.html

@@ -107,7 +107,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/collab.html

@@ -150,7 +150,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/commands.html

@@ -53,7 +53,7 @@
 
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-logo1"></script>
+<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>