@bongos/core 1.21.34 → 1.21.36

package/modules/ideas/governor-docket.js

@@ -19,6 +19,7 @@
 
 const api = require('../../src/module-api');
 const blockers = require('./blockers');
+const ratify = require('./ratify');
 
 const POINT = 'governor.docket';
 const DOCKET_BLOCKER_LIMIT = 50;
@@ -41,9 +42,96 @@ function blockerDocketMatter(b, mayResolve) {
     tally: null,
     href: `/blockers#blocker-${b.id}`,
     ref: { type: 'blocker', id: b.id },
+    // the floor desk's one act (task 1004560): decide, by one of its options
+    ...(mayResolve ? { acts: [{ key: 'decide', options: blockerOptions(b.body_md) }] } : {}),
   };
 }
 
+// A blocker's options as one-tap chips (task 1004560). Its own, when its body
+// lists them as "Option A: …" lines (two to five of them); otherwise the three
+// answers every blocker takes. The chosen key becomes the resolution note, so
+// a key is the option's own words (at most 64 characters) and the label its
+// first words. Pure.
+const DEFAULT_CHOICES = Object.freeze(['go ahead', 'not now', 'need more']);
+const OPTION_LINE = /^\s*(?:[-*]|\d+[.)])?\s*(?:\*\*)?option\s+[A-Za-z0-9]{1,2}(?:\*\*)?\s*[:.)—-]+\s*(?:\*\*)?(.+)$/i;
+function plainWords(s) { return String(s).replace(/[*_`[\]]+/g, '').replace(/\([^)]*\)/g, '').replace(/\s+/g, ' ').trim(); }
+function shortLabel(s) {
+  let out = '';
+  for (const w of s.split(' ')) { const next = out ? out + ' ' + w : w; if (next.length > 16) break; out = next; }
+  return out || s.slice(0, 16);
+}
+function blockerOptions(bodyMd) {
+  const found = [];
+  for (const line of String(bodyMd || '').split(/\r?\n/)) {
+    const m = OPTION_LINE.exec(line);
+    if (!m) continue;
+    const text = plainWords(m[1]).split(/\s[—–-]\s|[.;:]\s/)[0].trim();
+    if (text && !found.some((o) => o.key === text.slice(0, 64))) found.push({ key: text.slice(0, 64), label: shortLabel(text) });
+  }
+  if (found.length >= 2 && found.length <= 5) return found;
+  return DEFAULT_CHOICES.map((t) => ({ key: t, label: t }));
+}
+
+// The Ideas-to-ratify desk (task 1004560): the ideas a ratifier may take from
+// the floor, under idea.ratify (both ratify routes' atom). A criterion proposal
+// ratifies in one tap (POST /inbox/:id/ratify). A Full Idea the board has
+// carried becomes a goal (POST /inbox/:id/ratify-goal) with its target version
+// as a chip — only when its answers compose a goal on their own; one that needs
+// the ratifier to write its criterion opens its page instead. A Full Idea still
+// in its sitting is not here: it is the board's vote row (ADR 0175 §8). Pure.
+function ratifyDeskRows(ideas, versions, passed) {
+  const chips = (versions || []).slice(0, 5).map((v) => ({ key: String(v.id), label: String(v.id) }));
+  const out = [];
+  for (const i of ideas || []) {
+    if (!i || i.status !== 'open') continue;
+    const href = `/idea/${i.id}`;
+    if (i.kind === 'criterion-proposal') {
+      let p = null;
+      try { p = ratify.parseProposalBody(i.body_md); } catch (_) { p = null; }
+      if (!p || !p.target_version) continue;
+      out.push({
+        id: `p${i.id}`, name: String(i.title || 'a promise'), ref: { type: 'criterion_proposal', id: i.id }, href, opened_at: i.created_at,
+        fact: `a promise for ${p.target_version}`, facts: [String(p.criterion_md || '').slice(0, 80)],
+        acts: [{ key: 'ratify' }, { key: 'open' }],
+      });
+      continue;
+    }
+    if (i.grade !== 'full' || !passed.has(String(i.id))) continue;
+    const composed = ratify.composeGoalFromFullIdea({ ideaId: i.id, templateKey: i.template_key, fieldValues: i.field_values });
+    const fits = composed && composed.ok && chips.length > 0;
+    out.push({
+      id: `g${i.id}`, name: String(i.title || 'a full idea'), ref: { type: 'full_idea', id: i.id }, href, opened_at: i.created_at,
+      fact: 'the board carried it', facts: [fits ? 'becomes a goal' : 'needs its page to finish'],
+      acts: fits ? [{ key: 'ratify_goal', options: chips }, { key: 'open' }] : [{ key: 'open' }],
+    });
+  }
+  return out;
+}
+// The desk reads the oldest 30 open proposals and Full Ideas (older first, so
+// nothing waits forever behind newer ones); which Full Ideas the board carried
+// is one read for all of them (government.boardPassedIdeaIds).
+const RATIFY_IDEAS_LIMIT = 30;
+async function readRatifyDesk() {
+  const { rows: ideas } = await api.pool.query(
+    `SELECT i.id, i.title, i.kind, i.status, i.body_md, i.created_at,
+            COALESCE(g.grade, 'quick') AS grade, g.template_key, g.field_values
+       FROM idea_inbox i LEFT JOIN ideas_grades g ON g.idea_id = i.id
+      WHERE i.status = 'open' AND (i.kind = 'criterion-proposal' OR g.grade = 'full')
+      ORDER BY i.created_at, i.id LIMIT $1`,
+    [RATIFY_IDEAS_LIMIT],
+  );
+  const government = api.resolveOptional && api.resolveOptional('government');
+  const passed = new Set();
+  const full = ideas.filter((i) => i.grade === 'full').map((i) => i.id);
+  if (full.length && government && typeof government.boardPassedIdeaIds === 'function') {
+    (await government.boardPassedIdeaIds(full)).forEach((id) => passed.add(String(id)));
+  }
+  const { rows: versions } = passed.size
+    ? await api.pool.query(`SELECT id, name FROM versions WHERE status IN ('building', 'planning') ORDER BY (status = 'building') DESC, id LIMIT 5`)
+    : { rows: [] };
+  return ratifyDeskRows(ideas, versions, passed);
+}
+
 // The rules-at-work reading from this month's routed filings. Pure.
 function rulesReading(settledThisMonth) {
   const n = Number(settledThisMonth) || 0;
@@ -114,6 +202,7 @@ function contributeIdeasToDocket() {
       return rows.map((b) => blockerDocketMatter(b, mayResolve));
     },
   });
+  api.contribute(POINT, { desk: 'planning.ratify', gate: { permission: 'idea.ratify' }, read: () => readRatifyDesk() });
   // A count, no rows: any builder may read it.
   api.contribute(POINT, {
     reading: 'rules',
@@ -127,6 +216,8 @@ function contributeIdeasToDocket() {
 module.exports = {
   contributeIdeasToDocket,
   blockerDocketMatter,
+  blockerOptions,
+  ratifyDeskRows,
   rulesReading,
   rulesFloor,
   rulesHistory,

package/modules/lifecycle/governor-docket.js

@@ -58,10 +58,29 @@ function removalMatter(r) {
     tally: null,
     href: `/task/${encodeURIComponent(r.proposal_task_id)}`,
     ref: { type: 'task', id: r.proposal_task_id },
+    // POST /removal-proposals/:id/decide, the docket source's own atom (task 1004559)
+    acts: [{ key: 'remove' }, { key: 'keep' }],
   };
 }
 
-function uatMatter(c) {
+// The one-tap reasons a force sign-off may give (POST /done-when/:id/satisfy
+// requires one); the desk sends the label as the override reason.
+const FORCE_REASONS = Object.freeze([
+  { key: 'tested_by_hand', label: 'tested by hand' },
+  { key: 'checked_review', label: 'seen in review' },
+  { key: 'no_longer', label: 'no longer applies' },
+]);
+// What the viewer may do on a criterion waiting for a tester (task 1004559). A
+// backend-only criterion signs off in one tap (with the live attestation as its
+// chip); a user-facing one needs a recording, so its act goes to the goal's page.
+// Force sign-off only for a holder of criterion.satisfy, that route's own atom.
+function uatActs(c, { force = false } = {}) {
+  const acts = [c.backend_only === true ? { key: 'signoff', options: [{ key: 'live', label: 'tested it live' }] } : { key: 'record' }];
+  if (force) acts.push({ key: 'force', options: FORCE_REASONS });
+  return acts;
+}
+
+function uatMatter(c, opts) {
   return {
     id: c.id,
     rule: 'signoff',
@@ -75,6 +94,7 @@ function uatMatter(c) {
     tally: { for: c.shipped_total, against: 0, open: 0, needs: 'one sign-off by someone who did not build it' },
     href: c.goal_id ? `/goals#/goal/${encodeURIComponent(c.goal_id)}` : '/goals',
     ref: { type: 'criterion', id: c.id },
+    acts: uatActs(c, opts),
   };
 }
 
@@ -161,6 +181,37 @@ function prioritiesFloor(goals, versionId) {
   return { count: '', line: 'the order goals are worked in', lines: [[top, versionId ? `version ${versionId}` : ''], [`${plural(mine.length, 'goal is', 'goals are')} in the order.`, '']], hot: false };
 }
 
+// The Priorities desk (task 1004560): the building version's open goals in their
+// worked order, each with its promises kept of total, for a viewer who may set
+// the order — POST /goals/reorder's own atom (goal.reorder), or, where Planning
+// is put to a sitting, the right to file the matter (board.item.open). Which of
+// the two a save takes is the decision table's call, read by the screen from the
+// docket's own buildings row; the route the save reaches still decides. Pure.
+const ORDER_PIPS = 12;
+function orderDeskRows(goals, criteria, versionId, mayOrder) {
+  if (!mayOrder || !versionId) return [];
+  const by = new Map();
+  for (const c of criteria || []) {
+    if (c.goal_id == null) continue;
+    const k = String(c.goal_id);
+    if (!by.has(k)) by.set(k, { kept: 0, total: 0 });
+    const e = by.get(k); e.total += 1; if (c.satisfied === true) e.kept += 1;
+  }
+  const mine = (goals || []).filter((g) => g && g.status === 'open' && g.version_id === versionId);
+  if (mine.length < 2) return []; // one goal has no order to set
+  return mine.map((g) => {
+    const e = by.get(String(g.id));
+    const of = e ? Math.min(e.total, ORDER_PIPS) : 0;
+    return {
+      id: g.id, name: String(g.title), ref: { type: 'goal', id: g.id }, set: String(versionId),
+      fact: e ? `${e.kept} of ${e.total} promises kept` : 'no promises yet',
+      facts: [`version ${versionId}`],
+      ...(of ? { pips: { on: Math.min(e.kept, of), of } } : {}),
+      acts: [{ key: 'up' }, { key: 'down' }],
+    };
+  });
+}
+
 // Planning · Versions: what is building, and the last that shipped.
 function versionsFloor(versions, goals) {
   const all = versions || [];
@@ -190,6 +241,26 @@ function signedOffFloor(criteria, now) {
   };
 }
 
+// The Review desk's signed-off rows (task 1004561): the newest promises signed
+// off, each with one act, undo, for a viewer holding criterion.unsatisfy (POST
+// /done-when/:id/unsatisfy's own atom). The reason is one tap. Pure.
+const UNDO_REASONS = Object.freeze([
+  { key: 'broke', label: 'it broke again' },
+  { key: 'untested', label: 'not truly tested' },
+  { key: 'error', label: 'signed in error' },
+]);
+const SIGNED_ROWS = 8;
+function signedDeskRows(criteria) {
+  return (criteria || []).filter((c) => c && c.satisfied === true && c.checked_at)
+    .sort((a, b) => Date.parse(b.checked_at) - Date.parse(a.checked_at))
+    .slice(0, SIGNED_ROWS)
+    .map((c) => ({
+      id: c.id, name: String(c.criterion_md), fact: `signed off ${dayWord(c.checked_at)}`,
+      facts: c.goal_title ? [String(c.goal_title)] : [], ref: { type: 'signed_criterion', id: c.id },
+      acts: [{ key: 'unsign', options: UNDO_REASONS }],
+    }));
+}
+
 // Release · Live this month: shipped work, newest first.
 function liveMonthFloor(shipped, now) {
   const month = (shipped || []).filter((t) => t.shipped_at && Date.parse(t.shipped_at) >= monthStart(now));
@@ -264,6 +335,15 @@ function contributeLifecycleFloors() {
     floor: 'planning.priorities', gate: any,
     read: async (_ctx, { once } = {}) => prioritiesFloor(await openGoals(once), await db.currentBuildingVersionId()),
   });
+  api.contribute(POINT, {
+    desk: 'planning.order', gate: any,
+    read: async (ctx, { once } = {}) => {
+      const may = ctx.has('goal.reorder') || ctx.has('board.item.open');
+      if (!may) return [];
+      const v = await db.currentBuildingVersionId();
+      return orderDeskRows(await openGoals(once), v ? await doneWhen.listCriteria(v) : [], v, may);
+    },
+  });
   api.contribute(POINT, {
     floor: 'planning.versions', gate: any,
     read: async () => versionsFloor(await db.listVersions(), await db.listGoals({})),
@@ -275,6 +355,13 @@ function contributeLifecycleFloors() {
       return signedOffFloor(v ? await doneWhen.listCriteria(v) : [], now);
     },
   });
+  api.contribute(POINT, {
+    desk: 'review.signed', gate: { permission: 'criterion.unsatisfy' },
+    read: async () => {
+      const v = await db.currentBuildingVersionId();
+      return signedDeskRows(v ? await doneWhen.listCriteria(v) : []);
+    },
+  });
   api.contribute(POINT, {
     floor: 'release.live_month', gate: any,
     read: async (_ctx, { now } = {}) => liveMonthFloor(await db.recentShippedTasks(SHIPPED_LIMIT, { days: 31 }), now),
@@ -326,7 +413,8 @@ function contributeLifecycleToDocket() {
     source: 'criteria_uat',
     building: 'review',
     gate: { permission: 'criterion.review' },
-    read: async () => (await doneWhen.listPendingReviewCriteria({})).filter((c) => c.awaiting_uat === true).map(uatMatter),
+    read: async (ctx) => (await doneWhen.listPendingReviewCriteria({})).filter((c) => c.awaiting_uat === true)
+      .map((c) => uatMatter(c, { force: ctx.has('criterion.satisfy') })),
   });
   // Own-scoped by its read, like GET /goals/inbox: a goal's lead sees the requests
   // to join their goals, and everyone sees their own pending ones. An Archon is
@@ -371,13 +459,16 @@ module.exports = {
   overrideMatter,
   removalMatter,
   uatMatter,
+  uatActs,
   joinRequestMatter,
   flowReading,
   promisesReading,
   goalsFloor,
   prioritiesFloor,
+  orderDeskRows,
   versionsFloor,
   signedOffFloor,
+  signedDeskRows,
   liveMonthFloor,
   heldBackFloor,
   newcomersFloor,

package/modules/lifecycle/matter-acts.js

@@ -0,0 +1,63 @@
+'use strict';
+
+// modules/lifecycle/matter-acts.js — what a PASSED Review or Release matter
+// carries out (task 1004561, goal 1000125). When a project's decision table puts
+// Review or Release to a sitting, its passed matter acts here, after the close
+// commits, through the SAME function the direct route calls:
+//   review  satisfy_criterion → satisfyByOverride   (POST /done-when/:id/satisfy)
+//   release approve_override  → db.decideOverrideRequest (POST /override-requests/:id/decide)
+//   release approve_gate      → approveGatePr       (POST /gate-approvals/:pr/approve)
+// The government module only checks the act's shape and calls in through the
+// 'governor.matterAct' contribution point (a module never requires a sibling).
+// Each act returns { done, reason? }: a refusal the route would give (already
+// decided, not open, owner only) is a reason, never a throw.
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const doneWhen = require('./done-when');
+
+const POINT = 'governor.matterAct';
+const why = (area, ctx) => `A passed ${area} matter (matter ${ctx && ctx.matterId}) decided it.`;
+
+// Required lazily: the route files build routers, and only their shared
+// functions are needed here.
+const routes = {
+  doneWhen: () => require('./routes/done-when'),
+  gate: () => require('./routes/gate-approvals'),
+};
+
+const ACTS = Object.freeze({
+  review: Object.freeze({
+    satisfy_criterion: async (action, ctx) => {
+      const c = await doneWhen.getCriterion(action.criterion_id);
+      if (!c) return { done: false, reason: 'criterion_not_found' };
+      if (c.satisfied === true) return { done: false, reason: 'already_satisfied' };
+      await routes.doneWhen().satisfyByOverride({ criterionId: action.criterion_id, signerId: ctx.decidedBy, reason: why('Review', ctx) });
+      return { done: true };
+    },
+  }),
+  release: Object.freeze({
+    approve_override: async (action, ctx) => {
+      try {
+        await db.decideOverrideRequest({ requestId: action.request_id, archonId: ctx.decidedBy, decision: 'approve', note: why('Release', ctx) });
+        return { done: true };
+      } catch (err) {
+        if (err && err.code === 'REQUEST_NOT_OPEN') return { done: false, reason: 'request_not_open' };
+        if (err && err.code === 'OVERRIDE_OWNER_ONLY') return { done: false, reason: 'override_owner_only' };
+        throw err;
+      }
+    },
+    approve_gate: async (action, ctx) => {
+      const out = await routes.gate().approveGatePr({ number: action.pr, login: `council, matter ${ctx && ctx.matterId}` });
+      return out.ok ? { done: true } : { done: false, reason: out.code };
+    },
+  }),
+});
+
+function contributeLifecycleMatterActs() {
+  for (const [area, acts] of Object.entries(ACTS)) {
+    for (const [type, act] of Object.entries(acts)) api.contribute(POINT, { area, type, act });
+  }
+}
+
+module.exports = { ACTS, contributeLifecycleMatterActs };

package/modules/lifecycle/routes/done-when.js

@@ -25,6 +25,7 @@ const goalEdits = require('../goal-edits.js');
 const uatDb = require('../criterion-uat-db.js');
 const { isReservedCriterionSlug } = require('../criterion-ref.js');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
+const log = api.logger('lifecycle');
 
 // authorizeCriterionCreate — the ORDERED, FAIL-CLOSED decision for a non-Archon
 // POST /versions/:id/done-when (ADR 0154). PURE + exported so every rejection is
@@ -80,6 +81,24 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
   return { ok: true };
 }
 
+// Close a criterion WITHOUT a UAT, on a stated reason: the override row and the
+// flip in ONE transaction (an override row with no flip behind it would claim a
+// close that never happened), then the goal achieves if that was its last
+// criterion (a criterion with no goal completes none). Shared by POST
+// /done-when/:id/satisfy and a passed Review matter (task 1004561,
+// ../matter-acts.js) so the two can never differ.
+async function satisfyByOverride({ criterionId, signerId, reason, taskId = null }) {
+  const updated = await api.withTx(async (client) => {
+    await uatDb.recordOverride(client, { criterionId, signerId, reason });
+    return doneWhen.markCriterion(criterionId, taskId, { client });
+  }, { pool: api.pool });
+  let goalResult = { achieved: false, goal: null };
+  if (updated?.goal_id != null) {
+    goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
+  }
+  return { updated, goalResult };
+}
+
 module.exports = function buildDoneWhenRouter() {
   const router = express.Router();
 
@@ -248,18 +267,7 @@ module.exports = function buildDoneWhenRouter() {
       });
     }
     const taskId = req.body?.satisfied_by_task_id ?? null;
-    // ONE transaction: an override row with no flip behind it would claim a
-    // close that never happened, so the two commit together or not at all.
-    const updated = await api.withTx(async (client) => {
-      await uatDb.recordOverride(client, { criterionId: id, signerId: req.builder.id, reason });
-      return doneWhen.markCriterion(id, taskId, { client });
-    }, { pool: api.pool });
-    // Auto-achieve: confirming a goal's last criterion flips it open→achieved.
-    // A criterion with no goal (goal_id NULL) completes no goal.
-    let goalResult = { achieved: false, goal: null };
-    if (updated?.goal_id != null) {
-      goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
-    }
+    const { updated, goalResult } = await satisfyByOverride({ criterionId: id, signerId: req.builder.id, reason, taskId });
     // BV1.R08 (task 1003595): when the goal did NOT flip because it still holds
     // unfinished work, say so. Confirming the last criterion and getting a bare
     // `goal_achieved: false` back reads as a bug to the agent that just did it —
@@ -466,12 +474,17 @@ module.exports = function buildDoneWhenRouter() {
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).
   // rank: archon — un-flip a criterion; same gate as satisfy.
+  // An optional `reason` (the Review desk's one-tap chip, task 1004561) is
+  // logged beside who undid it; the flip itself is unchanged.
   router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
+    if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 200 } })) return;
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
     const existing = await doneWhen.getCriterion(id);
     if (!existing) return res.fail('criterion_not_found', 404);
     const updated = await doneWhen.unmarkCriterion(id);
+    const why = typeof req.body?.reason === 'string' && req.body.reason.trim() ? `: ${req.body.reason.trim()}` : '';
+    log.info(`[gds] criterion ${id} sign-off UNDONE by builder ${req.builder.id}${why}`);
     res.json({ criterion: updated });
   }, { errorCode: 'unsatisfy_failed' }));
 
@@ -482,3 +495,4 @@ module.exports = function buildDoneWhenRouter() {
 // tests/criterion_authoring_gate.mjs (DB-free), the authorizeGoalTaskCreate
 // precedent in routes/goals.js.
 module.exports.authorizeCriterionCreate = authorizeCriterionCreate;
+module.exports.satisfyByOverride = satisfyByOverride;

package/modules/lifecycle/routes/gate-approvals.js

@@ -141,6 +141,75 @@ function contributeGateApprovalsToDocket() {
   });
 }
 
+// The approval itself, shared by the route above and a passed Release matter
+// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
+// { ok: true, body } or { ok: false, code, status, message }; throws on an
+// unexpected failure (the caller says it). `login` is who approved, as the
+// status description names it.
+async function approveGatePr({ number, login }) {
+  if (!githubPush.isConfigured()) {
+    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
+  }
+  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
+  // so a later commit's head carries no approval — red-team #2b protection).
+  const prs = await githubPush.listOpenPullRequests({});
+  const pr = prs.find((p) => p.number === number);
+  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
+  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
+
+  const gate = findCheck(pr, 'gate-review');
+  if (gate && isSuccess(gate)) {
+    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
+  }
+
+  // 1. Set the trustless owner-approval status on the head sha.
+  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
+  if (!set) {
+    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
+    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
+  }
+
+  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
+  //    required check re-evaluates the new approval; re-arm auto-merge.
+  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
+  //    1004323): clearing the gate check is the owner's act on the PR, and
+  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
+  //    read that throws answers held, and an ordinary confirmed task left
+  //    un-armed still lands through the publish reconciler's sweep.
+  const prTask = taskIdFromPr(pr);
+  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
+  let recheck = { reopened: false, auto_merge: false };
+  try {
+    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
+  } catch (e) {
+    // The status IS set; if the re-trigger failed, the next push or a manual
+    // re-run still clears it, and the publish reconciler sweep merges once green.
+    console.error('[gds] gate-approval recheck failed', e);
+    return {
+      ok: true,
+      body: {
+        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
+        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    body: {
+      ok: true,
+      pr: number,
+      head_sha: pr.head_sha,
+      status_set: true,
+      recheck,
+      held_for_artist: held,
+      message: held
+        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
+        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
+    },
+  };
+}
+
 module.exports = function buildGateApprovalsRouter() {
   contributeGateApprovalsToDocket();
   const router = express.Router();
@@ -189,66 +258,10 @@ module.exports = function buildGateApprovalsRouter() {
   router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), async (req, res) => {
     const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
     if (number == null) return;
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot approve.' });
-    }
     try {
-      // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-      // so a later commit's head carries no approval — red-team #2b protection).
-      const prs = await githubPush.listOpenPullRequests({});
-      const pr = prs.find((p) => p.number === number);
-      if (!pr) return res.fail('pr_not_open', { status: 404, message: `No open PR #${number}.` });
-      if (!pr.head_sha) return res.fail('no_head_sha', { status: 409, message: 'Could not resolve the PR head commit.' });
-
-      const gate = findCheck(pr, 'gate-review');
-      if (gate && isSuccess(gate)) {
-        return res.json({ ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' });
-      }
-
-      // 1. Set the trustless owner-approval status on the head sha.
-      const set = await githubPush.setGateOwnerApproved({
-        sha: pr.head_sha,
-        login: req.builder.github_login,
-        targetUrl: pr.url,
-      });
-      if (!set) {
-        // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see catch).
-        return res.fail('status_set_failed', { status: 500, message: 'Could not set the gate-owner-approved status.' });
-      }
-
-      // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-      //    required check re-evaluates the new approval; re-arm auto-merge.
-      //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-      //    1004323): clearing the gate check is the owner's act on the PR, and
-      //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-      //    read that throws answers held, and an ordinary confirmed task left
-      //    un-armed still lands through the publish reconciler's sweep.
-      const prTask = taskIdFromPr(pr);
-      const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-      let recheck = { reopened: false, auto_merge: false };
-      try {
-        recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-      } catch (e) {
-        // The status IS set; if the re-trigger failed, the next push or a manual
-        // re-run still clears it, and the publish reconciler sweep merges once green.
-        console.error('[gds] gate-approval recheck failed', e);
-        return res.json({
-          ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-          message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-        });
-      }
-
-      res.json({
-        ok: true,
-        pr: number,
-        head_sha: pr.head_sha,
-        status_set: true,
-        recheck,
-        held_for_artist: held,
-        message: held
-          ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-          : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-      });
+      const out = await approveGatePr({ number, login: req.builder.github_login });
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      res.json(out.body);
     } catch (err) {
       console.error('[gds] POST /gate-approvals/:pr/approve', err);
       // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
@@ -261,3 +274,5 @@ module.exports = function buildGateApprovalsRouter() {
 
   return router;
 };
+
+module.exports.approveGatePr = approveGatePr;

package/modules/lifecycle/routes/lifecycle.js

@@ -139,6 +139,8 @@ function registerSeams() {
 module.exports = function buildLifecycleRouter() {
   registerSeams();
   governorDocket.contributeLifecycleToDocket();
+  // what a passed Review or Release matter carries out (task 1004561)
+  require('../matter-acts').contributeLifecycleMatterActs();
   // No HTTP surface — the lifecycle capability is a pure kernel port. The empty
   // router is only the loader's contributes.routes mount vehicle; returning a
   // valid express.Router() keeps mountModuleRoutes' `router.use(sub)` happy

package/modules/lifecycle/routes/project-settings.js

@@ -134,7 +134,29 @@ function upmarketRow() {
   };
 }
 
+// The Rules desk's settings rows (task 1004559), under this page's own atom: the
+// rot timer as one-tap day counts (PATCH /project-settings/rot-days), and the
+// work categories as a link to this page, since a category is named in words.
+// Pure; exported for tests.
+const ROT_CHOICES = Object.freeze([7, 14, 30, 60, 90]);
+function settingsDeskRows({ days, categories }) {
+  const live = (categories || []).filter((c) => c && c.active !== false).length;
+  return [
+    { id: 'rot', name: 'Rot timer', fact: `stale after ${days} ${days === 1 ? 'day' : 'days'}`, facts: ['raising it only asks a person'], tool: true, ref: { type: 'project_setting', id: 'rot_days' },
+      acts: [{ key: 'rot', options: ROT_CHOICES.filter((d) => d !== Number(days)).slice(0, 4).map((d) => ({ key: String(d), label: `${d} days` })) }] },
+    { id: 'categories', name: 'Work categories', fact: `${live} in use`, tool: true, href: '/project-settings', ref: { type: 'project_setting', id: 'work_categories' }, acts: [{ key: 'open' }] },
+  ];
+}
+function contributeSettingsDesk() {
+  api.contribute('governor.docket', {
+    desk: 'rules.settings',
+    gate: { permission: 'project.settings.manage' },
+    read: async () => settingsDeskRows({ days: (await api.resolveRotDays()).days, categories: await goalCategory.listCategories({ includeInactive: true }) }),
+  });
+}
+
 module.exports = function buildProjectSettingsRouter() {
+  contributeSettingsDesk();
   const router = express.Router();
 
   // GET /project-settings — all five rows in ONE read.
@@ -261,3 +283,5 @@ module.exports = function buildProjectSettingsRouter() {
 
   return router;
 };
+
+module.exports.settingsDeskRows = settingsDeskRows;

package/modules/onboarding/routes/access-requests.js

@@ -242,7 +242,12 @@ function accessRequestDocketMatter(r) {
 // The governor's docket: a pending request to join stands at People, shown only
 // to a viewer holding `access_request.review` (this queue's own atom, because it
 // exposes would-be builders' usernames) and needing that same viewer's act.
+// The People desk's invite row (task 1004559), under the invite route's own atom:
+// one GitHub name typed in place, sent to POST /access-requests/invite.
+const INVITE_DESK_ROW = Object.freeze({ id: 'invite', name: 'Invite someone', fact: 'by their GitHub name', tool: true, ref: { type: 'invite', id: 'new' }, acts: [{ key: 'invite', field: 'github_login' }] });
+
 function contributeAccessRequestsToDocket() {
+  api.contribute('governor.docket', { desk: 'people.invite', gate: { permission: 'access_request.review' }, read: async () => [INVITE_DESK_ROW] });
   api.contribute('governor.docket', {
     source: 'access_requests',
     building: 'people',
@@ -651,3 +656,5 @@ module.exports = function buildAccessRequestsRouter() {
 };
 
 module.exports.accessRequestDocketMatter = accessRequestDocketMatter;
+
+module.exports.INVITE_DESK_ROW = INVITE_DESK_ROW;

package/modules/provisioning/core-upgrade.js

@@ -545,5 +545,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };