@bongos/core 1.21.34 → 1.21.36

package/modules/provisioning/routes/core-upgrade.js

@@ -25,12 +25,45 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
-const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler } = require('../core-upgrade');
+const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler, loadPreview } = require('../core-upgrade');
 const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
+// The Release desk's core row (task 1004559): the platform's own move, in two
+// steps on one row. Until a dry run has PASSED for the very version on offer the
+// row offers only 'check' (POST …/core-upgrade with dry_run); 'take' (the real
+// move) is handed only after that pass, so no desk can move the pin without the
+// check. The chip carries the version, which the route requires as its own
+// confirmation. A run in progress offers nothing (the row then steps aside for
+// the plain core-update matter). Pure; exported for tests.
+function coreDeskRows(preview) {
+  const p = preview || {};
+  const to = p.recommended_version;
+  if (!p.behind || !to || p.instance_id == null) return [];
+  if (p.open_intent && (p.open_intent.state === 'pending' || p.open_intent.state === 'running')) return [];
+  const pf = p.preflight && p.preflight.target === to ? p.preflight : null;
+  const version = [{ key: String(to), label: String(to) }];
+  const base = { id: p.instance_id, name: `Core ${to}`, over: 'core_update', opened_at: p.observed_at || null, ref: { type: 'core_pin', id: p.instance_id } };
+  if (pf && pf.ok) return [{ ...base, fact: 'checked · nothing blocks', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'take', options: version }, { key: 'check', options: version }] }];
+  if (pf) return [{ ...base, fact: 'the check refused it', facts: [String(pf.error || 'no reason given'), `running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+  return [{ ...base, fact: 'not checked yet', facts: [`running ${p.served_version || 'unknown'}`], acts: [{ key: 'check', options: version }] }];
+}
+function contributeCoreDesk() {
+  api.contribute('governor.docket', {
+    desk: 'release.core',
+    // the control-plane read's own atom (GET /provisioning/control-plane)
+    gate: { permission: 'core.pin.move' },
+    read: async () => {
+      const { rows } = await api.pool.query("SELECT * FROM provisioning_instances WHERE hosting_shape = 'control-plane' LIMIT 1");
+      if (!rows.length) return [];
+      return coreDeskRows(await loadPreview(api.pool, provisioning, rows[0]));
+    },
+  });
+}
+
 module.exports = function buildCoreUpgradeRouter() {
+  contributeCoreDesk();
   const router = express.Router();
 
   // POST /provisioning/instances/:id/core-upgrade — move the core pin.
@@ -119,3 +152,5 @@ module.exports = function buildCoreUpgradeRouter() {
 
   return router;
 };
+
+module.exports.coreDeskRows = coreDeskRows;

package/modules/security/routes/reports.js

@@ -56,6 +56,23 @@ function redteamDocketMatter(r) {
     tally: null,
     href: '/watch',
     ref: { type: 'vulnerability_report', id: r.id },
+    // The floor desk's acts (task 1004559): the docket only lists this for a
+    // holder of the adjudicate atom, which both routes check.
+    acts: [{ key: 'confirm' }, { key: 'dispute' }],
+  };
+}
+
+// A confirmed report still waiting for its fix, as a Disputes desk row (task
+// 1004559): one act, POST /security/reports/:id/fix. Pure; exported for tests.
+function confirmedDeskRow(r) {
+  return {
+    id: r.id,
+    name: r.title,
+    fact: r.severity ? `${r.severity} · confirmed` : 'confirmed',
+    facts: ['confirmed, not fixed yet'],
+    opened_at: r.confirmed_at || r.reported_at || null,
+    ref: { type: 'vulnerability_report', id: r.id },
+    acts: [{ key: 'fix' }],
   };
 }
 
@@ -69,6 +86,11 @@ function contributeReportsToDocket() {
       return lists.flat().map(redteamDocketMatter);
     },
   });
+  api.contribute('governor.docket', {
+    desk: 'disputes.confirmed',
+    gate: { permission: 'security.report.adjudicate' },
+    read: async () => (await security.listVulnerabilityReports({ scope: 'all', status: 'confirmed', limit: 40 })).map(confirmedDeskRow),
+  });
   // The Disputes record (task 1004527): every report that was ruled on, dated by
   // its ruling (confirmed or fixed). Same atom as the list route it reads.
   api.contribute('governor.docket', {
@@ -318,3 +340,4 @@ module.exports = function buildSecurityReportsRouter() {
 
 module.exports.redteamDocketMatter = redteamDocketMatter;
 module.exports.rulingHistory = rulingHistory;
+module.exports.confirmedDeskRow = confirmedDeskRow;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.34",
+  "version": "1.21.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.34",
+      "version": "1.21.36",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.34",
+  "version": "1.21.36",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8964,5 +8964,21 @@
       "id": "1004558",
       "text": "Inside every building in the governor city, the floor you pick is now a desk you can act from, built from the new floor desks design. It shows the floor's name and how many things wait on you, up to three short numbers, and on"
     }
+  ],
+  "1.21.35": [
+    {
+      "id": "1004559",
+      "text": "Governing now happens inside the buildings. On a floor's desk you can set a builder's tier, deactivate them, invite someone by GitHub name, give or take back a custom rank; confirm, dispute or mark fixed a security report and"
+    }
+  ],
+  "1.21.36": [
+    {
+      "id": "1004561",
+      "text": "Three new governing actions, all in place inside the buildings. In Treasury you can now set each builder's monthly spending limit with one tap. In Review you can undo a sign-off with a one-tap reason. And when a council decide"
+    },
+    {
+      "id": "1004560",
+      "text": "The Planning building now has three working desks on its first floors. Priorities lists the open goals in order with a square for each promise; arrows move a goal up or down, and a save bar (with undo) sets the new order, or,"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -194,6 +194,8 @@ const EXPECTED_RANKS = {
   // builder authority — rank + lifecycle status mutation
   'PATCH /builders/:id/rank': 'perm:builder.rank.set',
   'PATCH /builders/:id/status': 'perm:builder.status.set',
+  // task 1004561: the Treasury desk sets a builder's monthly limit through it
+  'PATCH /builders/:id/budget': 'perm:builder.budget.set',
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',

package/src/bongos/routes/backup.js

@@ -24,6 +24,7 @@ const auth = require('../auth');
 const { branding } = require('../../branding');
 const { resolveEnv } = require('../../instance-config');
 const { asyncHandler } = require('./_helpers');
+const seams = require('../../module-seams');
 // task 1003208: structured logging — was console.*. A core file logs through
 // the kernel logger directly; only MODULES go via api.logger (the doorway).
 const log = require('../logger').logger.child({ src: 'backup' });
@@ -76,6 +77,20 @@ function isStaleDump(stamp, nowMs = Date.now(), staleAfterHours = STALE_AFTER_HO
   return age > staleAfterHours;
 }
 
+// The newest dump's age for the Treasury desk (task 1004559), read WITHOUT
+// blocking: the docket is read on every street visit, so this is one async
+// directory listing and the age from the filename (no stat), never latestDump()'s
+// synchronous reads. Same filename rule and staleness rule as latestDump().
+async function newestDumpAge(nowMs = Date.now()) {
+  let files;
+  try { files = await fs.promises.readdir(BACKUP_DIR); } catch { return null; }
+  const dumps = files.filter((f) => f.startsWith(`${DB_NAME}-`) && f.endsWith('.sql.gz')).sort();
+  if (!dumps.length) return null;
+  const ts = dumps[dumps.length - 1].replace(`${DB_NAME}-`, '').replace('.sql.gz', '');
+  const age = dumpAgeHours(ts, nowMs);
+  return { age_hours: age === null ? null : Math.round(age * 10) / 10, stale: isStaleDump(ts, nowMs) };
+}
+
 function latestDump(nowMs = Date.now()) {
   let files;
   try {
@@ -107,7 +122,16 @@ function latestDump(nowMs = Date.now()) {
   };
 }
 
+// The Treasury desk's backup row (task 1004559), under the backup routes' own
+// atom: one tap runs POST /backup/trigger. Pure; exported for tests.
+function backupDeskRows(dump, running) {
+  const age = dump && Number.isFinite(Number(dump.age_hours)) ? Number(dump.age_hours) : null;
+  const fact = running ? 'backing up now' : age == null ? 'no backup yet' : age < 1 ? 'last one under an hour' : age < 48 ? `last ${Math.round(age)} hours ago` : `last ${Math.round(age / 24)} days ago`;
+  return [{ id: 'now', name: 'Back up now', fact, facts: dump && dump.stale ? ['the last one is stale'] : [], tool: true, ref: { type: 'backup', id: 'now' }, acts: running ? [] : [{ key: 'backup' }] }];
+}
+
 module.exports = function buildBackupRouter() {
+  seams.contribute('governor.docket', { desk: 'treasury.backup', gate: { permission: 'backup.manage' }, read: async () => backupDeskRows(await newestDumpAge(), triggerRunning) });
   const router = express.Router();
 
   // rank: metic+archon — any working builder may check or trigger a backup. Gate:
@@ -168,3 +192,5 @@ module.exports.parseDumpTimestamp = parseDumpTimestamp;
 module.exports.dumpAgeHours = dumpAgeHours;
 module.exports.isStaleDump = isStaleDump;
 module.exports.STALE_AFTER_HOURS = STALE_AFTER_HOURS;
+
+module.exports.backupDeskRows = backupDeskRows;

package/src/bongos/routes/builders.js

@@ -168,7 +168,99 @@ function fireDiscordBroadcast(text) {
   }
 }
 
+// The People desk's builder rows (task 1004559): one row per active builder the
+// viewer may act on, with the acts the viewer's own atoms allow: set tier
+// (builder.rank.set, PATCH /builders/:id/rank) and deactivate (builder.status.set,
+// PATCH /builders/:id/status). Never the viewer's own row: both routes refuse it.
+// Pure; exported for tests.
+const STOP_REASONS = Object.freeze([
+  { key: 'left', label: 'left the project' },
+  { key: 'quiet', label: 'gone quiet' },
+  { key: 'asked', label: 'asked to stop' },
+]);
+function builderDeskRows(builders, { viewerId, mayRank, mayStop, ranks }) {
+  if (!mayRank && !mayStop) return [];
+  return (builders || []).filter((b) => b && String(b.id) !== String(viewerId)).map((b) => {
+    const acts = [];
+    // one rung up at most (the route refuses a multi-rung promotion), any rung down
+    const at = (ranks || []).indexOf(b.rank);
+    // a rank off the live ladder offers no tier chip: there is no rung to move by one
+    if (mayRank && at >= 0) acts.push({ key: 'tier', options: (ranks || []).filter((r, i) => r !== b.rank && i <= at + 1).map((r) => ({ key: r, label: r })) });
+    if (mayStop) acts.push({ key: 'deactivate', options: STOP_REASONS });
+    return { id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: b.rank || 'builder', facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder', id: b.id }, acts };
+  });
+}
+// Contributed from the router factory: any builder passes the gate, and the read
+// scopes itself to the viewer's atoms (an empty desk for a viewer holding neither).
+function contributeBuilderDesk() {
+  seams.contribute('governor.docket', {
+    desk: 'people.builders',
+    gate: { anyBuilder: true },
+    read: async (ctx) => {
+      const mayRank = ctx.has('builder.rank.set');
+      const mayStop = ctx.has('builder.status.set');
+      if (!mayRank && !mayStop) return [];
+      return builderDeskRows(await db.listActiveBuilders(), { viewerId: ctx.builderId, mayRank, mayStop, ranks: db.LIVE_RANK_LADDER });
+    },
+  });
+}
+
+// The Treasury desk's budget rows (task 1004561): one row per active builder,
+// their monthly spending limit as the fact, and the limits a viewer holding
+// builder.budget.set (PATCH /builders/:id/budget's own atom) may set in one tap.
+// The chip for the limit a builder already has is left off. Pure; exported.
+const BUDGET_CHIPS = Object.freeze([25, 50, 100, 250]);
+function budgetWords(usd) {
+  return usd == null ? 'no limit' : `$${Number(usd).toLocaleString('en-US', { maximumFractionDigits: 2 })} a month`;
+}
+function budgetDeskRows(builders) {
+  return (builders || []).filter(Boolean).map((b) => {
+    const now = b.monthly_budget_usd == null ? null : Number(b.monthly_budget_usd);
+    const options = BUDGET_CHIPS.filter((n) => n !== now).map((n) => ({ key: String(n), label: `$${n} a month` }));
+    if (now !== null) options.push({ key: 'none', label: 'no limit' });
+    return {
+      id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: budgetWords(now),
+      facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder_budget', id: b.id },
+      acts: [{ key: 'budget', options: options.slice(0, 5) }],
+    };
+  });
+}
+// The one write both the route and a passed Treasury matter make.
+async function setMonthlyBudget(builderId, usd) {
+  return seams.resolveOptional('reward').setBuilderMonthlyBudget(builderId, usd);
+}
+function contributeTreasury() {
+  seams.contribute('governor.docket', {
+    desk: 'treasury.budgets',
+    gate: { permission: 'builder.budget.set' },
+    // one read: the active roster and each limit together
+    read: async () => {
+      const { rows } = await pool.query(
+        `SELECT id, github_login, display_name, monthly_budget_usd
+           FROM builders
+          WHERE status = 'active'
+          ORDER BY COALESCE(display_name, github_login)`,
+      );
+      return budgetDeskRows(rows);
+    },
+  });
+  // What a passed Treasury matter carries out, when the decision table puts
+  // Treasury to a sitting: the same write as PATCH /builders/:id/budget.
+  seams.contribute('governor.matterAct', {
+    area: 'treasury',
+    type: 'set_budget',
+    act: async (action, ctx) => {
+      const updated = await setMonthlyBudget(action.builder_id, action.monthly_usd);
+      if (!updated) return { done: false, reason: 'builder_not_found' };
+      log.info(`[gds] builder ${action.builder_id} monthly budget set to ${budgetWords(action.monthly_usd)} by a passed Treasury matter (matter ${ctx && ctx.matterId})`);
+      return { done: true };
+    },
+  });
+}
+
 module.exports = function buildBuildersRouter() {
+  contributeBuilderDesk();
+  contributeTreasury();
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
@@ -323,7 +415,7 @@ module.exports = function buildBuildersRouter() {
       // setBuilderMonthlyBudget carved to modules/economy/ (BV1.R77 / ADR 0093
       // §1-2): resolve the `reward` kernel port (economy is default-on). The
       // archon rank gate on this route is unchanged.
-      const updated = await seams.resolveOptional('reward').setBuilderMonthlyBudget(targetId, budget);
+      const updated = await setMonthlyBudget(targetId, budget);
       if (!updated) return res.fail('builder_not_found', 404);
       res.json({ builder: updated });
     } catch (err) {
@@ -707,3 +799,6 @@ module.exports = function buildBuildersRouter() {
 
   return router;
 };
+
+module.exports.builderDeskRows = builderDeskRows;
+module.exports.budgetDeskRows = budgetDeskRows;

package/src/bongos/routes/modules.js

@@ -180,8 +180,24 @@ function contributeModuleRechecksToDocket() {
   });
 }
 
+// The Rules desk's module rows (task 1004559), under the toggle's own atom
+// (POST /modules/:key/enable, module.enable): each module on disk, turned on in
+// one tap, or off with a one-tap 'yes' so a stray tap cannot pull one. Pure;
+// exported for tests.
+function moduleDeskRows(mods) {
+  return (mods || []).filter((m) => m && m.key).map((m) => ({
+    id: m.key, name: m.title || m.key, fact: m.enabled ? 'on' : 'off', facts: m.description ? [m.description] : [], tool: true,
+    ref: { type: 'module', id: m.key },
+    acts: [m.enabled ? { key: 'module_off', options: [{ key: 'yes', label: 'yes, turn off' }] } : { key: 'module_on' }],
+  }));
+}
+function contributeModuleDesk() {
+  seams.contribute('governor.docket', { desk: 'rules.modules', gate: { permission: 'module.enable' }, read: async () => moduleDeskRows(listModules()) });
+}
+
 module.exports = function buildModulesRouter() {
   contributeModuleRechecksToDocket();
+  contributeModuleDesk();
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.
@@ -702,3 +718,5 @@ module.exports = function buildModulesRouter() {
 // own disk scan, no DB), so it's safe to require directly outside an Express
 // request cycle, the same way tests/atlas.mjs requires gen-atlas.js's builders.
 module.exports.listModules = listModules;
+
+module.exports.moduleDeskRows = moduleDeskRows;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.34'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.36'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/governor_docket.mjs

@@ -285,7 +285,7 @@ test('the response shape: counts, line, street-ordered buildings, sorted matters
   c.readings.set('flow', { reading: 'flow', gate: { anyBuilder: true }, read: async () => ({ value: 3, figure: '3 stuck', line: 'longest wait 4 days, waiting for review', hot: true }) });
   const d = await docket.buildDocket({ viewer: VIEWER, permissions: ['board.vote.cast', 'security.report.adjudicate'], contributions: c, now: NOW });
 
-  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
+  assert.deepEqual(Object.keys(d).sort(), ['buildings', 'counts', 'desks', 'floors', 'generated_at', 'history', 'history_sources', 'line', 'matters', 'readings', 'sources', 'viewer', 'vocabulary'].sort());
   assert.deepEqual(d.viewer, { id: '7' });
   // board 11 (needs) + board 12 (settled, closed this week) + blocker + report; board 13 is too old
   assert.deepEqual(d.counts, { needs: 2, moving: 1, settled: 1 });
@@ -734,3 +734,30 @@ test('GET /government/docket: 403 without board.vote.cast, the documented shape
   assert.equal(body.sources.find((s) => s.source === 'access_requests').status, 'not_yours');
   assert.ok(!JSON.stringify(body).includes('Admit Kai'), 'a hidden source leaks nothing');
 });
+
+// ── the floor desks' acts and rows (task 1004559) ────────────────────────────
+
+test('acts: a matter carries only well-formed acts, at most two, with at most five one-tap options', () => {
+  const m = docket.normalizeMatter({ id: 1, title: 't', acts: [{ key: 'confirm', options: [1, 2, 3, 4, 5, 6].map((n) => ({ key: n, label: `option ${n}` })) }, { key: 'Bad Key' }, { key: 'fix' }, { key: 'third' }] }, { source: 's', building: 'review' });
+  assert.deepEqual(m.acts.map((a) => a.key), ['confirm', 'fix']);
+  assert.equal(m.acts[0].options.length, 5);
+  assert.equal('acts' in docket.normalizeMatter({ id: 1, title: 't' }, { source: 's', building: 'review' }), false, 'no acts, no field');
+  assert.deepEqual(docket.normalizeActs([{ key: 'allow', pick: 'open_goals', except: [1, 2] }, { key: 'pause', pick: 'everything' }]), [{ key: 'allow', pick: 'open_goals', except: ['1', '2'] }, { key: 'pause' }]);
+  assert.equal(docket.normalizeDeskRow({ id: 1, name: 'n', acts: [] }, { desk: 'people.builders', building: 'people' }), null, 'a desk row with nothing to do is dropped');
+});
+
+test('desks: gated by the atom their write route checks; a gated-out desk is not_yours with no rows; a broken one is unavailable', async () => {
+  const c = none();
+  c.desks = new Map([
+    ['people.builders', { desk: 'people.builders', gate: { permission: 'builder.rank.set' }, read: async () => [{ id: 7, name: 'Ana', fact: 'thetes', acts: [{ key: 'tier', options: [{ key: 'metic', label: 'metic' }] }] }, { id: 8, name: 'no acts', acts: [] }] }],
+    ['automation.goals', { desk: 'automation.goals', gate: { anyBuilder: true }, read: async () => { throw new Error('boom'); } }],
+  ]);
+  const without = await docket.buildDocket({ viewer: VIEWER, permissions: [], contributions: c, now: NOW });
+  const by = (d, k) => d.desks.find((x) => x.key === k);
+  assert.deepEqual(by(without, 'people.builders'), { key: 'people.builders', building: 'people', status: 'not_yours', rows: [] });
+  assert.equal(by(without, 'automation.goals').status, 'unavailable');
+  assert.equal(by(without, 'automation.runners').status, 'off');
+  const withAtom = await docket.buildDocket({ viewer: VIEWER, permissions: ['builder.rank.set'], contributions: c, now: NOW });
+  assert.deepEqual(by(withAtom, 'people.builders').rows.map((r) => [r.id, r.name, r.acts[0].key]), [['people.builders:7', 'Ana', 'tier']]);
+  assert.equal(withAtom.matters.length, 0, 'desk rows never become matters (no pins, no counts)');
+});