@bongos/core 1.21.35 → 1.21.37

package/modules/lifecycle/governor-docket.js

@@ -181,6 +181,37 @@ function prioritiesFloor(goals, versionId) {
   return { count: '', line: 'the order goals are worked in', lines: [[top, versionId ? `version ${versionId}` : ''], [`${plural(mine.length, 'goal is', 'goals are')} in the order.`, '']], hot: false };
 }
 
+// The Priorities desk (task 1004560): the building version's open goals in their
+// worked order, each with its promises kept of total, for a viewer who may set
+// the order — POST /goals/reorder's own atom (goal.reorder), or, where Planning
+// is put to a sitting, the right to file the matter (board.item.open). Which of
+// the two a save takes is the decision table's call, read by the screen from the
+// docket's own buildings row; the route the save reaches still decides. Pure.
+const ORDER_PIPS = 12;
+function orderDeskRows(goals, criteria, versionId, mayOrder) {
+  if (!mayOrder || !versionId) return [];
+  const by = new Map();
+  for (const c of criteria || []) {
+    if (c.goal_id == null) continue;
+    const k = String(c.goal_id);
+    if (!by.has(k)) by.set(k, { kept: 0, total: 0 });
+    const e = by.get(k); e.total += 1; if (c.satisfied === true) e.kept += 1;
+  }
+  const mine = (goals || []).filter((g) => g && g.status === 'open' && g.version_id === versionId);
+  if (mine.length < 2) return []; // one goal has no order to set
+  return mine.map((g) => {
+    const e = by.get(String(g.id));
+    const of = e ? Math.min(e.total, ORDER_PIPS) : 0;
+    return {
+      id: g.id, name: String(g.title), ref: { type: 'goal', id: g.id }, set: String(versionId),
+      fact: e ? `${e.kept} of ${e.total} promises kept` : 'no promises yet',
+      facts: [`version ${versionId}`],
+      ...(of ? { pips: { on: Math.min(e.kept, of), of } } : {}),
+      acts: [{ key: 'up' }, { key: 'down' }],
+    };
+  });
+}
+
 // Planning · Versions: what is building, and the last that shipped.
 function versionsFloor(versions, goals) {
   const all = versions || [];
@@ -210,6 +241,26 @@ function signedOffFloor(criteria, now) {
   };
 }
 
+// The Review desk's signed-off rows (task 1004561): the newest promises signed
+// off, each with one act, undo, for a viewer holding criterion.unsatisfy (POST
+// /done-when/:id/unsatisfy's own atom). The reason is one tap. Pure.
+const UNDO_REASONS = Object.freeze([
+  { key: 'broke', label: 'it broke again' },
+  { key: 'untested', label: 'not truly tested' },
+  { key: 'error', label: 'signed in error' },
+]);
+const SIGNED_ROWS = 8;
+function signedDeskRows(criteria) {
+  return (criteria || []).filter((c) => c && c.satisfied === true && c.checked_at)
+    .sort((a, b) => Date.parse(b.checked_at) - Date.parse(a.checked_at))
+    .slice(0, SIGNED_ROWS)
+    .map((c) => ({
+      id: c.id, name: String(c.criterion_md), fact: `signed off ${dayWord(c.checked_at)}`,
+      facts: c.goal_title ? [String(c.goal_title)] : [], ref: { type: 'signed_criterion', id: c.id },
+      acts: [{ key: 'unsign', options: UNDO_REASONS }],
+    }));
+}
+
 // Release · Live this month: shipped work, newest first.
 function liveMonthFloor(shipped, now) {
   const month = (shipped || []).filter((t) => t.shipped_at && Date.parse(t.shipped_at) >= monthStart(now));
@@ -284,6 +335,15 @@ function contributeLifecycleFloors() {
     floor: 'planning.priorities', gate: any,
     read: async (_ctx, { once } = {}) => prioritiesFloor(await openGoals(once), await db.currentBuildingVersionId()),
   });
+  api.contribute(POINT, {
+    desk: 'planning.order', gate: any,
+    read: async (ctx, { once } = {}) => {
+      const may = ctx.has('goal.reorder') || ctx.has('board.item.open');
+      if (!may) return [];
+      const v = await db.currentBuildingVersionId();
+      return orderDeskRows(await openGoals(once), v ? await doneWhen.listCriteria(v) : [], v, may);
+    },
+  });
   api.contribute(POINT, {
     floor: 'planning.versions', gate: any,
     read: async () => versionsFloor(await db.listVersions(), await db.listGoals({})),
@@ -295,6 +355,13 @@ function contributeLifecycleFloors() {
       return signedOffFloor(v ? await doneWhen.listCriteria(v) : [], now);
     },
   });
+  api.contribute(POINT, {
+    desk: 'review.signed', gate: { permission: 'criterion.unsatisfy' },
+    read: async () => {
+      const v = await db.currentBuildingVersionId();
+      return signedDeskRows(v ? await doneWhen.listCriteria(v) : []);
+    },
+  });
   api.contribute(POINT, {
     floor: 'release.live_month', gate: any,
     read: async (_ctx, { now } = {}) => liveMonthFloor(await db.recentShippedTasks(SHIPPED_LIMIT, { days: 31 }), now),
@@ -398,8 +465,10 @@ module.exports = {
   promisesReading,
   goalsFloor,
   prioritiesFloor,
+  orderDeskRows,
   versionsFloor,
   signedOffFloor,
+  signedDeskRows,
   liveMonthFloor,
   heldBackFloor,
   newcomersFloor,

package/modules/lifecycle/matter-acts.js

@@ -0,0 +1,63 @@
+'use strict';
+
+// modules/lifecycle/matter-acts.js — what a PASSED Review or Release matter
+// carries out (task 1004561, goal 1000125). When a project's decision table puts
+// Review or Release to a sitting, its passed matter acts here, after the close
+// commits, through the SAME function the direct route calls:
+//   review  satisfy_criterion → satisfyByOverride   (POST /done-when/:id/satisfy)
+//   release approve_override  → db.decideOverrideRequest (POST /override-requests/:id/decide)
+//   release approve_gate      → approveGatePr       (POST /gate-approvals/:pr/approve)
+// The government module only checks the act's shape and calls in through the
+// 'governor.matterAct' contribution point (a module never requires a sibling).
+// Each act returns { done, reason? }: a refusal the route would give (already
+// decided, not open, owner only) is a reason, never a throw.
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const doneWhen = require('./done-when');
+
+const POINT = 'governor.matterAct';
+const why = (area, ctx) => `A passed ${area} matter (matter ${ctx && ctx.matterId}) decided it.`;
+
+// Required lazily: the route files build routers, and only their shared
+// functions are needed here.
+const routes = {
+  doneWhen: () => require('./routes/done-when'),
+  gate: () => require('./routes/gate-approvals'),
+};
+
+const ACTS = Object.freeze({
+  review: Object.freeze({
+    satisfy_criterion: async (action, ctx) => {
+      const c = await doneWhen.getCriterion(action.criterion_id);
+      if (!c) return { done: false, reason: 'criterion_not_found' };
+      if (c.satisfied === true) return { done: false, reason: 'already_satisfied' };
+      await routes.doneWhen().satisfyByOverride({ criterionId: action.criterion_id, signerId: ctx.decidedBy, reason: why('Review', ctx) });
+      return { done: true };
+    },
+  }),
+  release: Object.freeze({
+    approve_override: async (action, ctx) => {
+      try {
+        await db.decideOverrideRequest({ requestId: action.request_id, archonId: ctx.decidedBy, decision: 'approve', note: why('Release', ctx) });
+        return { done: true };
+      } catch (err) {
+        if (err && err.code === 'REQUEST_NOT_OPEN') return { done: false, reason: 'request_not_open' };
+        if (err && err.code === 'OVERRIDE_OWNER_ONLY') return { done: false, reason: 'override_owner_only' };
+        throw err;
+      }
+    },
+    approve_gate: async (action, ctx) => {
+      const out = await routes.gate().approveGatePr({ number: action.pr, login: `council, matter ${ctx && ctx.matterId}` });
+      return out.ok ? { done: true } : { done: false, reason: out.code };
+    },
+  }),
+});
+
+function contributeLifecycleMatterActs() {
+  for (const [area, acts] of Object.entries(ACTS)) {
+    for (const [type, act] of Object.entries(acts)) api.contribute(POINT, { area, type, act });
+  }
+}
+
+module.exports = { ACTS, contributeLifecycleMatterActs };

package/modules/lifecycle/routes/done-when.js

@@ -25,6 +25,7 @@ const goalEdits = require('../goal-edits.js');
 const uatDb = require('../criterion-uat-db.js');
 const { isReservedCriterionSlug } = require('../criterion-ref.js');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
+const log = api.logger('lifecycle');
 
 // authorizeCriterionCreate — the ORDERED, FAIL-CLOSED decision for a non-Archon
 // POST /versions/:id/done-when (ADR 0154). PURE + exported so every rejection is
@@ -80,6 +81,24 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
   return { ok: true };
 }
 
+// Close a criterion WITHOUT a UAT, on a stated reason: the override row and the
+// flip in ONE transaction (an override row with no flip behind it would claim a
+// close that never happened), then the goal achieves if that was its last
+// criterion (a criterion with no goal completes none). Shared by POST
+// /done-when/:id/satisfy and a passed Review matter (task 1004561,
+// ../matter-acts.js) so the two can never differ.
+async function satisfyByOverride({ criterionId, signerId, reason, taskId = null }) {
+  const updated = await api.withTx(async (client) => {
+    await uatDb.recordOverride(client, { criterionId, signerId, reason });
+    return doneWhen.markCriterion(criterionId, taskId, { client });
+  }, { pool: api.pool });
+  let goalResult = { achieved: false, goal: null };
+  if (updated?.goal_id != null) {
+    goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
+  }
+  return { updated, goalResult };
+}
+
 module.exports = function buildDoneWhenRouter() {
   const router = express.Router();
 
@@ -248,18 +267,7 @@ module.exports = function buildDoneWhenRouter() {
       });
     }
     const taskId = req.body?.satisfied_by_task_id ?? null;
-    // ONE transaction: an override row with no flip behind it would claim a
-    // close that never happened, so the two commit together or not at all.
-    const updated = await api.withTx(async (client) => {
-      await uatDb.recordOverride(client, { criterionId: id, signerId: req.builder.id, reason });
-      return doneWhen.markCriterion(id, taskId, { client });
-    }, { pool: api.pool });
-    // Auto-achieve: confirming a goal's last criterion flips it open→achieved.
-    // A criterion with no goal (goal_id NULL) completes no goal.
-    let goalResult = { achieved: false, goal: null };
-    if (updated?.goal_id != null) {
-      goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
-    }
+    const { updated, goalResult } = await satisfyByOverride({ criterionId: id, signerId: req.builder.id, reason, taskId });
     // BV1.R08 (task 1003595): when the goal did NOT flip because it still holds
     // unfinished work, say so. Confirming the last criterion and getting a bare
     // `goal_achieved: false` back reads as a bug to the agent that just did it —
@@ -466,12 +474,17 @@ module.exports = function buildDoneWhenRouter() {
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).
   // rank: archon — un-flip a criterion; same gate as satisfy.
+  // An optional `reason` (the Review desk's one-tap chip, task 1004561) is
+  // logged beside who undid it; the flip itself is unchanged.
   router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
+    if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 200 } })) return;
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
     const existing = await doneWhen.getCriterion(id);
     if (!existing) return res.fail('criterion_not_found', 404);
     const updated = await doneWhen.unmarkCriterion(id);
+    const why = typeof req.body?.reason === 'string' && req.body.reason.trim() ? `: ${req.body.reason.trim()}` : '';
+    log.info(`[gds] criterion ${id} sign-off UNDONE by builder ${req.builder.id}${why}`);
     res.json({ criterion: updated });
   }, { errorCode: 'unsatisfy_failed' }));
 
@@ -482,3 +495,4 @@ module.exports = function buildDoneWhenRouter() {
 // tests/criterion_authoring_gate.mjs (DB-free), the authorizeGoalTaskCreate
 // precedent in routes/goals.js.
 module.exports.authorizeCriterionCreate = authorizeCriterionCreate;
+module.exports.satisfyByOverride = satisfyByOverride;

package/modules/lifecycle/routes/gate-approvals.js

@@ -141,6 +141,75 @@ function contributeGateApprovalsToDocket() {
   });
 }
 
+// The approval itself, shared by the route above and a passed Release matter
+// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
+// { ok: true, body } or { ok: false, code, status, message }; throws on an
+// unexpected failure (the caller says it). `login` is who approved, as the
+// status description names it.
+async function approveGatePr({ number, login }) {
+  if (!githubPush.isConfigured()) {
+    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
+  }
+  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
+  // so a later commit's head carries no approval — red-team #2b protection).
+  const prs = await githubPush.listOpenPullRequests({});
+  const pr = prs.find((p) => p.number === number);
+  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
+  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
+
+  const gate = findCheck(pr, 'gate-review');
+  if (gate && isSuccess(gate)) {
+    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
+  }
+
+  // 1. Set the trustless owner-approval status on the head sha.
+  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
+  if (!set) {
+    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
+    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
+  }
+
+  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
+  //    required check re-evaluates the new approval; re-arm auto-merge.
+  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
+  //    1004323): clearing the gate check is the owner's act on the PR, and
+  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
+  //    read that throws answers held, and an ordinary confirmed task left
+  //    un-armed still lands through the publish reconciler's sweep.
+  const prTask = taskIdFromPr(pr);
+  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
+  let recheck = { reopened: false, auto_merge: false };
+  try {
+    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
+  } catch (e) {
+    // The status IS set; if the re-trigger failed, the next push or a manual
+    // re-run still clears it, and the publish reconciler sweep merges once green.
+    console.error('[gds] gate-approval recheck failed', e);
+    return {
+      ok: true,
+      body: {
+        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
+        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    body: {
+      ok: true,
+      pr: number,
+      head_sha: pr.head_sha,
+      status_set: true,
+      recheck,
+      held_for_artist: held,
+      message: held
+        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
+        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
+    },
+  };
+}
+
 module.exports = function buildGateApprovalsRouter() {
   contributeGateApprovalsToDocket();
   const router = express.Router();
@@ -189,66 +258,10 @@ module.exports = function buildGateApprovalsRouter() {
   router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), async (req, res) => {
     const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
     if (number == null) return;
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot approve.' });
-    }
     try {
-      // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-      // so a later commit's head carries no approval — red-team #2b protection).
-      const prs = await githubPush.listOpenPullRequests({});
-      const pr = prs.find((p) => p.number === number);
-      if (!pr) return res.fail('pr_not_open', { status: 404, message: `No open PR #${number}.` });
-      if (!pr.head_sha) return res.fail('no_head_sha', { status: 409, message: 'Could not resolve the PR head commit.' });
-
-      const gate = findCheck(pr, 'gate-review');
-      if (gate && isSuccess(gate)) {
-        return res.json({ ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' });
-      }
-
-      // 1. Set the trustless owner-approval status on the head sha.
-      const set = await githubPush.setGateOwnerApproved({
-        sha: pr.head_sha,
-        login: req.builder.github_login,
-        targetUrl: pr.url,
-      });
-      if (!set) {
-        // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see catch).
-        return res.fail('status_set_failed', { status: 500, message: 'Could not set the gate-owner-approved status.' });
-      }
-
-      // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-      //    required check re-evaluates the new approval; re-arm auto-merge.
-      //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-      //    1004323): clearing the gate check is the owner's act on the PR, and
-      //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-      //    read that throws answers held, and an ordinary confirmed task left
-      //    un-armed still lands through the publish reconciler's sweep.
-      const prTask = taskIdFromPr(pr);
-      const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-      let recheck = { reopened: false, auto_merge: false };
-      try {
-        recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-      } catch (e) {
-        // The status IS set; if the re-trigger failed, the next push or a manual
-        // re-run still clears it, and the publish reconciler sweep merges once green.
-        console.error('[gds] gate-approval recheck failed', e);
-        return res.json({
-          ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-          message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-        });
-      }
-
-      res.json({
-        ok: true,
-        pr: number,
-        head_sha: pr.head_sha,
-        status_set: true,
-        recheck,
-        held_for_artist: held,
-        message: held
-          ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-          : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-      });
+      const out = await approveGatePr({ number, login: req.builder.github_login });
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      res.json(out.body);
     } catch (err) {
       console.error('[gds] POST /gate-approvals/:pr/approve', err);
       // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
@@ -261,3 +274,5 @@ module.exports = function buildGateApprovalsRouter() {
 
   return router;
 };
+
+module.exports.approveGatePr = approveGatePr;

package/modules/lifecycle/routes/lifecycle.js

@@ -139,6 +139,8 @@ function registerSeams() {
 module.exports = function buildLifecycleRouter() {
   registerSeams();
   governorDocket.contributeLifecycleToDocket();
+  // what a passed Review or Release matter carries out (task 1004561)
+  require('../matter-acts').contributeLifecycleMatterActs();
   // No HTTP surface — the lifecycle capability is a pure kernel port. The empty
   // router is only the loader's contributes.routes mount vehicle; returning a
   // valid express.Router() keeps mountModuleRoutes' `router.use(sub)` happy

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.35",
+  "version": "1.21.37",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.35",
+      "version": "1.21.37",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.35",
+  "version": "1.21.37",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8970,5 +8970,21 @@
       "id": "1004559",
       "text": "Governing now happens inside the buildings. On a floor's desk you can set a builder's tier, deactivate them, invite someone by GitHub name, give or take back a custom rank; confirm, dispute or mark fixed a security report and"
     }
+  ],
+  "1.21.36": [
+    {
+      "id": "1004561",
+      "text": "Three new governing actions, all in place inside the buildings. In Treasury you can now set each builder's monthly spending limit with one tap. In Review you can undo a sign-off with a one-tap reason. And when a council decide"
+    },
+    {
+      "id": "1004560",
+      "text": "The Planning building now has three working desks on its first floors. Priorities lists the open goals in order with a square for each promise; arrows move a goal up or down, and a save bar (with undo) sets the new order, or,"
+    }
+  ],
+  "1.21.37": [
+    {
+      "id": "1004495",
+      "text": "The hall now looks different in each craft mode. In Artistry, Ideating and Governing the mode button, the current sidebar tab and the top edge of the page take the mode's own colour (moonlight or night ink, gold, city blue), t"
+    }
   ]
 }

package/src/bongos/route-rank-check.js

@@ -194,6 +194,8 @@ const EXPECTED_RANKS = {
   // builder authority — rank + lifecycle status mutation
   'PATCH /builders/:id/rank': 'perm:builder.rank.set',
   'PATCH /builders/:id/status': 'perm:builder.status.set',
+  // task 1004561: the Treasury desk sets a builder's monthly limit through it
+  'PATCH /builders/:id/budget': 'perm:builder.budget.set',
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',

package/src/bongos/routes/builders.js

@@ -205,8 +205,62 @@ function contributeBuilderDesk() {
   });
 }
 
+// The Treasury desk's budget rows (task 1004561): one row per active builder,
+// their monthly spending limit as the fact, and the limits a viewer holding
+// builder.budget.set (PATCH /builders/:id/budget's own atom) may set in one tap.
+// The chip for the limit a builder already has is left off. Pure; exported.
+const BUDGET_CHIPS = Object.freeze([25, 50, 100, 250]);
+function budgetWords(usd) {
+  return usd == null ? 'no limit' : `$${Number(usd).toLocaleString('en-US', { maximumFractionDigits: 2 })} a month`;
+}
+function budgetDeskRows(builders) {
+  return (builders || []).filter(Boolean).map((b) => {
+    const now = b.monthly_budget_usd == null ? null : Number(b.monthly_budget_usd);
+    const options = BUDGET_CHIPS.filter((n) => n !== now).map((n) => ({ key: String(n), label: `$${n} a month` }));
+    if (now !== null) options.push({ key: 'none', label: 'no limit' });
+    return {
+      id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: budgetWords(now),
+      facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder_budget', id: b.id },
+      acts: [{ key: 'budget', options: options.slice(0, 5) }],
+    };
+  });
+}
+// The one write both the route and a passed Treasury matter make.
+async function setMonthlyBudget(builderId, usd) {
+  return seams.resolveOptional('reward').setBuilderMonthlyBudget(builderId, usd);
+}
+function contributeTreasury() {
+  seams.contribute('governor.docket', {
+    desk: 'treasury.budgets',
+    gate: { permission: 'builder.budget.set' },
+    // one read: the active roster and each limit together
+    read: async () => {
+      const { rows } = await pool.query(
+        `SELECT id, github_login, display_name, monthly_budget_usd
+           FROM builders
+          WHERE status = 'active'
+          ORDER BY COALESCE(display_name, github_login)`,
+      );
+      return budgetDeskRows(rows);
+    },
+  });
+  // What a passed Treasury matter carries out, when the decision table puts
+  // Treasury to a sitting: the same write as PATCH /builders/:id/budget.
+  seams.contribute('governor.matterAct', {
+    area: 'treasury',
+    type: 'set_budget',
+    act: async (action, ctx) => {
+      const updated = await setMonthlyBudget(action.builder_id, action.monthly_usd);
+      if (!updated) return { done: false, reason: 'builder_not_found' };
+      log.info(`[gds] builder ${action.builder_id} monthly budget set to ${budgetWords(action.monthly_usd)} by a passed Treasury matter (matter ${ctx && ctx.matterId})`);
+      return { done: true };
+    },
+  });
+}
+
 module.exports = function buildBuildersRouter() {
   contributeBuilderDesk();
+  contributeTreasury();
   const router = express.Router();
 
   // rank: archon — sole chokepoint that mutates builders.rank; ADR 0016 §enforcement.
@@ -361,7 +415,7 @@ module.exports = function buildBuildersRouter() {
       // setBuilderMonthlyBudget carved to modules/economy/ (BV1.R77 / ADR 0093
       // §1-2): resolve the `reward` kernel port (economy is default-on). The
       // archon rank gate on this route is unchanged.
-      const updated = await seams.resolveOptional('reward').setBuilderMonthlyBudget(targetId, budget);
+      const updated = await setMonthlyBudget(targetId, budget);
       if (!updated) return res.fail('builder_not_found', 404);
       res.json({ builder: updated });
     } catch (err) {
@@ -747,3 +801,4 @@ module.exports = function buildBuildersRouter() {
 };
 
 module.exports.builderDeskRows = builderDeskRows;
+module.exports.budgetDeskRows = budgetDeskRows;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.35'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.37'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');