@bongos/core 1.21.91 → 1.21.93

package/modules/autonomy/routes/autonomy.js

@@ -155,6 +155,15 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // WHO DECIDES AT AUTOMATION (task 1004657; ADR 0363 D5). While the project's
+  // decision-rules row hands Automation to a sitting, these writes refuse one
+  // builder acting alone (409 decided_by_sitting) and point at the matter route;
+  // a passed matter acts through matter-acts.js, never through these routes.
+  // The BRAKE is exempt: switching unattended building off, or pausing one
+  // runner, never waits for a meeting — stopping can only narrow what runs.
+  const isTheBrake = (req) => !!req.body && req.body.enabled === false;
+  const isAPause = (req) => !!req.body && req.body.paused === true;
+
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
   // These five routes ARE the fence. Everything the unattended runner is allowed
@@ -195,7 +204,7 @@ module.exports = function buildAutonomyRouter() {
 
   // The kill switch. Archon, system:true — see the catalog entry for why it is the
   // one permission that cannot be delegated to a custom rank.
-  router.post('/autonomy/fence', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation', { unless: isTheBrake }), async (req, res) => {
     if (validateOrRespond(req, res, {
       enabled: { required: true, type: 'boolean' },
       reason: { type: 'string', maxLength: 500 },
@@ -217,7 +226,7 @@ module.exports = function buildAutonomyRouter() {
   });
 
   // Add a goal to the allowlist.
-  router.post('/autonomy/fence/goals', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence/goals', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     if (validateOrRespond(req, res, {
       goal_id: { required: true },   // number or stringified number; coerced below
       note: { type: 'string', maxLength: 500 },
@@ -237,7 +246,7 @@ module.exports = function buildAutonomyRouter() {
 
   // Revoke one. `removed` distinguishes "just revoked" from "already gone" — an
   // owner clicking Remove deserves to know which happened.
-  router.delete('/autonomy/fence/goals/:goalId', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.delete('/autonomy/fence/goals/:goalId', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     const goalId = Number(req.params.goalId);
     if (!Number.isSafeInteger(goalId) || goalId <= 0) return res.fail('bad_goal_id', 400);
     try {
@@ -255,7 +264,7 @@ module.exports = function buildAutonomyRouter() {
   // first is part of choosing what it may do. The goal must already be on the
   // allowlist (409 otherwise), so a priority can order the list and never widen
   // it. `goal_id: null` clears it.
-  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     // Declared with an open rule: the value is a number OR null, which the
     // validator has no type for, so the shape is checked just below.
     if (validateOrRespond(req, res, { goal_id: {} })) return;
@@ -302,7 +311,7 @@ module.exports = function buildAutonomyRouter() {
   // switch. Same atom as the kill switch: stopping a machine is the same act
   // whether it is everyone's or one person's, and the paused builder must not be
   // able to lift it (autonomy.run does not reach this route).
-  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation', { unless: isAPause }), async (req, res) => {
     if (validateOrRespond(req, res, {
       paused: { required: true, type: 'boolean' },
       reason: { type: 'string', maxLength: 500 },

package/modules/government/decision-board.js

@@ -286,13 +286,23 @@ async function openMatter({ area, title, detailMd = null, action = null, propose
 }
 
 // May this builder act ALONE at this building — the check a building's own
-// direct route runs before acting (People's rank assignments today). Resolved
+// direct route runs before acting (People's rank assignments here; every other
+// building's routes through the doorway's requireActAlone, task 1004657 — the
+// list is decision-rules AREAS[].acts). Resolved
 // per request against the live row and the builder's live ranks, uncached.
 // Returns { ok: true } or { ok: false, reason: 'decided_by_sitting', … }.
+//
+// HOT PATH since task 1004657: ~30 write routes across the modules mount this
+// through requireActAlone, so it does ONE query and no file I/O. The board block
+// (loadGovernmentConfig — two synchronous file reads, boot-only by config.js's own
+// rule) only ever shapes the CHARTER row's rule and words, and no direct route
+// asks about the charter; every other building's row reads the same without it.
 async function checkActAlone(area, builderId) {
-  const { board } = loadGovernmentConfig();
+  if (!decisionRules.AREA_KEYS.includes(area)) return { ok: false, reason: 'unknown_area' };
   const rows = await db.listDecisionRules();
-  const resolved = decisionRules.resolveAll(rows, { board }).find((r) => r.area === area);
+  const board = area === 'charter' ? loadGovernmentConfig().board : {};
+  const stored = (rows || []).find((r) => r.area === area) || decisionRules.defaultRow(area);
+  const resolved = decisionRules.resolveRow(stored, { board });
   if (!resolved) return { ok: false, reason: 'unknown_area' };
   if (resolved.as_today) return { ok: true, decided: resolved };
   const seated = resolved.sitting

package/modules/government/decision-rules.js

@@ -44,30 +44,77 @@ const { RANK_ORDER } = require('./catalog');
 // The nine buildings, in street order (held equal to docket-vocab BUILDINGS by
 // test). `gate` is the fixed permission that decides the building's matters
 // today — the atom its own pages require, named so a reader can see what a
-// sitting replaces. `acts` lists the direct acts in THIS module that already
-// defer to the row (task 1004529 wired People's rank assignments); every other
-// building's own pages keep their gate until their owning module adopts
-// `mayActAlone` (the ADR's follow-up list).
+// sitting replaces. `acts` is THE RECORD of every direct route that defers to
+// the building's row: while the row names a sitting, each refuses one builder
+// acting alone (409 decided_by_sitting) and points at the matter route. People's
+// rank assignments ask in this module (task 1004529); every other route mounts
+// the doorway's requireActAlone(area) after its permission gate (task 1004657).
+// tests/government_act_alone_buildings.mjs reads this list against the source
+// both ways, so a route cannot defer without being listed, or be listed without
+// deferring. Which routes are a building's: those gated by its `gate` atom,
+// plus the routes its passed matters act through (decision-board MATTER_ACTIONS)
+// and its docket desks reach. A building with no direct route says so in
+// `no_direct_route` — the charter, whose only act is an amendment.
+// NOT a lone act, so never refused: a BRAKE (switching unattended building off,
+// pausing one runner — stopping never waits for a meeting), a dry run, and a
+// tenant project's own owner moving their own pin (that project's decision).
 const AREAS = Object.freeze([
   Object.freeze({ key: 'charter', name: 'Charter', gate: null,
-    today: 'the board, under the constitution in force', acts: Object.freeze([]) }),
+    today: 'the board, under the constitution in force', acts: Object.freeze([]),
+    no_direct_route: 'the charter is changed only by amending the constitution — POST /government/board/items or /government/board/charter' }),
   Object.freeze({ key: 'rules', name: 'Rules', gate: 'project.settings.manage',
-    today: 'whoever may change the project settings', acts: Object.freeze([]) }),
+    today: 'whoever may change the project settings', acts: Object.freeze([
+      'PATCH /project-settings/rot-days',
+      'PATCH /project-settings/ship-mode',
+      'PATCH /work-categories/:id',
+    ]) }),
   Object.freeze({ key: 'disputes', name: 'Disputes', gate: 'security.report.adjudicate',
-    today: 'whoever may judge reports', acts: Object.freeze([]) }),
+    today: 'whoever may judge reports', acts: Object.freeze([
+      'POST /security/reports/:id/confirm',
+      'POST /security/reports/:id/dispute',
+      'POST /security/reports/:id/fix',
+    ]) }),
   Object.freeze({ key: 'people', name: 'People', gate: 'government.manage',
     today: 'whoever may manage ranks',
-    acts: Object.freeze(['POST /government/assignments', 'DELETE /government/assignments/:builderId/:rankKey']) }),
+    acts: Object.freeze([
+      'POST /government/assignments',
+      'DELETE /government/assignments/:builderId/:rankKey',
+      'PATCH /access-requests/:id',
+      'POST /access-requests/invite',
+    ]) }),
   Object.freeze({ key: 'planning', name: 'Planning', gate: 'goal.create',
-    today: 'whoever may create goals', acts: Object.freeze([]) }),
+    today: 'whoever may create goals', acts: Object.freeze([
+      'POST /goals',
+      'POST /goals/reorder',
+      'POST /work-categories',
+      'PUT /versions/focus',
+    ]) }),
   Object.freeze({ key: 'automation', name: 'Automation', gate: 'autonomy.fence.manage',
-    today: 'whoever may switch unattended building on and off', acts: Object.freeze([]) }),
+    today: 'whoever may switch unattended building on and off', acts: Object.freeze([
+      'POST /autonomy/fence',
+      'POST /autonomy/fence/goals',
+      'DELETE /autonomy/fence/goals/:goalId',
+      'POST /autonomy/fence/priority',
+      'POST /autonomy/builders/:builderId/pause',
+    ]) }),
   Object.freeze({ key: 'review', name: 'Review', gate: 'criterion.satisfy',
-    today: 'whoever may mark work as meeting its checks', acts: Object.freeze([]) }),
+    today: 'whoever may mark work as meeting its checks', acts: Object.freeze([
+      'POST /done-when/:criterionId/satisfy',
+      'POST /done-when/:criterionId/unsatisfy',
+    ]) }),
   Object.freeze({ key: 'release', name: 'Release', gate: 'core.pin.move',
-    today: 'whoever may put a release live', acts: Object.freeze([]) }),
+    today: 'whoever may put a release live', acts: Object.freeze([
+      'POST /gate-approvals/:pr/approve',
+      'POST /override-requests/:id/decide',
+      'POST /provisioning/instances/:id/core-upgrade',
+      'POST /provisioning/instances/:id/update-channel',
+      'POST /render-deploy/act',
+      'POST /npm-release/release',
+    ]) }),
   Object.freeze({ key: 'treasury', name: 'Treasury', gate: 'builder.budget.set',
-    today: 'whoever may set spending limits', acts: Object.freeze([]) }),
+    today: 'whoever may set spending limits', acts: Object.freeze([
+      'PATCH /builders/:id/budget',
+    ]) }),
 ]);
 const AREA_KEYS = Object.freeze(AREAS.map((a) => a.key));
 const areaByKey = (key) => AREAS.find((a) => a.key === key) || null;
@@ -245,6 +292,7 @@ function resolveRow(stored, { board = {} } = {}) {
     gate: def.gate,
     today: def.today,
     acts: def.acts,
+    no_direct_route: def.no_direct_route || null,
     set_by_item_id: row.set_by_item_id == null ? null : String(row.set_by_item_id),
     updated_at: row.updated_at || null,
   });

package/modules/lifecycle/routes/done-when.js

@@ -248,7 +248,7 @@ module.exports = function buildDoneWhenRouter() {
   // everywhere — never as a UAT. The escape hatch stays (an all-abandoned
   // criterion that was met another way still needs one); it is just no longer
   // silent.
-  router.post('/done-when/:criterionId/satisfy', auth.requireBuilder, auth.requirePermission('criterion.satisfy'), asyncHandler('POST /done-when/:criterionId/satisfy', async (req, res) => {
+  router.post('/done-when/:criterionId/satisfy', auth.requireBuilder, auth.requirePermission('criterion.satisfy'), auth.requireActAlone('review'), asyncHandler('POST /done-when/:criterionId/satisfy', async (req, res) => {
     if (validateOrRespond(req, res, {
       satisfied_by_task_id: { type: 'integer', min: 1 },
       override_reason: { type: 'string', maxLength: 2000 },
@@ -476,7 +476,7 @@ module.exports = function buildDoneWhenRouter() {
   // rank: archon — un-flip a criterion; same gate as satisfy.
   // An optional `reason` (the Review desk's one-tap chip, task 1004561) is
   // logged beside who undid it; the flip itself is unchanged.
-  router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
+  router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), auth.requireActAlone('review'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
     if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 200 } })) return;
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;

package/modules/lifecycle/routes/gate-approvals.js

@@ -255,7 +255,7 @@ module.exports = function buildGateApprovalsRouter() {
   // POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and
   // re-run the gate-review check so it clears. rank: archon (clears the hard floor —
   // pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).
-  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), async (req, res) => {
+  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), auth.requireActAlone('release'), async (req, res) => {
     const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
     if (number == null) return;
     try {

package/modules/lifecycle/routes/goals.js

@@ -83,7 +83,7 @@ module.exports = function buildGoalsRouter() {
   // POST /goals — create a goal.
   // rank: metic+archon — a Metic or Archon may create a goal; creation of a goal
   // whose scope_modules includes a PROTECTED module is Archon-only (in-handler).
-  router.post('/goals', auth.requireBuilder, auth.requirePermission('goal.create'), async (req, res) => {
+  router.post('/goals', auth.requireBuilder, auth.requirePermission('goal.create'), auth.requireActAlone('planning'), async (req, res) => {
     if (validateOrRespond(req, res, {
       version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
       title: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
@@ -239,7 +239,7 @@ module.exports = function buildGoalsRouter() {
   // Mounted BEFORE GET /goals/:id so 'reorder' is never captured as an id.
   // rank: archon — priority is an owner decision, never self-granted by a
   // goal's own member/manager (unlike the goal-authority routes above).
-  router.post('/goals/reorder', auth.requireBuilder, auth.requirePermission('goal.reorder'), async (req, res) => {
+  router.post('/goals/reorder', auth.requireBuilder, auth.requirePermission('goal.reorder'), auth.requireActAlone('planning'), async (req, res) => {
     if (validateOrRespond(req, res, {
       version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
       ordered_ids: { required: true, type: 'array', maxItems: 500, itemsType: 'integer' },
@@ -425,7 +425,7 @@ module.exports = function buildGoalsRouter() {
   // prompt writes into. Same permission as authoring a goal: extending the project's
   // vocabulary is a planning act. A duplicate slug returns the existing row (200),
   // so two people prompted at once converge instead of one being stranded.
-  router.post('/work-categories', auth.requireBuilder, auth.requirePermission('goal.create'),
+  router.post('/work-categories', auth.requireBuilder, auth.requirePermission('goal.create'), auth.requireActAlone('planning'),
     goalCategory.categoryCreateHandler({ validateOrRespond, LIMITS, log }));
   // PATCH /work-categories/:id — body { label?, sort_order?, active? }: rename a
   // category, move it in the order, or stop offering it. The set has been list+add
@@ -440,7 +440,7 @@ module.exports = function buildGoalsRouter() {
   // /goal-create prompt refer to. Deactivating never deletes — goals already carrying
   // a retired category keep a resolvable label.
   router.patch('/work-categories/:id', auth.requireBuilder,
-    auth.requirePermission('project.settings.manage'),
+    auth.requirePermission('project.settings.manage'), auth.requireActAlone('rules'),
     goalCategory.categoryUpdateHandler({ validateOrRespond, LIMITS, parseId, log }));
 
   // PATCH /goals/:id/category — body { category_id } (null clears it). Separate from

package/modules/lifecycle/routes/project-settings.js

@@ -313,7 +313,7 @@ module.exports = function buildProjectSettingsRouter() {
   // first and fitness.js caught it; that is why every gated route in the tree spells
   // its atom inline. (Wrapping the middleware list across lines is fine — the sibling
   // PATCH /work-categories/:id does exactly that and still classifies metic+archon.)
-  router.patch('/project-settings/rot-days', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+  router.patch('/project-settings/rot-days', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
       // STRICT schema first (ADR 0118): it declares the only field this handler reads,
       // so an unknown key is refused through the ADR 0116 envelope instead of being
       // silently dropped. It settles the TYPE; parseDays below settles the RANGE, using
@@ -364,7 +364,7 @@ module.exports = function buildProjectSettingsRouter() {
   // rank: project.settings.manage (metic+, government_010) — the same atom as the
   // other writes on this page. Validated with the resolver's own parser, so the
   // page, the CLI and the reader can never disagree about what a mode is.
-  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
     if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
     const parsed = api.projectSettings.parseShipMode(req.body.mode);
     if (!parsed.mode) {

package/modules/lifecycle/routes/tasks.js

@@ -1437,7 +1437,7 @@ module.exports = function buildTasksRouter() {
   // caller; this route only renders its refusal (403 override_owner_only).
   // Approving one confirms nothing and pays nothing — it stops the review holding
   // the DEPLOY and leaves it open on the board.
-  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), async (req, res) => {
+  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), auth.requireActAlone('release'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {

package/modules/lifecycle/routes/versions.js

@@ -56,7 +56,7 @@ module.exports = function buildVersionsRouter() {
 
   // rank: archon (atom version.focus.set, system) — body { version_id } sets the focus; { version_id: null } clears it.
   // An unknown version id is refused rather than stored.
-  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), asyncHandler('PUT /versions/focus', async (req, res) => {
+  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), auth.requireActAlone('planning'), asyncHandler('PUT /versions/focus', async (req, res) => {
     if (validateOrRespond(req, res, { version_id: { type: 'string', maxLength: 64 } })) return;
     const raw = (req.body || {}).version_id;
     if (raw === undefined || (raw !== null && !raw.trim())) return res.fail('bad_version_id', { status: 400, message: 'Pick a version to star, or send null to clear the focus.' });

package/modules/npm-release/routes/release.js

@@ -36,6 +36,7 @@ module.exports = function buildNpmReleaseReleaseRouter({
     '/npm-release/release',
     api.requireBuilder,
     api.requirePermission('core.pin.move'),
+    api.requireActAlone('release'),
     async (req, res) => {
       if (api.validateOrRespond(req, res, releaseSchema, { strict: true })) return undefined;
       if (!VERSION_RE.test(req.body.version)) {

package/modules/onboarding/routes/access-requests.js

@@ -58,7 +58,7 @@ const express = require('express');
 // core file a module may require, ADR 0083); approval-broadcast travels WITH this
 // admission route (its sole consumer) and is an intra-module require.
 const api = require('../../../src/module-api');
-const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
+const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission, requireActAlone: api.requireActAlone };
 const { pool } = api;
 const { validateOrRespond, parseId, accountExistenceReadRateLimit } = api;
 // A recruit invite's door closes 30 days after it is sent, computed at read time
@@ -486,7 +486,7 @@ module.exports = function buildAccessRequestsRouter() {
   // the SET value. Postgres infers text from the assignment anyway, but no real
   // engine ever executes this statement — there is no integration test for this
   // route and CI has no Postgres — so the type is stated rather than relied on.
-  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), auth.requireActAlone('people'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {
@@ -567,7 +567,7 @@ module.exports = function buildAccessRequestsRouter() {
   // pending request was resolved; 200 already_invited when an invite already
   // stands; 409 already_member when they have an account.
   // rank: archon — the same gate as resolving a request.
-  router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+  router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), auth.requireActAlone('people'), async (req, res) => {
     if (validateOrRespond(req, res, {
       github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
       note: { type: 'string', maxLength: 500 },

package/modules/provisioning/routes/core-upgrade.js

@@ -62,6 +62,15 @@ function contributeCoreDesk() {
   });
 }
 
+// WHO DECIDES AT RELEASE (task 1004657; ADR 0363 D5). The pin move and the
+// update rule are Release's own acts when the PIN door admitted the caller: while
+// the project's decision-rules row hands Release to a sitting, one builder acting
+// alone is refused (409 decided_by_sitting). Not a lone Release act, so never
+// asked: a tenant project's own owner moving THEIR project (ADR 0339 — that
+// project's decision, not this one's), and a dry run, which only reads.
+const notThisProjectsRelease = (req) => req.coreUpgradeAuthority === 'owner';
+const notADecision = (req) => notThisProjectsRelease(req) || (!!req.body && req.body.dry_run === true);
+
 module.exports = function buildCoreUpgradeRouter() {
   contributeCoreDesk();
   const router = express.Router();
@@ -95,6 +104,7 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
     requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    api.requireActAlone('release', { unless: notADecision }),
     makeCoreUpgradeHandler({
       provisioning,
       pool: api.pool,
@@ -130,6 +140,7 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/instances/:id/update-channel',
     api.requireBuilder,
     requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    api.requireActAlone('release', { unless: notThisProjectsRelease }),
     makeUpdateChannelHandler({
       provisioning,
       pool: api.pool,

package/modules/public-landing/public/projects-hall-live.states.json

@@ -32,22 +32,6 @@
           "wait",
           600
         ],
-        [
-          "click",
-          "#termsAck"
-        ],
-        [
-          "wait",
-          100
-        ],
-        [
-          "click",
-          "#wizStart"
-        ],
-        [
-          "wait",
-          400
-        ],
         [
           "fill",
           "#newName",
@@ -62,14 +46,6 @@
           "#f-desc",
           "A co-op farming game where the seasons never repeat."
         ],
-        [
-          "click",
-          "#panel-what button[type=submit]"
-        ],
-        [
-          "wait",
-          400
-        ],
         [
           "select",
           "#physCountry",
@@ -91,13 +67,9 @@
           "click",
           "[data-phys=\"entity\"][data-val=\"intent-solo\"]"
         ],
-        [
-          "click",
-          "#physNext"
-        ],
         [
           "wait",
-          700
+          300
         ],
         [
           "click",
@@ -135,11 +107,11 @@
         ],
         [
           "click",
-          "#reviewGo"
+          "#termsAck"
         ],
         [
           "wait",
-          500
+          100
         ],
         [
           "click",
@@ -159,12 +131,11 @@
           "#panel-done",
           "#wizInvite",
           "#wizInviteWho",
-          "#humanSteps li.cur",
-          "#stepPager",
-          "#stepNext"
+          "#humanSteps"
         ],
         "hidden": [
-          "#hop"
+          "#hop",
+          "#wizParts"
         ],
         "text": [
           [