@bongos/core 1.21.92 → 1.21.93

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.92",
-  "core_contract": "1.21.92",
-  "source_commit": "ac78d5a2c74cee8a20316c57da690eddc3570a5b",
+  "core_version": "1.21.93",
+  "core_contract": "1.21.93",
+  "source_commit": "4c275841c75ef2bebdaed532f3b5e57c7a789d90",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T06:43:20.649Z",
+  "built_at": "2026-10-09T07:16:47.997Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 590,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3006,
+    "functional_verbatim": 3008,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3625,
-  "tree_sha256": "66720407767d9b1a1ebe740e2f1ab6fe6e7aab62efd10b5390a61dafba847979",
+  "file_count": 3627,
+  "tree_sha256": "49bb2f826dddbdaabbcfe2ace12bc326ab12234fc2ce4514883ad7aa6ca0e018",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2272,7 +2272,7 @@
     {
       "path": "docs/adr/0363-who-decides-what-is-a-table-changed-only-by-amendment.md",
       "mode": "0000644",
-      "sha256": "4feed5892da4fe2fbe148cdf56edeacd2bf7e6c3886a880a4246811e500e6973"
+      "sha256": "9668a578579f0f38cc24b1eaa3a87a7306f4cf8ef62df64a7938f07c249954e2"
     },
     {
       "path": "docs/adr/0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5807d793684e3ef4b0973dada791efe1edace1ec4f51803ad5688ac32edf612b"
+      "sha256": "63e2775e1139816091d9e9629b5e2b1d16a2862ad7caaacfa817cee89eb90809"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4247,7 +4247,7 @@
     {
       "path": "modules/autonomy/routes/autonomy.js",
       "mode": "0000644",
-      "sha256": "872875e93429b0d7de6b322811a9a86e5698e8bb6717e89bcf769d5fde4ce82b"
+      "sha256": "3def3840ed0dd842fa08ef59df0b6af68d3d44ef33b13b3a2ab83c4a3a82c9ed"
     },
     {
       "path": "modules/autonomy/runner-health.js",
@@ -4927,12 +4927,12 @@
     {
       "path": "modules/government/decision-board.js",
       "mode": "0000644",
-      "sha256": "af3c46850f40b8119bc514c2289d697e9b7c4a6c9fc0c389721600dcfccb2968"
+      "sha256": "d3fbff112e2da86a12498be1b87904071b556c4939525ccf9bc906a66deb8b72"
     },
     {
       "path": "modules/government/decision-rules.js",
       "mode": "0000644",
-      "sha256": "577921791cf32ad8a824f78e534bf26d608eaf32401ed31cc555554bc8e411eb"
+      "sha256": "942304d1b77cc7f428a5f4f2462e28a96accc23de2e081ba7c62d9a8a61f44cf"
     },
     {
       "path": "modules/government/docket-floors.js",
@@ -7297,12 +7297,12 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "7d4e83a96c0c4fc4e3c7cdd8abc0c46607ef7fde28201bad37de72970cf7e26c"
+      "sha256": "22d015052c9d4870491101ad1170f5e784a372de6e49732b39f449dee1cf2b8e"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
       "mode": "0000644",
-      "sha256": "b532f0cc111640d5b7b658b9a465969666129ac9b9144d37a4f2dd5459961b59"
+      "sha256": "7dd64c54a5b35ec849a91361dc5cdc3cba86e0dc102ea283ee86c28caf60efe7"
     },
     {
       "path": "modules/lifecycle/routes/goal-move.js",
@@ -7322,7 +7322,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "88cd70b4b1912c40bb9a40af9dd499f28461175e33a3c0a702ce35d4f805de79"
+      "sha256": "3179f77a1117e54c13d75d7af5248cb28a434e1bcce938fb88b2edbe27cd5aac"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -7352,7 +7352,7 @@
     {
       "path": "modules/lifecycle/routes/project-settings.js",
       "mode": "0000644",
-      "sha256": "069f431d53ff1219d15e81dbf6c6a0e58413b97ba0b116f6113f6e41755b2aca"
+      "sha256": "e892c118488d028f5a0203b5560fb8efa0047e2a4bbac9faafe5ee2132027c54"
     },
     {
       "path": "modules/lifecycle/routes/recommendations.js",
@@ -7387,7 +7387,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "efd442d161d9b212d1e9aa4cad06aa428b1e4c74ac67d22658591ca7c28f2621"
+      "sha256": "564dabb3de1eee96e374160d39f57c61100bca843ebac2b2267aa4693ec5038f"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7397,7 +7397,7 @@
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
-      "sha256": "882403ac8a51cd660b8251c1be7aabefa26688fa78882e71567df1e6e136e365"
+      "sha256": "161c9f5928ff2ba5ec7733e150c8ba86217b428588e2d0322e971c989ce0d71f"
     },
     {
       "path": "modules/lifecycle/routes/visuals.js",
@@ -7602,7 +7602,7 @@
     {
       "path": "modules/npm-release/routes/release.js",
       "mode": "0000644",
-      "sha256": "8f8fa94eafbe428628da850f62e19b845b2098df5392d9028e6e5d30b51c3a56"
+      "sha256": "e1736b4252f720fd2f8d1d42b56e0099fbd3a82f257d96c4aad4ffe8eef982bf"
     },
     {
       "path": "modules/npm-release/routes/task-where.js",
@@ -7682,7 +7682,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "5a498b7b0a5f5b67fdfce415eeafbc54426752360c716451d22d180e3f6e8c54"
+      "sha256": "e54866a2398da3a4f39bd31a9fd122a6045568da1e67c26450121d67456bc769"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -8552,7 +8552,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "109ab7dc8f2662301b9216ed1778d1beaea19a1e2e6e73481f7ba0c6c6fb45ad"
+      "sha256": "48bb22ee49d10e74fd4c01a56f46ca0d19d57eeb3228c1b797e2ba05854b3400"
     },
     {
       "path": "modules/provisioning/routes/demo.js",
@@ -9377,7 +9377,7 @@
     {
       "path": "modules/render-deploy/routes/act.js",
       "mode": "0000644",
-      "sha256": "0d62a8bf0050b680bf0b79b8f6be1748dd39d7ecd23a270eea8f02cfe802d524"
+      "sha256": "8a986f38de7fa3d62b27459d12e1d304344bb1575968a445c483f6e3ca5cf0c1"
     },
     {
       "path": "modules/render-deploy/routes/app.js",
@@ -9517,7 +9517,7 @@
     {
       "path": "modules/security/routes/reports.js",
       "mode": "0000644",
-      "sha256": "f4d0dad797101b9cb23e9d5b20b0bf7caf78eeed6043e93852535fc86eddc3fb"
+      "sha256": "f38c00f7da0106db5a39fb207206276f1c4c8b6ded3b33f25f3c894fc1558fb7"
     },
     {
       "path": "modules/security/routes/scans.js",
@@ -10107,12 +10107,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c6a00151a026a942ae23e1440ee403b96260c9dcb40dd580740391a2f95fd8dc"
+      "sha256": "c5cb988b5bb2255930679a818cdcc5cf278646176ef15bbd2dc113f36698af02"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "18bf0866e76fd3b70f4b5cbfefed40ba4b429abf21bab389306f33b5a5865e75"
+      "sha256": "4e05f7203accb56a762ab83c6ad71a8c91dcf58218665625ae993c3825f13da7"
     },
     {
       "path": "public-docs/index.html",
@@ -10132,7 +10132,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "20f8bfb8624ecfa5e9c42ed12bb663ea6b8590de3213172aae00c415e1c70838"
+      "sha256": "ccf38aea55687532ade59d10785095bc50b266095c37901865b3e7db6777e16f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10702,7 +10702,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "36c3593ea85bafa7d53a5d4a257cdd5748deb7eb3886d4faabfab3cc435be969"
+      "sha256": "0ea1beb8b23148696f9a88cfbca1b303d9299e1e8dc2da21bf86ea21b9d035e0"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -11989,6 +11989,11 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "src/bongos/act-alone.js",
+      "mode": "0000644",
+      "sha256": "5d7f7b434b8aa8ab5782e7902f42b7103a697a71c95cc6f61beb4f3f0ea561f4"
+    },
     {
       "path": "src/bongos/api-errors.js",
       "mode": "0000644",
@@ -12262,7 +12267,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "110b46f7cbb7921dd7144162cb372cb43f8d6c4959cd6c52fc38527995697f0f"
+      "sha256": "0511897ded470ced36f21645685f0757b3c77ad8b8a50e043b05a9b59fff480d"
     },
     {
       "path": "src/bongos/routes/cli-commands.js",
@@ -12392,7 +12397,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ecc4b760892e24a3017377ffe19d6e3a8f5683dda2d1ecaae7e3e52e7bf7f33c"
+      "sha256": "93548f4008e232c69ca994b86cb82c971d7b3830271e28b5251d60e6a958e777"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12912,7 +12917,7 @@
     {
       "path": "tests/autonomy_fence_priority.mjs",
       "mode": "0000644",
-      "sha256": "5bb8707d762967e77100e531fc8914f76d9401393ecbaa354beb31956a133c66"
+      "sha256": "050fb46d4db451ded339caa6de865410ea7a0357688f15d558e25335c83a0d22"
     },
     {
       "path": "tests/autonomy_gate.mjs",
@@ -14284,6 +14289,11 @@
       "mode": "0000644",
       "sha256": "47d5e7db2bdab4504fca424d20588d4b0857e3246cd0376f5e111e6ca409632e"
     },
+    {
+      "path": "tests/government_act_alone_buildings.mjs",
+      "mode": "0000644",
+      "sha256": "22ee46f430e4443cb4946aa27608a442c23599c338602b70f0de602635257f77"
+    },
     {
       "path": "tests/government_board_amendment.mjs",
       "mode": "0000644",
@@ -15672,7 +15682,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "9244fee28297a30d3effb01db58772ccb4ab234d180beaaf14a4bded5f9841f1"
+      "sha256": "9e282a1e2de543831d164a78a160735d37dd956a4751f2d26c74beddc41319cc"
     },
     {
       "path": "tests/module_api_lazy.mjs",
@@ -15937,7 +15947,7 @@
     {
       "path": "tests/npm_release_release.mjs",
       "mode": "0000644",
-      "sha256": "308beb34056741040b24cc954cf3e644f1a0c9f61876b0e5c509996f52780db2"
+      "sha256": "1bf138c9a88e23989255548a6aec0205da7f9c1787dbf872271c1b01575f065c"
     },
     {
       "path": "tests/npm_release_where.mjs",
@@ -17307,7 +17317,7 @@
     {
       "path": "tests/ship_mode.mjs",
       "mode": "0000644",
-      "sha256": "b545f8efbf7ae42b5db2b22e275fac2de65a268e46331bd018b515c69b274f25"
+      "sha256": "aee20a5f6e2998d18f605b91d1eb1019e8ada824135759b29633caa3153d9255"
     },
     {
       "path": "tests/ship_post_land_verify.mjs",

package/docs/adr/0363-who-decides-what-is-a-table-changed-only-by-amendment.md

@@ -47,6 +47,7 @@ The council, tester, lead, trustee, maintainer and treasurer seats are the proje
 ## Consequences
 
 - Owning modules adopt `checkActAlone` on their own direct acts, one at a time: admission and goal join requests (People), goal creation (Planning), report judging (Disputes), settings (Rules), the fence (Automation), criteria (Review), the pin move (Release) and budgets (Treasury). Until then, a row for those buildings decides that building's board matters, and the direct page still decides alone. The docket says so honestly (D6). Widening, where a row lets a seat that does not hold the permission act, is deliberately not done here. It would put the table inside the permission resolver, which is a trust-boundary change of its own.
+- **Done by [task 1004657](https://cloudbongos.com/builders#/task/1004657):** every building's direct routes now ask their row, through one doorway gate, `requireActAlone(area)` (`src/bongos/act-alone.js`), mounted after the permission gate and refusing with D5's exact shape. The routes per building are listed in `decision-rules.js` `AREAS[].acts`, and a test holds that list equal to the source. Three things are never refused: a brake (switching unattended building off, pausing one runner), because stopping must not wait for a meeting; a dry run, which only reads; and a passed matter's own act, which never goes through a route. The charter has no direct route. Goal join-request answers stay with the goal's owner.
 - An objection on a matter still names a Full Idea section (the vote CHECK is unchanged), the same position as a genesis stage.
 - Opening a matter needs `board.item.open` (metic floor). A project where everyone votes still has its matters put up by metics and above.
 - Rejected: a settings route for the table (it would let a rank gate rewrite the government); a separate amendments table (a second pass path to keep in step); storing the rows in the instance config file like the board block (a row must be a database fact the trigger can guard).

package/docs/module-api-changelog.md

@@ -3010,11 +3010,18 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.87 with no explicit bump. run 37888371878. (task 1002620)
   1.21.89 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.88 with no explicit bump. run 37889772259. (task 1002620)
+  (next carrier) — requireActAlone added (task 1004657, goal 1000111; ADR 0363
+        D5). The gate a building's own page mounts after its permission gate:
+        while the project's decision-rules row hands that building to a
+        sitting, one builder acting alone is refused (409 decided_by_sitting).
+        Additive; with no government module it lets every request through.
   1.21.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.89 with no explicit bump. run 37891104032. (task 1002620)
   1.21.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.90 with no explicit bump. run 37892645919. (task 1002620)
   1.21.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.91 with no explicit bump. run 37894940047. (task 1002620)
+  1.21.93 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.92 with no explicit bump. run 37898035856. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/autonomy/routes/autonomy.js

@@ -155,6 +155,15 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // WHO DECIDES AT AUTOMATION (task 1004657; ADR 0363 D5). While the project's
+  // decision-rules row hands Automation to a sitting, these writes refuse one
+  // builder acting alone (409 decided_by_sitting) and point at the matter route;
+  // a passed matter acts through matter-acts.js, never through these routes.
+  // The BRAKE is exempt: switching unattended building off, or pausing one
+  // runner, never waits for a meeting — stopping can only narrow what runs.
+  const isTheBrake = (req) => !!req.body && req.body.enabled === false;
+  const isAPause = (req) => !!req.body && req.body.paused === true;
+
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
   // These five routes ARE the fence. Everything the unattended runner is allowed
@@ -195,7 +204,7 @@ module.exports = function buildAutonomyRouter() {
 
   // The kill switch. Archon, system:true — see the catalog entry for why it is the
   // one permission that cannot be delegated to a custom rank.
-  router.post('/autonomy/fence', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation', { unless: isTheBrake }), async (req, res) => {
     if (validateOrRespond(req, res, {
       enabled: { required: true, type: 'boolean' },
       reason: { type: 'string', maxLength: 500 },
@@ -217,7 +226,7 @@ module.exports = function buildAutonomyRouter() {
   });
 
   // Add a goal to the allowlist.
-  router.post('/autonomy/fence/goals', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence/goals', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     if (validateOrRespond(req, res, {
       goal_id: { required: true },   // number or stringified number; coerced below
       note: { type: 'string', maxLength: 500 },
@@ -237,7 +246,7 @@ module.exports = function buildAutonomyRouter() {
 
   // Revoke one. `removed` distinguishes "just revoked" from "already gone" — an
   // owner clicking Remove deserves to know which happened.
-  router.delete('/autonomy/fence/goals/:goalId', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.delete('/autonomy/fence/goals/:goalId', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     const goalId = Number(req.params.goalId);
     if (!Number.isSafeInteger(goalId) || goalId <= 0) return res.fail('bad_goal_id', 400);
     try {
@@ -255,7 +264,7 @@ module.exports = function buildAutonomyRouter() {
   // first is part of choosing what it may do. The goal must already be on the
   // allowlist (409 otherwise), so a priority can order the list and never widen
   // it. `goal_id: null` clears it.
-  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/fence/priority', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation'), async (req, res) => {
     // Declared with an open rule: the value is a number OR null, which the
     // validator has no type for, so the shape is checked just below.
     if (validateOrRespond(req, res, { goal_id: {} })) return;
@@ -302,7 +311,7 @@ module.exports = function buildAutonomyRouter() {
   // switch. Same atom as the kill switch: stopping a machine is the same act
   // whether it is everyone's or one person's, and the paused builder must not be
   // able to lift it (autonomy.run does not reach this route).
-  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), async (req, res) => {
+  router.post('/autonomy/builders/:builderId/pause', auth.requireBuilder, auth.requirePermission('autonomy.fence.manage'), auth.requireActAlone('automation', { unless: isAPause }), async (req, res) => {
     if (validateOrRespond(req, res, {
       paused: { required: true, type: 'boolean' },
       reason: { type: 'string', maxLength: 500 },

package/modules/government/decision-board.js

@@ -286,13 +286,23 @@ async function openMatter({ area, title, detailMd = null, action = null, propose
 }
 
 // May this builder act ALONE at this building — the check a building's own
-// direct route runs before acting (People's rank assignments today). Resolved
+// direct route runs before acting (People's rank assignments here; every other
+// building's routes through the doorway's requireActAlone, task 1004657 — the
+// list is decision-rules AREAS[].acts). Resolved
 // per request against the live row and the builder's live ranks, uncached.
 // Returns { ok: true } or { ok: false, reason: 'decided_by_sitting', … }.
+//
+// HOT PATH since task 1004657: ~30 write routes across the modules mount this
+// through requireActAlone, so it does ONE query and no file I/O. The board block
+// (loadGovernmentConfig — two synchronous file reads, boot-only by config.js's own
+// rule) only ever shapes the CHARTER row's rule and words, and no direct route
+// asks about the charter; every other building's row reads the same without it.
 async function checkActAlone(area, builderId) {
-  const { board } = loadGovernmentConfig();
+  if (!decisionRules.AREA_KEYS.includes(area)) return { ok: false, reason: 'unknown_area' };
   const rows = await db.listDecisionRules();
-  const resolved = decisionRules.resolveAll(rows, { board }).find((r) => r.area === area);
+  const board = area === 'charter' ? loadGovernmentConfig().board : {};
+  const stored = (rows || []).find((r) => r.area === area) || decisionRules.defaultRow(area);
+  const resolved = decisionRules.resolveRow(stored, { board });
   if (!resolved) return { ok: false, reason: 'unknown_area' };
   if (resolved.as_today) return { ok: true, decided: resolved };
   const seated = resolved.sitting

package/modules/government/decision-rules.js

@@ -44,30 +44,77 @@ const { RANK_ORDER } = require('./catalog');
 // The nine buildings, in street order (held equal to docket-vocab BUILDINGS by
 // test). `gate` is the fixed permission that decides the building's matters
 // today — the atom its own pages require, named so a reader can see what a
-// sitting replaces. `acts` lists the direct acts in THIS module that already
-// defer to the row (task 1004529 wired People's rank assignments); every other
-// building's own pages keep their gate until their owning module adopts
-// `mayActAlone` (the ADR's follow-up list).
+// sitting replaces. `acts` is THE RECORD of every direct route that defers to
+// the building's row: while the row names a sitting, each refuses one builder
+// acting alone (409 decided_by_sitting) and points at the matter route. People's
+// rank assignments ask in this module (task 1004529); every other route mounts
+// the doorway's requireActAlone(area) after its permission gate (task 1004657).
+// tests/government_act_alone_buildings.mjs reads this list against the source
+// both ways, so a route cannot defer without being listed, or be listed without
+// deferring. Which routes are a building's: those gated by its `gate` atom,
+// plus the routes its passed matters act through (decision-board MATTER_ACTIONS)
+// and its docket desks reach. A building with no direct route says so in
+// `no_direct_route` — the charter, whose only act is an amendment.
+// NOT a lone act, so never refused: a BRAKE (switching unattended building off,
+// pausing one runner — stopping never waits for a meeting), a dry run, and a
+// tenant project's own owner moving their own pin (that project's decision).
 const AREAS = Object.freeze([
   Object.freeze({ key: 'charter', name: 'Charter', gate: null,
-    today: 'the board, under the constitution in force', acts: Object.freeze([]) }),
+    today: 'the board, under the constitution in force', acts: Object.freeze([]),
+    no_direct_route: 'the charter is changed only by amending the constitution — POST /government/board/items or /government/board/charter' }),
   Object.freeze({ key: 'rules', name: 'Rules', gate: 'project.settings.manage',
-    today: 'whoever may change the project settings', acts: Object.freeze([]) }),
+    today: 'whoever may change the project settings', acts: Object.freeze([
+      'PATCH /project-settings/rot-days',
+      'PATCH /project-settings/ship-mode',
+      'PATCH /work-categories/:id',
+    ]) }),
   Object.freeze({ key: 'disputes', name: 'Disputes', gate: 'security.report.adjudicate',
-    today: 'whoever may judge reports', acts: Object.freeze([]) }),
+    today: 'whoever may judge reports', acts: Object.freeze([
+      'POST /security/reports/:id/confirm',
+      'POST /security/reports/:id/dispute',
+      'POST /security/reports/:id/fix',
+    ]) }),
   Object.freeze({ key: 'people', name: 'People', gate: 'government.manage',
     today: 'whoever may manage ranks',
-    acts: Object.freeze(['POST /government/assignments', 'DELETE /government/assignments/:builderId/:rankKey']) }),
+    acts: Object.freeze([
+      'POST /government/assignments',
+      'DELETE /government/assignments/:builderId/:rankKey',
+      'PATCH /access-requests/:id',
+      'POST /access-requests/invite',
+    ]) }),
   Object.freeze({ key: 'planning', name: 'Planning', gate: 'goal.create',
-    today: 'whoever may create goals', acts: Object.freeze([]) }),
+    today: 'whoever may create goals', acts: Object.freeze([
+      'POST /goals',
+      'POST /goals/reorder',
+      'POST /work-categories',
+      'PUT /versions/focus',
+    ]) }),
   Object.freeze({ key: 'automation', name: 'Automation', gate: 'autonomy.fence.manage',
-    today: 'whoever may switch unattended building on and off', acts: Object.freeze([]) }),
+    today: 'whoever may switch unattended building on and off', acts: Object.freeze([
+      'POST /autonomy/fence',
+      'POST /autonomy/fence/goals',
+      'DELETE /autonomy/fence/goals/:goalId',
+      'POST /autonomy/fence/priority',
+      'POST /autonomy/builders/:builderId/pause',
+    ]) }),
   Object.freeze({ key: 'review', name: 'Review', gate: 'criterion.satisfy',
-    today: 'whoever may mark work as meeting its checks', acts: Object.freeze([]) }),
+    today: 'whoever may mark work as meeting its checks', acts: Object.freeze([
+      'POST /done-when/:criterionId/satisfy',
+      'POST /done-when/:criterionId/unsatisfy',
+    ]) }),
   Object.freeze({ key: 'release', name: 'Release', gate: 'core.pin.move',
-    today: 'whoever may put a release live', acts: Object.freeze([]) }),
+    today: 'whoever may put a release live', acts: Object.freeze([
+      'POST /gate-approvals/:pr/approve',
+      'POST /override-requests/:id/decide',
+      'POST /provisioning/instances/:id/core-upgrade',
+      'POST /provisioning/instances/:id/update-channel',
+      'POST /render-deploy/act',
+      'POST /npm-release/release',
+    ]) }),
   Object.freeze({ key: 'treasury', name: 'Treasury', gate: 'builder.budget.set',
-    today: 'whoever may set spending limits', acts: Object.freeze([]) }),
+    today: 'whoever may set spending limits', acts: Object.freeze([
+      'PATCH /builders/:id/budget',
+    ]) }),
 ]);
 const AREA_KEYS = Object.freeze(AREAS.map((a) => a.key));
 const areaByKey = (key) => AREAS.find((a) => a.key === key) || null;
@@ -245,6 +292,7 @@ function resolveRow(stored, { board = {} } = {}) {
     gate: def.gate,
     today: def.today,
     acts: def.acts,
+    no_direct_route: def.no_direct_route || null,
     set_by_item_id: row.set_by_item_id == null ? null : String(row.set_by_item_id),
     updated_at: row.updated_at || null,
   });

package/modules/lifecycle/routes/done-when.js

@@ -248,7 +248,7 @@ module.exports = function buildDoneWhenRouter() {
   // everywhere — never as a UAT. The escape hatch stays (an all-abandoned
   // criterion that was met another way still needs one); it is just no longer
   // silent.
-  router.post('/done-when/:criterionId/satisfy', auth.requireBuilder, auth.requirePermission('criterion.satisfy'), asyncHandler('POST /done-when/:criterionId/satisfy', async (req, res) => {
+  router.post('/done-when/:criterionId/satisfy', auth.requireBuilder, auth.requirePermission('criterion.satisfy'), auth.requireActAlone('review'), asyncHandler('POST /done-when/:criterionId/satisfy', async (req, res) => {
     if (validateOrRespond(req, res, {
       satisfied_by_task_id: { type: 'integer', min: 1 },
       override_reason: { type: 'string', maxLength: 2000 },
@@ -476,7 +476,7 @@ module.exports = function buildDoneWhenRouter() {
   // rank: archon — un-flip a criterion; same gate as satisfy.
   // An optional `reason` (the Review desk's one-tap chip, task 1004561) is
   // logged beside who undid it; the flip itself is unchanged.
-  router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
+  router.post('/done-when/:criterionId/unsatisfy', auth.requireBuilder, auth.requirePermission('criterion.unsatisfy'), auth.requireActAlone('review'), asyncHandler('POST /done-when/:criterionId/unsatisfy', async (req, res) => {
     if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 200 } })) return;
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;

package/modules/lifecycle/routes/gate-approvals.js

@@ -255,7 +255,7 @@ module.exports = function buildGateApprovalsRouter() {
   // POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and
   // re-run the gate-review check so it clears. rank: archon (clears the hard floor —
   // pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).
-  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), async (req, res) => {
+  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), auth.requireActAlone('release'), async (req, res) => {
     const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
     if (number == null) return;
     try {

package/modules/lifecycle/routes/goals.js

@@ -83,7 +83,7 @@ module.exports = function buildGoalsRouter() {
   // POST /goals — create a goal.
   // rank: metic+archon — a Metic or Archon may create a goal; creation of a goal
   // whose scope_modules includes a PROTECTED module is Archon-only (in-handler).
-  router.post('/goals', auth.requireBuilder, auth.requirePermission('goal.create'), async (req, res) => {
+  router.post('/goals', auth.requireBuilder, auth.requirePermission('goal.create'), auth.requireActAlone('planning'), async (req, res) => {
     if (validateOrRespond(req, res, {
       version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
       title: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
@@ -239,7 +239,7 @@ module.exports = function buildGoalsRouter() {
   // Mounted BEFORE GET /goals/:id so 'reorder' is never captured as an id.
   // rank: archon — priority is an owner decision, never self-granted by a
   // goal's own member/manager (unlike the goal-authority routes above).
-  router.post('/goals/reorder', auth.requireBuilder, auth.requirePermission('goal.reorder'), async (req, res) => {
+  router.post('/goals/reorder', auth.requireBuilder, auth.requirePermission('goal.reorder'), auth.requireActAlone('planning'), async (req, res) => {
     if (validateOrRespond(req, res, {
       version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
       ordered_ids: { required: true, type: 'array', maxItems: 500, itemsType: 'integer' },
@@ -425,7 +425,7 @@ module.exports = function buildGoalsRouter() {
   // prompt writes into. Same permission as authoring a goal: extending the project's
   // vocabulary is a planning act. A duplicate slug returns the existing row (200),
   // so two people prompted at once converge instead of one being stranded.
-  router.post('/work-categories', auth.requireBuilder, auth.requirePermission('goal.create'),
+  router.post('/work-categories', auth.requireBuilder, auth.requirePermission('goal.create'), auth.requireActAlone('planning'),
     goalCategory.categoryCreateHandler({ validateOrRespond, LIMITS, log }));
   // PATCH /work-categories/:id — body { label?, sort_order?, active? }: rename a
   // category, move it in the order, or stop offering it. The set has been list+add
@@ -440,7 +440,7 @@ module.exports = function buildGoalsRouter() {
   // /goal-create prompt refer to. Deactivating never deletes — goals already carrying
   // a retired category keep a resolvable label.
   router.patch('/work-categories/:id', auth.requireBuilder,
-    auth.requirePermission('project.settings.manage'),
+    auth.requirePermission('project.settings.manage'), auth.requireActAlone('rules'),
     goalCategory.categoryUpdateHandler({ validateOrRespond, LIMITS, parseId, log }));
 
   // PATCH /goals/:id/category — body { category_id } (null clears it). Separate from

package/modules/lifecycle/routes/project-settings.js

@@ -313,7 +313,7 @@ module.exports = function buildProjectSettingsRouter() {
   // first and fitness.js caught it; that is why every gated route in the tree spells
   // its atom inline. (Wrapping the middleware list across lines is fine — the sibling
   // PATCH /work-categories/:id does exactly that and still classifies metic+archon.)
-  router.patch('/project-settings/rot-days', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+  router.patch('/project-settings/rot-days', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
       // STRICT schema first (ADR 0118): it declares the only field this handler reads,
       // so an unknown key is refused through the ADR 0116 envelope instead of being
       // silently dropped. It settles the TYPE; parseDays below settles the RANGE, using
@@ -364,7 +364,7 @@ module.exports = function buildProjectSettingsRouter() {
   // rank: project.settings.manage (metic+, government_010) — the same atom as the
   // other writes on this page. Validated with the resolver's own parser, so the
   // page, the CLI and the reader can never disagree about what a mode is.
-  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), async (req, res) => {
+  router.patch('/project-settings/ship-mode', api.requireBuilder, api.requirePermission('project.settings.manage'), api.requireActAlone('rules'), async (req, res) => {
     if (api.validateOrRespond(req, res, { mode: { required: true, type: 'string' } })) return;
     const parsed = api.projectSettings.parseShipMode(req.body.mode);
     if (!parsed.mode) {

package/modules/lifecycle/routes/tasks.js

@@ -1437,7 +1437,7 @@ module.exports = function buildTasksRouter() {
   // caller; this route only renders its refusal (403 override_owner_only).
   // Approving one confirms nothing and pays nothing — it stops the review holding
   // the DEPLOY and leaves it open on the board.
-  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), async (req, res) => {
+  router.post('/override-requests/:id/decide', auth.requireBuilder, auth.requirePermission('override_request.decide'), auth.requireActAlone('release'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {

package/modules/lifecycle/routes/versions.js

@@ -56,7 +56,7 @@ module.exports = function buildVersionsRouter() {
 
   // rank: archon (atom version.focus.set, system) — body { version_id } sets the focus; { version_id: null } clears it.
   // An unknown version id is refused rather than stored.
-  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), asyncHandler('PUT /versions/focus', async (req, res) => {
+  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), auth.requireActAlone('planning'), asyncHandler('PUT /versions/focus', async (req, res) => {
     if (validateOrRespond(req, res, { version_id: { type: 'string', maxLength: 64 } })) return;
     const raw = (req.body || {}).version_id;
     if (raw === undefined || (raw !== null && !raw.trim())) return res.fail('bad_version_id', { status: 400, message: 'Pick a version to star, or send null to clear the focus.' });

package/modules/npm-release/routes/release.js

@@ -36,6 +36,7 @@ module.exports = function buildNpmReleaseReleaseRouter({
     '/npm-release/release',
     api.requireBuilder,
     api.requirePermission('core.pin.move'),
+    api.requireActAlone('release'),
     async (req, res) => {
       if (api.validateOrRespond(req, res, releaseSchema, { strict: true })) return undefined;
       if (!VERSION_RE.test(req.body.version)) {