@bongos/core 1.21.92 → 1.21.93

package/modules/onboarding/routes/access-requests.js

@@ -58,7 +58,7 @@ const express = require('express');
 // core file a module may require, ADR 0083); approval-broadcast travels WITH this
 // admission route (its sole consumer) and is an intra-module require.
 const api = require('../../../src/module-api');
-const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
+const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission, requireActAlone: api.requireActAlone };
 const { pool } = api;
 const { validateOrRespond, parseId, accountExistenceReadRateLimit } = api;
 // A recruit invite's door closes 30 days after it is sent, computed at read time
@@ -486,7 +486,7 @@ module.exports = function buildAccessRequestsRouter() {
   // the SET value. Postgres infers text from the assignment anyway, but no real
   // engine ever executes this statement — there is no integration test for this
   // route and CI has no Postgres — so the type is stated rather than relied on.
-  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), auth.requireActAlone('people'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {
@@ -567,7 +567,7 @@ module.exports = function buildAccessRequestsRouter() {
   // pending request was resolved; 200 already_invited when an invite already
   // stands; 409 already_member when they have an account.
   // rank: archon — the same gate as resolving a request.
-  router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+  router.post('/access-requests/invite', auth.requireBuilder, auth.requirePermission('access_request.review'), auth.requireActAlone('people'), async (req, res) => {
     if (validateOrRespond(req, res, {
       github_login: { required: true, type: 'string', minLength: 1, maxLength: 60 },
       note: { type: 'string', maxLength: 500 },

package/modules/provisioning/routes/core-upgrade.js

@@ -62,6 +62,15 @@ function contributeCoreDesk() {
   });
 }
 
+// WHO DECIDES AT RELEASE (task 1004657; ADR 0363 D5). The pin move and the
+// update rule are Release's own acts when the PIN door admitted the caller: while
+// the project's decision-rules row hands Release to a sitting, one builder acting
+// alone is refused (409 decided_by_sitting). Not a lone Release act, so never
+// asked: a tenant project's own owner moving THEIR project (ADR 0339 — that
+// project's decision, not this one's), and a dry run, which only reads.
+const notThisProjectsRelease = (req) => req.coreUpgradeAuthority === 'owner';
+const notADecision = (req) => notThisProjectsRelease(req) || (!!req.body && req.body.dry_run === true);
+
 module.exports = function buildCoreUpgradeRouter() {
   contributeCoreDesk();
   const router = express.Router();
@@ -95,6 +104,7 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
     requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    api.requireActAlone('release', { unless: notADecision }),
     makeCoreUpgradeHandler({
       provisioning,
       pool: api.pool,
@@ -130,6 +140,7 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/instances/:id/update-channel',
     api.requireBuilder,
     requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    api.requireActAlone('release', { unless: notThisProjectsRelease }),
     makeUpdateChannelHandler({
       provisioning,
       pool: api.pool,

package/modules/render-deploy/routes/act.js

@@ -26,7 +26,7 @@ const log = api.logger('render-deploy');
 module.exports = function buildRenderDeployActRouter({ makeClient = defaultMakeClient, pool } = {}) {
   const router = express.Router();
 
-  router.post('/render-deploy/act', api.requireBuilder, api.requirePermission('core.pin.move'), async (req, res) => {
+  router.post('/render-deploy/act', api.requireBuilder, api.requirePermission('core.pin.move'), api.requireActAlone('release'), async (req, res) => {
     const db = pool || api.pool;
     // Shape only, and strict: an undeclared field is refused. `confirm` and `expectLiveDeployId`
     // are left to the checks below so each gets its own plain refusal rather than a schema one.

package/modules/security/routes/reports.js

@@ -217,6 +217,7 @@ module.exports = function buildSecurityReportsRouter() {
     '/security/reports/:id/confirm',
     api.requireBuilder,
     api.requirePermission('security.report.adjudicate'),
+    api.requireActAlone('disputes'),
     async (req, res) => {
       // drachmae_awarded is OPTIONAL and deliberately UNTYPED here: the handler
       // accepts a number, a stringified number, '' and null alike, and the inline
@@ -256,6 +257,7 @@ module.exports = function buildSecurityReportsRouter() {
     '/security/reports/:id/dispute',
     api.requireBuilder,
     api.requirePermission('security.report.adjudicate'),
+    api.requireActAlone('disputes'),
     async (req, res) => {
       const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
       if (id === null) return;
@@ -281,6 +283,7 @@ module.exports = function buildSecurityReportsRouter() {
     '/security/reports/:id/fix',
     api.requireBuilder,
     api.requirePermission('security.report.adjudicate'),
+    api.requireActAlone('disputes'),
     async (req, res) => {
       const id = parseId(req, res, { code: 'bad_report_id', positiveInt: true });
       if (id === null) return;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.92",
+  "version": "1.21.93",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.92",
+      "version": "1.21.93",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.92",
+  "version": "1.21.93",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9382,5 +9382,11 @@
       "id": "1004648",
       "text": "Starting a project is now one page instead of six screens. After signing in, a founder sees \"Make something.\" with three parts: their project (name, kind, a sentence and four quick checks), a short summary of how it will be ru"
     }
+  ],
+  "1.21.93": [
+    {
+      "id": "1004657",
+      "text": "When a project votes that a part of its government is decided by a group, that vote now holds on every page, not only the People page. Before, someone with the right permission could still switch unattended building on, sign o"
+    }
   ]
 }

package/scripts/gds/fitness.js

@@ -609,6 +609,12 @@ const KERNEL_FILES = [
   // this roster reads as a kernel->non-kernel leak. It imports only node built-ins
   // (https, zlib), so joining costs nothing.
   'src/bongos/package-registry.js',
+  // task 1004657 (ADR 0363 D5): requireActAlone, the gate a building's own page mounts
+  // after its permission gate — the same trust-gate category as auth.js, re-exported
+  // by the doorway, so leaving it off reads as a kernel->non-kernel leak. It imports
+  // only module-seams.js and logger.js (both on this roster) and reaches the
+  // government module through its port, never by require.
+  'src/bongos/act-alone.js',
 ];
 
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a
@@ -641,6 +647,7 @@ const KERNEL_NAMES_MODULES_OK = new Set([
   'src/bongos/auth-github.js',           // ticks the 'onboarding' port on first sign-in
   'src/bongos/auth-idp.js',              // same, on the federated path
   'src/bongos/auth-discord.js',          // the Discord account-link flow itself
+  'src/bongos/act-alone.js',             // resolves the 'government' port by key for checkActAlone (task 1004657)
   'src/bongos/permission-path-check.js', // names module path subtrees to PROTECT them
   'src/bongos/route-rank-check.js',      // names module route dirs to rank-gate them
   'src/role-responsibilities.js',        // the ideator's VERBATIM statement reads "Make good ideas" — the English word, colliding with the `ideas` key. Owner text; unparaphrasable.

package/src/bongos/act-alone.js

@@ -0,0 +1,84 @@
+'use strict';
+
+// src/bongos/act-alone.js — WHO DECIDES WHAT, on every building's own page
+// (task 1004657, goal 1000111; ADR 0363 D5 and its Consequences).
+//
+// WHY. A project's decision-rules table (modules/government/decision-rules.js)
+// can hand a building to a sitting: "Release is decided by the council, by
+// majority". Until this file, only People's own routes asked the table before
+// letting one builder act; every other building's page still let whoever held
+// its permission act alone, so a passed amendment changed the board and not
+// the building. requireActAlone(area) is the one gate those pages mount, AFTER
+// their permission gate, so the permission stays the coarse wall and the row
+// only narrows who may use it alone (never wider — ADR 0363 D5).
+//
+// THE REFUSAL is People's, exactly (modules/government/routes/government.js,
+// peopleMayActAlone): 409 `decided_by_sitting` with { area, rule, who,
+// what_this_means, open_with }, so the hall renders one sentence for every
+// building and the builder is pointed at the sitting (POST
+// /government/board/matters) instead.
+//
+// FAIL DIRECTIONS, mirroring checkActAlone and People:
+//   • no government module, or a port without checkActAlone → AS TODAY (the
+//     route's own permission is the whole gate). A malformed or missing row
+//     already reads as its as-today default inside checkActAlone (D2).
+//   • the table cannot be read at all (checkActAlone throws), or the answer is
+//     not one this gate knows → 503 `decision_rule_unreadable`, fail-CLOSED, as
+//     People does: an unreadable rule never waves a lone act through.
+//
+// A PASSED MATTER IS NOT A LONE ACT. When a sitting passes a matter, the owning
+// module carries it out through its 'governor.matterAct' contribution, which
+// calls the route's underlying write directly (modules/autonomy/matter-acts.js,
+// modules/lifecycle/matter-acts.js, the Treasury act in
+// src/bongos/routes/builders.js) and never passes through this middleware — the
+// sitting is the authority. tests/government_act_alone_buildings.mjs pins that.
+//
+// `unless(req)` exempts a request that is not a decision at all (a dry run that
+// only reads, the owner door of a tenant pin move) or a BRAKE (switching
+// unattended building off, pausing one runner): stopping a machine never waits
+// for a meeting. Pass a named function — the route classifier reads the line.
+//
+// Server-side, per request, uncached (ADR 0016). Core and modules reach the
+// government module only through its port, never by require (ADR 0083).
+
+const seams = require('../module-seams');
+const log = require('./logger').logger.child({ src: 'act-alone' });
+
+function logError(message) {
+  try {
+    log.error(message);
+  } catch (_) { /* logging must never decide a request */ }
+}
+
+function requireActAlone(area, { unless = null } = {}) {
+  if (typeof area !== 'string' || area.length === 0) {
+    throw new TypeError('requireActAlone(area): name the building whose row decides this route');
+  }
+  if (unless !== null && typeof unless !== 'function') {
+    throw new TypeError('requireActAlone(area, { unless }): unless must be a function of the request');
+  }
+  return async function actAloneGate(req, res, next) {
+    if (unless && unless(req) === true) return next();
+    const government = seams.resolveOptional('government');
+    if (!government || typeof government.checkActAlone !== 'function') return next();
+    let out;
+    try {
+      out = await government.checkActAlone(area, req.builder && req.builder.id);
+    } catch (err) {
+      logError(`${area} decision rule unreadable: ${err && err.message}`);
+      return res.fail('decision_rule_unreadable', { status: 503, message: `who decides at ${area} could not be read just now` });
+    }
+    if (out && out.ok === true) return next();
+    if (!out || out.reason !== 'decided_by_sitting') {
+      // unknown_area is a wiring bug in the route, not a fact about the caller.
+      logError(`requireActAlone('${area}') got ${out && out.reason} — refusing fail-closed`);
+      return res.fail('decision_rule_unreadable', { status: 503, message: `who decides at ${area} could not be read just now` });
+    }
+    return res.fail('decided_by_sitting', 409, {
+      area: out.area, rule: out.rule, who: out.who,
+      what_this_means: out.what_this_means, open_with: out.open_with,
+    });
+  };
+}
+
+module.exports = { requireActAlone };

package/src/bongos/routes/builders.js

@@ -26,6 +26,11 @@ const path = require('node:path');
 const { execFile } = require('node:child_process');
 const express = require('express');
 const auth = require('../auth');
+// WHO DECIDES AT TREASURY (task 1004657; ADR 0363 D5): the budget write refuses a
+// lone act while Treasury's decision-rules row names a sitting. A passed Treasury
+// matter sets the limit through setMonthlyBudget directly (the governor.matterAct
+// below), never through the route, so the sitting is never refused by its own gate.
+const { requireActAlone } = require('../act-alone');
 const db = require('../db');
 const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81 / ADR
@@ -398,7 +403,7 @@ module.exports = function buildBuildersRouter() {
   // rank: archon — changes another builder's cost ceiling. NOT ownership-scoped:
   // archon-only admin op. Gate: requirePermission('builder.budget.set') — BV1.R104;
   // the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).
-  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requirePermission('builder.budget.set'), async (req, res) => {
+  router.patch('/builders/:id/budget', auth.requireBuilder, auth.requirePermission('builder.budget.set'), requireActAlone('treasury'), async (req, res) => {
     const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
     if (targetId === null) return;
     if (validateOrRespond(req, res, { monthly_budget_usd: {} })) return;  // number ≥0, or null to clear; validated below

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.92'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.93'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -133,6 +133,12 @@ module.exports = {
   //     the equivalent requireRank admitted, so a migrated module route is
   //     behaviour-identical (BV1.R105).
   get requirePermission() { return require('./bongos/auth').requirePermission; },
+  // requireActAlone(area, { unless }) — WHO DECIDES WHAT on a building's own
+  //     page (task 1004657; ADR 0363 D5). Mounted AFTER the route's permission
+  //     gate: while the project's decision-rules row hands that building to a
+  //     sitting, one builder acting alone is refused (409 decided_by_sitting,
+  //     pointing at the matter route). No government module → as today.
+  get requireActAlone() { return require('./bongos/act-alone').requireActAlone; },
   get rankMeetsThreshold() { return require('./bongos/auth').rankMeetsThreshold; },
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
   // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside

package/tests/autonomy_fence_priority.mjs

@@ -64,8 +64,10 @@ test('POST /autonomy/fence/priority sits behind the same owner-only atom as the
   const layer = router.stack.find((l) => l.route && l.route.path === '/autonomy/fence/priority');
   assert.ok(layer, 'the route is registered');
   assert.equal(layer.route.methods.post, true);
-  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack.length, 4, 'requireBuilder + requirePermission + requireActAlone + handler');
   assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.fence.manage');
+  // task 1004657: Automation's decision rule is asked after the permission gate.
+  assert.equal(layer.route.stack[2].handle.name, 'actAloneGate');
 });
 
 test('the route sets, clears, and refuses a goal that is not allowlisted', async () => {