@bongos/core 1.21.98 → 1.21.100

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.98",
-  "core_contract": "1.21.98",
-  "source_commit": "e830432e8980019fb401fc5aa8adf72bcca01811",
+  "core_version": "1.21.100",
+  "core_contract": "1.21.100",
+  "source_commit": "8305d0876dae80fcb40694e6ec47fd7a58c39758",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T11:44:35.365Z",
+  "built_at": "2026-10-09T12:41:06.123Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 590,
+    "docs_redacted": 592,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3017,
+    "functional_verbatim": 3019,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3636,
-  "tree_sha256": "10aaec2a3eabaf5dd793204d82ecbfcb2fbc61dfde61a60d2a3d318c3f9503c5",
+  "file_count": 3640,
+  "tree_sha256": "3ffdbef90f1b79435d7c0d64b7ab8ae554d1d7fc99b18c7126a37465763e5a17",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -294,6 +294,11 @@
       "mode": "0000644",
       "sha256": "b151b43139e62a6b71efc49edd447ee0c4b6a95deb42d7a840b851ab79ec4782"
     },
+    {
+      "path": "GOVERNMENT.md",
+      "mode": "0000644",
+      "sha256": "a1e334f7814b8294c460be15ad7f3bad0b7ea5be8e2463c1d7f368a149e5f5c0"
+    },
     {
       "path": "LICENSE",
       "mode": "0000644",
@@ -302,7 +307,7 @@
     {
       "path": "README.md",
       "mode": "0000644",
-      "sha256": "9c9e99127efafe70d60e1d464f07815397e436e69dc0b82c2e67f41dbd8dc8d6"
+      "sha256": "abbf022b58c07144e4ae1d57cde3a232237099c1f37474310d56abae1992c141"
     },
     {
       "path": "bin/bongos.js",
@@ -2309,10 +2314,15 @@
       "mode": "0000644",
       "sha256": "d4963a203bce58f5d5f422bab582e022bf2d2b33eaa854c0ee80b6b76ccff1ee"
     },
+    {
+      "path": "docs/adr/0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md",
+      "mode": "0000644",
+      "sha256": "c23bc85e0e4e925911e7f7c3b2914b8e8dea8db725bd7c8d7840f4dade1f02a6"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "3a58f45b80d4311b5ae5458bc7d564301978b0cf3ba5c72c6244bc1ef6356e89"
+      "sha256": "a010bc0f1d8a26126c5b86c24a4a0e548e038c651909e2b27d5fbdc7cbdd6f94"
     },
     {
       "path": "docs/api-reference.md",
@@ -2862,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7d7a017bb5c1bb3a0af17cd04a2b747a9df2a2fdb26879cb431096eb6d4cf9c0"
+      "sha256": "f69d36a5d32aab16dd006bc16c8117d481064c56528a989997dcb8f516c37daa"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2922,7 +2932,7 @@
     {
       "path": "docs/onboarding/primer.md",
       "mode": "0000644",
-      "sha256": "f347c1355e2f1a71f3170a260a9c7cec719624c47b24ba89a6db371868caefdc"
+      "sha256": "bed8d38e81c9b6cf0b67d589f7e6ab4362034776c651c1a3743d6d98d6f6c8eb"
     },
     {
       "path": "docs/onboarding/slash-commands.md",
@@ -10122,12 +10132,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8430c9bf8e4cfbf413316f9b99f85ddfb2dca688374f65373c3959d3f5d67d1a"
+      "sha256": "989f100357f592179e3bace36ba999890b2f872b511d894606d6815c3c9fffe5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ff69b26fc946bd74d06693048dd4cb7495107d8ee6fef45b45d5c678bce417a5"
+      "sha256": "028cf735e44c50e2e49fae8b3820d9163570c8e56fc324d429b22c8a01236c56"
     },
     {
       "path": "public-docs/index.html",
@@ -10147,7 +10157,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "feedbd41f5e5808a38ee9478e01a5060197e78ea317797cee594931e24aeb8bc"
+      "sha256": "0bd4355a927a990dc4cf27f748792e9c02f5feeb38bb55848aec90258ec95176"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10829,6 +10839,11 @@
       "mode": "0000644",
       "sha256": "320841b1e4df014966ea9b6b70645ecb7915b412f94b8fa0d9835dae5b9446c5"
     },
+    {
+      "path": "scripts/gds/government-walk.js",
+      "mode": "0000644",
+      "sha256": "f7a6091ce0621fdfdf69f667e44e52aaf96f6a1222f52f9e5730ff003e162383"
+    },
     {
       "path": "scripts/gds/grade-correlation-audit.js",
       "mode": "0000644",
@@ -11227,7 +11242,7 @@
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "e698374e1c0709b343202ccd3b336c4fc8b7b9523f7f15291f99cff0f43fd759"
+      "sha256": "d059af3ab3d980229ea02073b69d8281c7dd8526d8a3a1445e89be51cd36fb50"
     },
     {
       "path": "scripts/gds/publish-watch.js",
@@ -12177,7 +12192,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "4a42901ad09df965b0b42ce2cb75c0993adfd49b560b050d99419cba1ccdcaa4"
+      "sha256": "67711bf6dd6becd1edeb6866279a788fd6360a51d013eed77f2592be0aaab01b"
     },
     {
       "path": "src/bongos/module-store.js",
@@ -12417,7 +12432,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7a9984b85013e6be20e59eb846c78da89ea7f62b650aa3f3c7bf9d3fda539e53"
+      "sha256": "b56a3d392b5d31ada22d6c5cf12bb9c39514c4b707d5cb63239a4209b256c648"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14554,6 +14569,11 @@
       "mode": "0000644",
       "sha256": "444f0638dccebc42e5a371820ed565c665d4373c198e1581389ab222bf267c5e"
     },
+    {
+      "path": "tests/government_walk.mjs",
+      "mode": "0000644",
+      "sha256": "35d39431886fb2faad9508dd8ca481987760432397464b1b702aef0451de2270"
+    },
     {
       "path": "tests/governor_docket.mjs",
       "mode": "0000644",

package/GOVERNMENT.md

@@ -0,0 +1,145 @@
+# How government works
+
+> This is about **your project's** government. How Cloud Bongos itself is run is a different file: [`GOVERNANCE.md`](GOVERNANCE.md).
+
+Every project on Cloud Bongos has a government. It answers one question: when something needs deciding, who decides, and how? It's not a theme or a label on a page. It's the rules the server actually checks every time someone tries to do something, so the government you pick is the way your project gets steered. Pick it at the start, change it later by vote, and every change is on the record.
+
+A few words you'll see a lot:
+
+- **Rank**: your standing on the project. There are four built-in ranks. **Archon** is the founder. **Metic** is a trusted builder, a rank you earn by shipping. **Thetes** and **Xenos** are newer builders, with Xenos the newest. You can also make your own ranks, like a council.
+- **Board**: the people who get a vote.
+- **Sitting**: one vote on one thing. It stays open until it closes as **passed** or **returned** (sent back).
+- **Amendment**: a proposal to change the rules. The government you have now decides it, not the one you're proposing.
+
+## The four forms you can pick today
+
+A form is just two settings together: who votes, and how many have to agree.
+
+| Form | Who votes | What passes | Good for |
+|---|---|---|---|
+| **Monarchy / BDFL** ("benevolent dictator for life") | Only the founder | The founder's one yes | A solo start, when there's nobody else to ask. Every project is born one. |
+| **Timocratic Republic** | Trusted builders (Metic) and the founder | Passes unless someone objects | A small team where people earned their say by shipping. |
+| **Direct Democracy** | Every builder | Passes unless someone objects | A flat team where everyone in the room counts. |
+| **Foundation** | A council you name | Passes unless someone objects | A bigger project that wants a small group of trustees looking after it. |
+
+For a Foundation, the council is a rank you create and fill yourself. Make that rank first, then switch.
+
+You can also mix your own settings, like "every builder, more than half". If your mix doesn't match a named form it reads as **Custom**. That's fine. Custom is still the real rules, not a guess at the nearest name.
+
+Three more forms are on the list but **not available yet**: **Presidential** (needs elections), **Cooperative** (needs member shares) and **Federation** (for projects made of many teams).
+
+Not sure? Start as a Monarchy and switch once there's someone to share the calls with.
+
+## The dials
+
+### Who votes
+
+The founder only, trusted builders and up, every builder, or a council you name. Whoever holds the rank gets the vote, and nobody keeps it after they lose the rank. A builder who leaves, or gets moved down, is off the board on their very next request.
+
+### How many must agree
+
+| Rule | What it means | If nobody votes |
+|---|---|---|
+| **One yes is enough** | The first yes decides it. | it passes |
+| **Passes unless someone objects** | A yes doesn't end it. It passes once everyone has voted with no objection. One objection sends it back. | it passes |
+| **More than half** | More than half of **everyone on the board** says yes, not just the people who showed up. 3 of 5 carries it, and a tie isn't a majority. | it's returned |
+| **Everyone agrees** | Everyone who votes says yes, and at least one person does. One objection sends it back straight away. People who don't vote don't block it. | it's returned |
+
+An objection has to come with a reason, so whoever proposed it knows what to fix.
+
+### The voting clock
+
+Your constitution (the written-down settings of your government) can give a sitting a time limit, and a sitting closes early once everyone has voted. Look at the last column above: under the first two rules silence means yes. So a building's vote only gets a clock under "more than half" or "everyone agrees". We won't let a deadline pass something nobody read. Out of the box there's no clock.
+
+Honest note: the clock is built, but the walk below doesn't test a clock running out yet. Every sitting it closes, closes on votes.
+
+### Who decides in each building
+
+Your project's decisions are split into nine **buildings**, one per kind of decision. You'll find them on the street in the hall (`/street`).
+
+| Building | What it covers | Who decides as today |
+|---|---|---|
+| **Charter** | The government itself | Always the board, under the rules in force |
+| **Rules** | Project settings (when work counts as stale, ship mode) and editing work categories | Whoever may change project settings |
+| **Disputes** | Security reports: confirm, dispute, mark fixed | Whoever may judge reports |
+| **People** | Giving and taking custom ranks, access requests, invites | Whoever may manage ranks |
+| **Planning** | Creating and ordering goals, new work categories, the focus version | Whoever may create goals |
+| **Automation** | Unattended building (AI agents working with nobody watching): on or off, which goals, priority, pausing a runner | Whoever may switch it on and off |
+| **Review** | Marking a goal's done-when check as met or not met | Whoever may mark work as meeting its checks |
+| **Release** | Clearing a PR's gate, override requests, putting a new version live, releases and deploys | Whoever may put a release live |
+| **Treasury** | Builders' monthly spending limits | Whoever may set spending limits |
+
+Every building except the Charter is in one of three states:
+
+- **As today.** Whoever holds that building's permission acts alone, from its own page. Every building starts here.
+- **By vote.** You pick who sits (a rank, a rank and everyone above it, or a list of ranks) and how they decide: first yes wins, passes unless someone objects, more than half, everyone agrees, or signed off by someone who didn't build it. Once a building is by vote, nobody can act alone there. Try it and you get refused and pointed at the vote instead.
+- **Empty.** Nobody holds it yet, so its matters wait.
+
+The walk put every building to a vote, tried to act alone on all 28 of their direct actions (every one was refused), then set them back to as today and checked all 28 work again. Two things are built but **not walked yet**: the empty state, and a "decides alone" rule where one seated member can still act by themselves.
+
+## What a vote can actually change
+
+This is the part that matters. A passed vote doesn't just get recorded, it **does the thing**. The vote is the authority, so it acts on its own, not through any one person.
+
+| Building | What a passed vote carries out |
+|---|---|
+| **People** | Gives someone a custom rank, or takes it away |
+| **Automation** | Switches unattended building on or off, or allows a goal to be built unattended |
+| **Release** | Approves an override request, or clears the gate on a PR |
+| **Review** | Signs off a done-when check |
+| **Treasury** | Sets a builder's monthly spending limit |
+
+Two more things the walk proved: a returned vote changes nothing, and someone the building doesn't seat can't vote on its matters.
+
+At **Rules, Disputes and Planning** a vote stops people acting alone, but a passed vote there can't carry out an action by itself yet. That's **later**.
+
+## How to change your government
+
+**1. When you found the project.** Every project is born a Monarchy. At the decide step of founding you pick your form. That pick is filed as your first amendment, and your one yes as founder ratifies it. After that, the five founding stages (scope, strategize, charter, legalize, legislation) are each closed by a vote of the government you picked. Pick a Timocratic Republic and you can't close a stage alone: your trusted builders have to say yes too. A stage with unfinished tasks can't be put to a vote at all. Once all five pass the project comes alive, still governed by your pick.
+
+**2. Any time after: the Charter building.** Open the Charter on the street and hit "change how this works". The forms are one tap each. A Foundation needs its council rank first, and the forms that aren't ready yet are shown as later. Or pick who decides and how by hand. Add a reason and file it. That's an amendment, and your current government votes on it.
+
+**3. Any building, the same way.** "Change how this works" on any building drafts a change to who decides there.
+
+(The picker screens are built. The walk tests the amendments they file, not the screens themselves.)
+
+The rules every amendment follows:
+
+- Your current government decides it.
+- There's no settings page. A passed amendment is the only way the rules change. Even editing the database by hand gets refused.
+- If your change would take away your own vote, it stops and asks you to confirm first.
+- Every attempt, passed or returned, stays on the record.
+
+## What can never be changed, and why
+
+Some things no vote can move, and that's on purpose.
+
+- **The Archon rank.** You can't edit it from the government page, so nobody can click the founder out of their own project.
+- **Pushing to main, touching protected files, and server access.** These are enforced outside the app, by git hooks and audits, not by the database. So no rank can ever be given them, not even by vote. A switch that looked like it granted them would be a switch that does nothing, so we don't show one.
+- **A file can't give anyone power.** Editing `CLAUDE.md`, a config file, your settings or your hooks gets you nothing. The server checks your rank against the live database on every request, with no caching.
+- **Nothing outside a vote changes the constitution.** Not an environment variable and not a hand edit. The only way in is an amendment.
+
+These walls are proven by their own tests. The government walk below doesn't cover them.
+
+## Today vs later
+
+| | Today | Later |
+|---|---|---|
+| **Forms** | Monarchy / BDFL, Timocratic Republic, Direct Democracy, Foundation, and your own Custom mix | Presidential, Cooperative, Federation |
+| **Dials** | Who votes, how many must agree, the voting clock | Veto points (how many separate approvals a big change needs), whether the team can replace its leader by vote, judicial review (who can cancel a decision that breaks the charter), a government that changes as you grow |
+| **What a vote does** | People, Automation, Release, Review, Treasury carry out their actions | An action at Rules, Disputes and Planning; grade appeals; standing rules; votes on treasury spending |
+| **Proof** | The walk, in memory, re-run in CI | The same walk against a real database |
+
+## How we know it works
+
+We don't take our own word for it. There's a walk: one repeatable run over a throwaway test project with six people. It founds the project, closes all five stages, switches through every form, puts every building to a vote and tries to act alone everywhere, then passes every kind of matter and checks the thing actually happened.
+
+**119 checks, 119 pass.** Every request goes through the real code that makes every decision. One honest catch: the storage underneath is an in-memory stand-in for the database. A real-database run is later.
+
+Run it yourself:
+
+```sh
+node scripts/gds/government-walk.js
+```
+
+The full pass/fail table is in [`docs/governance/government-walk.md`](docs/governance/government-walk.md). CI re-runs the walk on every change, so if any row flips, the build goes red.

package/README.md

@@ -6,6 +6,8 @@ Cloud Bongos is free software under the **GNU AGPL-3.0** (see [`LICENSE`](./LICE
 
 > **Provenance.** This core was extracted with fresh history from **Example** — the reference instance, built by Hermeslines, and the first project to run on Cloud Bongos. Example now consumes this core as a pinned dependency, the same shape as any other instance. The extraction is a redacted subtree (no instance secrets, IPs, or private identity); the exact pin — `core_version`, `source_commit`, `tree_sha256` — is recorded in [`.cloudbongos-core.json`](./.cloudbongos-core.json).
 
+**How your project decides things** — who votes, what a vote changes, and how to change your government — is in [`GOVERNMENT.md`](./GOVERNMENT.md).
+
 The durable framing for AI agents — methodology, working rules, session protocol, architecture — lives in [`CLAUDE.md`](./CLAUDE.md). Read it before editing code.
 
 ## What's in here

package/docs/adr/0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md

@@ -0,0 +1,64 @@
+# ADR 0371 — Auto-pickup applies a submitted tweak on the runner, and the artist still approves
+
+- **Status:** accepted
+- **Date:** 2026-10-09
+- **Task:** [task 1004330](https://cloudbongos.com/builders#/task/1004330) (BV2.TW19, goal 1000095, BONGOS-V2)
+- **Builds on:** [ADR 0341](0341-the-page-is-the-unit-of-tweak-mode.md) (Tweak Mode; D7 nothing ships without the artist's approval), [ADR 0307](0307-autobongos-a-deterministic-supervisor-and-agentic-workers.md) (Autobongos: one supervisor, one headless worker per task, a DB fence), [ADR 0369](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) (a live knob in `project_settings` behind one resolver)
+- **Decided with:** the owner, 2026-09-27 ("queue now, auto later") and 2026-10-08 (write the design now, without waiting for the live artist proof, task 1004329)
+
+## Context
+
+In Tweak Mode an artist rewrites a whole page in the studio and presses submit. The round then waits, at `ready` with no claim, until a builder or agent session runs `/tweak` (`modules/copy-desk/skills/tweak/SKILL.md`). That session claims the round, applies the words with `copy-apply.js --batch`, takes before and after renders, commits and runs `ship.js`. A passed grade is then held for the artist (`page-tweak-hold.js`), who approves it in the Approval queue or sends it back.
+
+So an artist with nobody at a terminal waits indefinitely. The task asks for an agent that picks up a submitted page on its own, and names four questions: the trigger, who pays, the loop guard, and the rank it runs at.
+
+Two machines in the core could host it:
+
+- **The agents module** (`modules/agents/`). It fires on events, from the web server, through `claude -p --tools Read`. That spawn lives in grading (`modules/grading/grader-subagent.js`) and is hardcoded read-only, which is why its agents "may only report". Applying a tweak needs file writes, git, a browser for the page reader and renders, and `ship.js`. Widening the grader's spawn is an edit to a protected path, and the web server process has no worktree to write in.
+- **Autobongos** (ADR 0307, `scripts/gds/autobongos-run.js`). A supervisor on a builder's machine claims a task, starts one headless worker in a worktree, and reads the outcome from the ledger. It already writes code, ships through the normal grade, and is bounded by a DB fence (kill switch, goal allowlist, protected paths, a grader-outage stop), a wall clock and a grade cap.
+
+## Decision
+
+**D1 — Auto-pickup is a lane of the Autobongos runner, not an agent.** The runner gains a *tweak lane*. Before it picks ordinary work, it asks for the oldest submitted round and, if the lane is allowed, hands that one page to a worker that runs `/tweak` for it. Everything a person's `/tweak` session does still happens, in the same order, through the same scripts. The worker gains no new power: it runs as the runner's builder, through the claim, grade and land paths every session uses. The agents module stays read-only.
+
+**D2 — The trigger is the runner's own poll, not a new event.** Submit emits nothing today, and nothing needs it to: the runner already wakes on its cadence and reads the ledger. The lane reads the same derived state the studio shows (`open_round.state = 'submitted'` from `modules/copy-desk/page-status.js`), oldest first, so the queue order an artist sees is the order it is worked. A round becomes eligible the moment it is submitted; how soon it is picked up is the runner's cadence, which is stated on the studio rather than promised.
+
+**D3 — It is off until the project turns it on.** A new project setting, `tweak.autopickup` (`off` | `on`, default `off`), in `project_settings` behind one resolver, as ADR 0369 does for `ship.mode`. Any builder can read it, `project.settings.manage` writes it. The lane also needs everything an Autobongos run already needs: the fence's kill switch open, a grader that is up, and a runner some Metic+ builder has chosen to run. The setting replaces only the **goal allowlist** for this lane, because a tweak round lives in whatever goal holds the version's page work and an artist cannot be expected to know which goal to allowlist. It does not replace any other fence rule.
+
+**D4 — It runs at the rank of the builder whose runner it is, and that must be Metic or higher.** There is no new service principal. `/tweak` is Metic+ already (`copy-apply.js` writes a `page-tweak-applied` block, which needs `task.edit`), so a runner below Metic gets the same refusal a person would, and the lane reports it once and stops trying. A bot identity was rejected: `builders.system_role` principals are trusted for identity and never for authorization ([ADR 0033](0033-discord-bot-service-principal.md)), and a new one would be a second way to hold `task.edit` that no person holds.
+
+**D5 — Who pays.** The worker's model time is the runner owner's own capacity, exactly as for any Autobongos task: the gauge keeps the owner's reserve and the wall clock (`DEFAULT_WORKER_TIMEOUT_MS`) bounds one worker. The grade is charged to the project, as every grade is. Because a tweak costs the project a grade without a person choosing to spend it, the lane has its own ceiling: **`tweak.autopickup_monthly_cap`**, a count of rounds the lane may pick up per calendar month (default **20**), counted from the ledger, never from a counter that can drift. The lane claims with an `auto_pickup` mark that the server records on the claim row, and **the server enforces the cap at claim time**: the count and the claim insert run in one transaction under a project-wide advisory lock (`page-tweak/autopickup`), so two runners racing for the last slot cannot both get it. At the cap the claim is refused, the lane stops and the studio says so; rounds wait for a person, as today. The mark is a cost brake on a runner the owner chose to run, not a security boundary: a worker that claimed without it would be claiming as its builder, which that builder may already do by hand. **Why 20:** a grade costs the project a few dollars (the `/tweak` skill's own cost line), so 20 rounds is a bounded, legible monthly spend at about the level of one active artist; the owner can raise it. The cost-plus session reward (ADR 0054) is unchanged: it goes to the builder whose session shipped, as for any worktree claim, and the artist's page credit is untouched (ADR 0341 D10).
+
+**D6 — The loop guard is per round, and the artist is the gate that matters.**
+1. **Nothing lands without the artist.** The held pass (`isHeldForArtist`) is unchanged, so the worst an unattended worker can do is offer the artist a bad render to send back. This is why auto-pickup is safe to have at all.
+2. **Two automatic applies per round, then a person.** A sent-back round returns to `ready` with the artist's note, and the lane may take it again, because the note is the artist's instruction. After the lane has applied a round twice (counted from that round's own claims by the runner), it leaves the round for a person and the studio shows "waiting for a person". The server refuses a third `auto_pickup` claim on the same round, with the same refusal shape as the cap. **Why two:** one apply plus one try at the artist's note; a round sent back twice is a disagreement a person should read, not a third render to approve.
+3. **A failed apply is not retried until the round changes.** `copy-apply.js` exit 2 (nothing applied) or a refused claim releases the round with a note, and the lane skips it until the artist edits or resubmits it (its `updated_at` moves). The runner's existing set-aside and grade cap (one grade plus one re-grade) still apply on top.
+
+**D7 — The fence's other rules are kept, on the page's files.** A round's touches are the page's files from the page inventory. The [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) protected-path matcher and the host-access check run over those exactly as `decideTask` runs them over a task's touches. A page whose files hit a protected path (the shared shell is the likely one) is left for a person, and the studio says why. The lane never edits a file outside the page's own list; a rewrite that needs one is already its own engineer task (`page-tweak-unplaced`).
+
+**D8 — The worker is headless, so `/tweak` gains a non-interactive mode.** Today the skill can stop and ask. The worker cannot. `/tweak --page <page-id> --unattended` takes one named round, never asks, and on any halt (claim refused, nothing applied, ship-check stale, grade unavailable) releases the round with a plain note and exits. It never runs `--skip-grade`, never edits a protected path, and never ships more than the one round it was given.
+
+**Those rules are not left to the worker.** The skill states them; the server holds them, so a worker that ignored its instructions gets refused rather than trusted:
+- **No land without the artist.** A page-tweak round reaches `confirmed` only through the artist's approval (`approveHeldTweak`) or the owner's override request, never through a ship path that skips or bypasses the grade. Task 1004678 pins this with a test over every confirm path, and closes any path that does not hold it.
+- **No file outside the page.** At publish, the server reads the merged change's files itself (`ship-files.js`, not the client's report) and refuses an `auto_pickup` round whose diff touches any file outside that page's inventory list, or a protected path.
+- **One round per claim** is the claim model already: a worktree holds one active claim.
+
+**D9 — The artist can see it happened.** The Approval queue already names who applied a round ("with help from", ADR 0341 / task 1004432). An automatic apply is marked "applied automatically" there and in the studio's queue line, and the project settings page carries the switch and the month's count against the cap.
+
+## Rejected
+
+- **A write-capable agent in `modules/agents/`.** It would need a capability-parametrized spawn in grading (a protected edit) and a worktree, a browser and git inside the web server process. Every guard Autobongos already has would be rebuilt there.
+- **A `page.submitted` event.** Useful only to a host that sleeps between events. The runner polls the ledger, which cannot miss a submit that happened while it was down; an event can.
+- **Landing without the artist when the grade passes.** Contradicts ADR 0341 D7, and it is the artist's approval that makes an unattended apply acceptable.
+- **A per-round dollar cap.** The grade cost is set by the grader, not by the lane. A count of rounds is something the owner can reason about and the ledger can count exactly.
+
+## Consequences
+
+- Built by five tasks in goal 1000095:
+  - [task 1004677](https://cloudbongos.com/builders#/task/1004677) (TW19a): the setting, the claim mark and the server-enforced cap and per-round limit (D3, D5, D6; needs a migration);
+  - [task 1004678](https://cloudbongos.com/builders#/task/1004678) (TW19b): `/tweak --page <id> --unattended` and the server guards under it, after TW19a (D8);
+  - [task 1004679](https://cloudbongos.com/builders#/task/1004679) (TW19c): the runner's tweak lane, after the two above (D1, D2, D4, D6, D7);
+  - [task 1004680](https://cloudbongos.com/builders#/task/1004680) (TW19d): the studio and settings surfaces (D9);
+  - [task 1004681](https://cloudbongos.com/builders#/task/1004681) (TW19e): the live proof, which also waits for the artist proof ([task 1004329](https://cloudbongos.com/builders#/task/1004329)) because it needs a real artist to approve the result.
+- Nothing changes until a project turns `tweak.autopickup` on and a Metic+ builder runs the runner. A project that never does keeps today's queue exactly.
+- An instance with no runner has no auto-pickup. That is deliberate: the core does not run unattended workers in its own server process.

package/docs/adr/README.md

@@ -489,3 +489,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |
 | 0369 | [**Ship mode decides who starts a ship, not how it lands** ([task 1004628](https://cloudbongos.com/builders#/task/1004628), goal 1000106). **D1:** a `ship.mode` project setting, `auto` (the AI ships and lands a finished task with no commands) or `manual` (a person approves each ship), in `project_settings` with no migration. **D2:** Auto is the default, and the resolver reports whether anyone has chosen. **D3:** it is separate from deploy mode (`config/deploy.json`), which decides how a land happens. **D4:** any builder can read it (the AI must know), and `project.settings.manage` writes it, from the settings page or `bongos ship-mode`.](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) | lifecycle / shipping / project settings |
 | 0370 | [**A repo we create for a new project is private** ([task 1004645](https://cloudbongos.com/builders#/task/1004645), goal 1000106). Supersedes ADR 0155 Decision 3: `createUserRepo` sends `private: true`, still not a parameter, and the wizard says the new repo is private. Safe because ADR 0176 already gives a private repo its own read-only deploy key before the first pull; the owner can make it public from the manage page.](0370-a-repo-we-create-is-private.md) | onboarding / security / github |
+| 0371 | [**Auto-pickup applies a submitted tweak on the runner, and the artist still approves** ([task 1004330](https://cloudbongos.com/builders#/task/1004330), goal 1000095, BV2.TW19). **D1:** a tweak lane of the Autobongos runner (ADR 0307), not a write-capable agent: the agents spawn is read-only by construction. **D2:** the trigger is the runner's ledger poll of the oldest `submitted` round, no new event. **D3:** off until a `tweak.autopickup` project setting turns it on; it replaces only the fence's goal allowlist. **D4:** runs as the runner's Metic+ builder, no service principal. **D5:** model time is the runner owner's; grades are the project's, under a monthly round cap (default 20) counted from the ledger. **D6:** the held pass still waits for the artist; two automatic applies per round, then a person; a failed apply waits for the round to change. **D7:** protected-path and host checks run on the page's files. **D8:** `/tweak --unattended`. **D9:** "applied automatically" is shown. Build tasks 1004677–1004681.](0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md) | copy-desk / autonomy / tweak mode |

package/docs/module-api-changelog.md

@@ -3033,5 +3033,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.96 with no explicit bump. run 37920956545. (task 1002620)
   1.21.98 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.97 with no explicit bump. run 37925528587. (task 1002620)
+  1.21.99 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.98 with no explicit bump. run 37927704012. (task 1002620)
+  1.21.100 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.99 with no explicit bump. run 37931583687. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/primer.md

@@ -116,6 +116,7 @@ Other depth, in roughly the order you'll need it:
 - [`docs/architecture.md`](../architecture.md) — live system: droplet, stack, schema, API surface
 - [`docs/modules-contract.md`](../modules-contract.md) — the product is built as a small core plus swappable `modules/<key>/` (the game, Discord, art, and more); this is the live roster and how a task lands inside one
 - [`docs/canonical-permissions.md`](../canonical-permissions.md) — who can do what (rank gates)
+- [`GOVERNMENT.md`](../../GOVERNMENT.md) — how your project's government works and how to change it, in plain words
 - [`docs/file-map.md`](../file-map.md) — where every folder is and what it contains
 - [`docs/recipes/`](../recipes/) — long-form ops gotchas (read before deploying)
 - [`docs/onboarding/diagrams/`](diagrams/) — pan-and-zoom maps of the task lifecycle, rank ladder, the credit economy, the complete architecture (where your work runs and how it reaches production), and versioning

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.98",
+  "version": "1.21.100",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.98",
+      "version": "1.21.100",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.98",
+  "version": "1.21.100",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9422,5 +9422,21 @@
       "id": "1004592",
       "text": "When someone restores a cut task or takes a task back off the board, it now stays put until a person promotes it. Before, the automatic promoter put it straight back on the claimable list within about five minutes."
     }
+  ],
+  "1.21.99": [
+    {
+      "id": "1004330",
+      "text": "The plan for applying an artist's submitted page automatically, with nobody at a terminal, is written and broken into five build tasks. It is off until a project turns it on, it has a monthly limit, and the artist still approv"
+    },
+    {
+      "id": "1004658",
+      "text": "There is now one walk anyone can re-run that tests a project's whole government from start to finish, and a table showing the result. It founds a test project with a chosen government and checks that this government, not the f"
+    }
+  ],
+  "1.21.100": [
+    {
+      "id": "1004659",
+      "text": "There is now a plain-language guide to how a project's government works: GOVERNMENT.md, linked from the README and the hall primer. It explains the four forms you can pick today, who votes and how many must agree, who decides"
+    }
   ]
 }