@bongos/core 1.23.21 → 1.24.1

package/modules/economy/routes/cost.js

@@ -20,20 +20,38 @@ const express = require('express');
 // intra-module require — a module never requires a core internal.
 const api = require('../../../src/module-api');
 const cost = require('../cost');
+const { checkCostWrite, MAX_ROW_USD } = require('../cost-write-guard');
 const { validateOrRespond, LIMITS } = api;
 
 const COST_CATEGORIES = ['api', 'compute', 'infra', 'domain', 'art', 'other'];
 
-module.exports = function buildCostRouter() {
+// Has this builder ever claimed this task? A released claim still counts: a
+// session's cost lands after its ship frees the claim (task 1004959). Served by
+// idx_claims_task_all (claims (task_id), core_263): a task carries a handful of
+// claims ever, so the builder_id filter runs over those rows, never the table.
+async function builderHasClaimed(taskId, builderId) {
+  const { rows } = await api.pool.query(
+    'SELECT 1 FROM claims WHERE task_id = $1 AND builder_id = $2 LIMIT 1',
+    [taskId, builderId],
+  );
+  return rows.length > 0;
+}
+
+// deps.logCost / deps.hasClaimed are test seams; production uses the real ones.
+module.exports = function buildCostRouter(deps = {}) {
   // The Treasury's floors and record in the Governor City (task 1004527).
   require('../governor-docket').contributeEconomyToDocket();
   const router = express.Router();
+  const logCost = deps.logCost || ((...a) => cost.logCost(...a));
+  const hasClaimed = deps.hasClaimed || builderHasClaimed;
 
   // rank: any-builder — log cost on own claim (idempotent via source/source_ref).
+  // Who may book what (reserved sources, the caller's own task, the per-row cap)
+  // is cost-write-guard.js — security report 1000029.
   router.post('/cost', api.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       task_id: { type: 'integer', min: 1 },
-      amount_usd: { required: true, type: 'number', min: 0, max: 1000000 },
+      amount_usd: { required: true, type: 'number', min: 0, max: MAX_ROW_USD },
       // Don't enum-restrict category — the existing skills set categories that
       // may legitimately drift; just cap the length. (CLAUDE.md mentions
       // api|compute|infra|domain|art|other as the canonical set.)
@@ -45,10 +63,10 @@ module.exports = function buildCostRouter() {
       // System 1 / task 1344: optional per-tier USD split (cost_log columns
       // added by migration 123). session-cost.js sends these so spend can be
       // attributed by tier (cache_read is the marathon sink). Omitted → NULL.
-      fresh_input_usd: { type: 'number', min: 0, max: 1000000 },
-      cache_read_usd: { type: 'number', min: 0, max: 1000000 },
-      cache_write_usd: { type: 'number', min: 0, max: 1000000 },
-      output_usd: { type: 'number', min: 0, max: 1000000 },
+      fresh_input_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      cache_read_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      cache_write_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
+      output_usd: { type: 'number', min: 0, max: MAX_ROW_USD },
       // V3.R11 (#91): builder_id is optional. When absent we default to the
       // authed builder (the right answer 99% of the time). When provided it
       // must match the authed builder — we don't let one builder attribute
@@ -85,7 +103,15 @@ module.exports = function buildCostRouter() {
       recordedAtDate = parsed;
     }
     try {
-      const out = await cost.logCost({
+      const refused = await checkCostWrite({
+        source,
+        taskId: taskId ?? null,
+        rank: req.builder?.rank,
+        rankMeets: api.rankMeetsThreshold,
+        callerHasClaimed: (id) => hasClaimed(id, authedBuilderId),
+      });
+      if (refused) return res.fail(refused.code, { status: refused.status, message: refused.message });
+      const out = await logCost({
         taskId: taskId ?? null,
         amountUsd,
         category,

package/modules/government/catalog.js

@@ -238,6 +238,12 @@ const PERMISSIONS = [
   // Review the store's proposed sub-categories (task 1004355, ADR 0342 D3): approve,
   // rename then approve, or merge into an existing one (a merge moves its modules).
   { key: 'module.subcategory.review', system: false, floor: 'metic', guards: 'GET /store/subcategories/queue, POST /store/subcategories/:id/approve, POST /store/subcategories/:id/merge' },
+  // The project's authorised person for money (task 1004913, ADR 0385 D4): sign,
+  // narrow or revoke a standing payout rule, hold a noticed run, approve one payout,
+  // sign one equity grant or contract, and read the approval log. Archon by default;
+  // not a system key, so a project may hand it to a treasurer rank of its own. The
+  // routes additionally refuse anything but a person's own web session.
+  { key: 'payout.approve', system: false, floor: 'archon', guards: 'GET /payouts/approvals, GET /payouts/rules, POST /payouts/rules[/:id/{narrow,revoke,runs,runs/:runKey/hold}], POST /payouts/{approve,grants,contracts}' },
   // Take a module out of the store (task 1003797, ADR 0338 D2). Stops new installs,
   // versions and downloads; never reaches an instance that already holds it.
   { key: 'module.delist', system: false, floor: 'metic', guards: 'POST /store/modules/:key/delist, POST /store/modules/:key/versions/:version/release (a version the promotion gate held on tester — task 1003804), POST /store/modules/:key/versions/:version/withdraw (take a version back — task 1004895)' },

package/modules/government/db.js

@@ -169,6 +169,79 @@ async function grantRankPermission({ rankKey, permissionKey }) {
   return rowCount > 0;
 }
 
+// Add a recommended rank set in ONE transaction and three statements (task
+// 1004929) — the batched form of "createRank, then grantRankPermission per key",
+// which used to cost a read, an insert and one insert per grant for every rank,
+// each its own round trip and none of them atomic. A rank that already exists is
+// LEFT ALONE: it is neither inserted nor granted, and a rank a concurrent call
+// created between the read and the insert is caught by ON CONFLICT DO NOTHING —
+// the batched twin of the old per-row 23505 catch. Grants go only to the ranks
+// THIS call created. Still a dumb write: `permissionKeys` arrive screened against
+// the catalog by the route (routes/government.js), which owns that decision.
+//
+// `ranks`: [{ rankKey, label, description, permissionKeys }], in set order.
+// Returns a Map of rank_key → the permission keys actually granted, in input
+// order, for each rank this call created; a key absent from the Map was skipped.
+async function applyRankSet({ ranks, createdBy }) {
+  const firstByKey = new Map();
+  for (const r of ranks) if (!firstByKey.has(r.rankKey)) firstByKey.set(r.rankKey, r);
+  const wanted = [...firstByKey.values()];
+  const created = new Map();
+  if (wanted.length === 0) return created;
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows: existing } = await client.query(
+      `SELECT rank_key FROM government_ranks WHERE rank_key = ANY($1::text[])`,
+      [wanted.map((r) => r.rankKey)],
+    );
+    const have = new Set(existing.map((row) => row.rank_key));
+    const fresh = wanted.filter((r) => !have.has(r.rankKey));
+    if (fresh.length > 0) {
+      // WITH ORDINALITY + ORDER BY keeps the ids in set order, as the loop did.
+      const { rows: inserted } = await client.query(
+        `INSERT INTO government_ranks (rank_key, label, description, is_system, seeded_rank, created_by)
+         SELECT r.rank_key, r.label, r.description, false, NULL, $4::bigint
+           FROM unnest($1::text[], $2::text[], $3::text[]) WITH ORDINALITY AS r(rank_key, label, description, ord)
+          ORDER BY r.ord
+         ON CONFLICT DO NOTHING
+         RETURNING rank_key`,
+        [fresh.map((r) => r.rankKey), fresh.map((r) => r.label), fresh.map((r) => r.description ?? null), createdBy],
+      );
+      const made = new Set(inserted.map((row) => row.rank_key));
+      const grantRanks = [];
+      const grantKeys = [];
+      for (const r of fresh) {
+        if (!made.has(r.rankKey)) continue;
+        created.set(r.rankKey, []);
+        for (const key of new Set(r.permissionKeys)) { grantRanks.push(r.rankKey); grantKeys.push(key); }
+      }
+      if (grantKeys.length > 0) {
+        const { rows: granted } = await client.query(
+          `INSERT INTO government_rank_permissions (rank_key, permission_key)
+           SELECT g.rank_key, g.permission_key
+             FROM unnest($1::text[], $2::text[]) WITH ORDINALITY AS g(rank_key, permission_key, ord)
+            ORDER BY g.ord
+           ON CONFLICT (rank_key, permission_key) DO NOTHING
+           RETURNING rank_key, permission_key`,
+          [grantRanks, grantKeys],
+        );
+        const landed = new Set(granted.map((row) => `${row.rank_key}\u0000${row.permission_key}`));
+        grantRanks.forEach((rk, i) => {
+          if (landed.has(`${rk}\u0000${grantKeys[i]}`)) created.get(rk).push(grantKeys[i]);
+        });
+      }
+    }
+    await client.query('COMMIT');
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+  }
+  return created;
+}
+
 async function revokeRankPermission({ rankKey, permissionKey }) {
   const { rowCount } = await pool.query(
     `DELETE FROM government_rank_permissions
@@ -356,9 +429,26 @@ async function openBoardItem({ subjectType, subjectId, openedBy = null, constitu
      RETURNING *`,
     [subjectType, subjectId, openedBy, windowMinutes, JSON.stringify(constitution || {})],
   );
+  // Tell the expiry poller (task 1004960): it sleeps until the soonest deadline
+  // it knows of, so a window shorter than its idle wait must wake it sooner.
+  // closes_at is now() + the window, so the window IS the time until close.
+  // A listener the poller registers (not a require: the poller requires this
+  // file). Never let a hint fail an open.
+  if (rows[0] && windowMinutes != null) {
+    for (const fn of deadlineListeners) {
+      try { fn(Number(windowMinutes) * 60_000); } catch (_) { /* best-effort */ }
+    }
+  }
   return rows[0] || null;
 }
 
+// Who wants to hear that a timed window opened (the expiry poller's start()).
+const deadlineListeners = new Set();
+function onBoardDeadline(fn) {
+  deadlineListeners.add(fn);
+  return () => deadlineListeners.delete(fn);
+}
+
 async function getOpenBoardItem(subjectType, subjectId) {
   const { rows } = await pool.query(
     `SELECT * FROM government_board_items
@@ -1041,6 +1131,21 @@ async function getExpiredOpenBoardItems(limit = 100) {
   return rows;
 }
 
+// The expiry poller's alarm clock (task 1004960): how many milliseconds until
+// the soonest OPEN deadline, measured on the DATABASE clock (so a skewed
+// process clock can never make the poller wake early or late), or null when no
+// open item has a clock. ONE read, served by the same partial index as the
+// sweep — the poller sleeps until this deadline instead of asking every minute.
+async function msUntilSoonestOpenDeadline() {
+  const { rows } = await pool.query(
+    `SELECT EXTRACT(EPOCH FROM (MIN(closes_at) - now())) * 1000 AS ms
+       FROM government_board_items
+      WHERE closed_at IS NULL AND closes_at IS NOT NULL`,
+  );
+  const ms = rows[0] ? rows[0].ms : null;
+  return ms == null ? null : Number(ms);
+}
+
 // The summons read (task 1003271): every OPEN item this builder could still
 // vote on, with the two facts that decide it — who authored the subject, and
 // whether this builder has already cast. Membership is NOT decided here: it
@@ -1165,6 +1270,7 @@ module.exports = {
   getRankByKey,
   createRank,
   grantRankPermission,
+  applyRankSet,
   revokeRankPermission,
   resetRankGrants,
   deleteCustomRank,
@@ -1186,6 +1292,8 @@ module.exports = {
   withdrawBoardItem,
   getIdeaCompleteness,
   getExpiredOpenBoardItems,
+  msUntilSoonestOpenDeadline,
+  onBoardDeadline,
   getLatestReturnedItemWithObjection,
   getLatestPassedItem,
   listPassedSubjectIds,

package/modules/government/docket.js

@@ -85,6 +85,7 @@ const docketFloors = require('./docket-floors');
 const governmentConfig = require('./config');
 const asksDb = require('./asks-db');
 const routing = require('./routing');
+const waiting = require('./waiting');
 const { ownerOf } = require('./leads');
 
 const log = api.logger('government');
@@ -847,6 +848,40 @@ async function loadSeats(government) {
   }
 }
 
+// OPEN BLOCKERS UNDER THE PEOPLE THEY WAIT ON (task 1004999). The blockers source is
+// read exactly as the docket reads it (the ideas module's contribution, under its own
+// `anyBuilder` gate — the list is public), each one carries its stored ask, and the
+// seats are read once, uncached (ADR 0016). waiting.js groups them with routing.js's
+// rule, so this answers "whose is it" exactly as the City does. A board seat's holders
+// are read only when some blocker names one. → { available, people, nobody, yours }
+// `available: false` names why nothing could be grouped — never an empty list
+// standing in for "nobody is waiting".
+async function blockersByPerson(builder, { contributions = registeredContributions(), now = Date.now(), timeoutMs = SOURCE_TIMEOUT_MS } = {}) {
+  const c = contributions.sources.get('blockers');
+  if (!c) return { available: false, reason: 'off', people: [], nobody: [], yours: waiting.forViewer(null, builder.id) };
+  const permissions = await resolver.resolveBuilderPermissions(builder.id);
+  const held = new Set(permissions || []);
+  const ctx = Object.freeze({ builderId: String(builder.id), rank: builder.rank || null, has: (p) => held.has(p) });
+  if (!gateAllows(c.gate, ctx)) return { available: false, reason: 'not_yours', people: [], nobody: [], yours: waiting.forViewer(null, builder.id) };
+  let matters;
+  try {
+    const raw = await withTimeout(Promise.resolve(c.read(ctx, { now })), timeoutMs);
+    matters = (Array.isArray(raw) ? raw : []).map((m) => normalizeMatter(m, { source: 'blockers', building: c.building || 'planning' })).filter(Boolean);
+  } catch (err) {
+    log.warn({ err: err && err.message }, 'blockers by person: blockers unreadable');
+    return { available: false, reason: 'unavailable', people: [], nobody: [], yours: waiting.forViewer(null, builder.id) };
+  }
+  await attachAsks(matters, asksDb.asksFor, timeoutMs);
+  const boardSeat = matters.some((m) => /^board:/.test(routing.seatOf(m)));
+  const government = boardSeat
+    ? await loadGovernment({ decisions: await board.decisionRulesView().catch(() => null) })
+    : { holders: {} };
+  const seats = await loadSeats(government);
+  if (!seats) return { available: false, reason: 'unavailable', people: [], nobody: [], yours: waiting.forViewer(null, builder.id) };
+  const grouped = waiting.groupByPerson(matters, seats);
+  return { available: true, ...grouped, yours: waiting.forViewer(grouped, builder.id) };
+}
+
 // One matter with its stored ask and the seats, for passing it on to `toSeat`
 // (task 1004705): → { matter, seats } | { reason } as findMatter answers. A
 // board's holders are read only when a board seat is involved.
@@ -927,5 +962,6 @@ module.exports = {
   findMatter,
   findMatterFor,
   loadSeats,
+  blockersByPerson,
   matterWithSeats,
 };

package/modules/government/migrations/government_035_payout_approve.sql

@@ -0,0 +1,29 @@
+-- government_035_payout_approve.sql — grant the new `payout.approve` atom to
+-- Archon (task 1004913, goal 1000092 N9; ADR 0385 D4).
+--
+-- WHAT IT IS. The project's authorised person for money: signs a standing payout
+-- rule, narrows or revokes it, holds a run in its pause window, approves a single
+-- payout, signs an equity grant or a contract, and reads the approval log
+-- (core_283_payout_approvals). The routes also demand the person's own web
+-- session, so holding the atom on a CLI token is not enough to sign.
+--
+-- WHY THIS FILE EXISTS. RANK_SEED is derived from the catalog's floors, and the
+-- drift guard (tests/government_seed.mjs) compares it against the union of the
+-- run-once seed plus every later grant migration, per rank. An archon-floor key
+-- is held by archon only.
+--
+-- Additive only: one new permission key granted to one rank; nothing is revoked.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'payout.approve'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/government/pollers/board-expiry.js

@@ -19,17 +19,32 @@
 // minute-cadence poller logging every tick would bury the journal (the
 // reconciler's own warn-once lesson).
 //
-// CADENCE: windows are minutes-granular (the recommended sitting is 90
-// minutes), so a one-minute sweep bounds lateness at ~1 minute — tight enough
-// that "closes on time" is honest, cheap enough that the query (one indexed
-// read; government_board_items_open_by_deadline exists for exactly this, per
-// government_003's own comment) is negligible. Concurrent windows are normal
+// CADENCE (task 1004960): the poller SLEEPS UNTIL THE SOONEST DEADLINE instead
+// of asking every minute. After each sweep it makes one MIN(closes_at) read
+// (msUntilSoonestOpenDeadline, the same partial index) and arms its next run
+// for just after that deadline — capped at MAX_WAIT_MS (5 minutes) so an item
+// opened by some other process is still caught. A window opened in THIS process
+// wakes it sooner through noteDeadline (db.openBoardItem calls it), so a
+// one-minute window still closes on time. An idle instance with no open clock
+// therefore reads twice per 5 minutes, not once a minute; a vote still closes
+// within ~1 second of its deadline. While something is OVERDUE after a sweep
+// (its close threw and rolled back) the retry waits RETRY_MS (the old one-minute
+// cadence), never a hot loop. Runs never overlap: a tick that fires while the
+// previous sweep is still in flight is skipped. Concurrent windows are normal
 // (owner decision 10): the sweep closes every due item, oldest deadline first.
 
 const board = require('../board');
 const db = require('../db');
 
-const INTERVAL_MS = Number(process.env.BOARD_EXPIRY_SWEEP_MS) || 60_000;
+// The longest the poller ever sleeps (BOARD_EXPIRY_SWEEP_MS overrides it). It
+// only bounds an item opened by ANOTHER process; this process's opens wake it.
+const MAX_WAIT_MS = Number(process.env.BOARD_EXPIRY_SWEEP_MS) || 5 * 60_000;
+// Kept as an alias: INTERVAL_MS was the fixed cadence before task 1004960.
+const INTERVAL_MS = MAX_WAIT_MS;
+// While an item is overdue after a sweep (its close failed and rolled back).
+const RETRY_MS = 60_000;
+// Wake just AFTER a deadline, since the sweep reads closes_at < now().
+const GRACE_MS = 1_000;
 // A first sweep shortly after boot, so windows that expired while the process
 // was down (a deploy restart mid-sitting) close promptly rather than one full
 // interval late.
@@ -38,8 +53,21 @@ const FIRST_SWEEP_DELAY_MS = Number(process.env.BOARD_EXPIRY_FIRST_MS) || 15_000
 // handful of open windows (the board's subjects are rare by construction).
 const SWEEP_LIMIT = 100;
 
-let intervalTimer = null;
-let firstTimer = null;
+let timer = null;
+let dueAt = null;      // when the armed timer fires (process clock, ms)
+let started = false;
+let running = false;
+let hintAt = null;     // soonest deadline (process clock) noted mid-sweep
+let startDeps = {};
+let unlisten = null;
+
+// When to run next, given the ms until the soonest open deadline (null: none).
+function nextDelayMs(msUntilSoonest) {
+  if (msUntilSoonest == null || !Number.isFinite(Number(msUntilSoonest))) return MAX_WAIT_MS;
+  const ms = Number(msUntilSoonest);
+  if (ms <= 0) return RETRY_MS; // still overdue after a sweep: retry, never spin
+  return Math.min(MAX_WAIT_MS, ms + GRACE_MS);
+}
 
 // One sweep. Injectable deps keep it DB-free testable: listFn yields the due
 // items, closeFn closes one, log receives the disposition lines.
@@ -82,20 +110,80 @@ function start(deps = {}) {
     console.log('[board-expiry] disabled (BOARD_EXPIRY_DISABLED=1)');
     return;
   }
-  if (intervalTimer) return; // already started
-  const tick = () => {
-    runSweep(deps).catch((e) => console.error(`[board-expiry] sweep crashed: ${e && e.message}`));
-  };
-  firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
-  if (firstTimer.unref) firstTimer.unref();
-  intervalTimer = setInterval(tick, INTERVAL_MS);
-  if (intervalTimer.unref) intervalTimer.unref(); // never hold the process open on a restart
-  console.log(`[board-expiry] started (every ${Math.round(INTERVAL_MS / 1000)}s; first sweep in ${Math.round(FIRST_SWEEP_DELAY_MS / 1000)}s)`);
+  if (started) return; // already started
+  started = true;
+  startDeps = deps;
+  unlisten = db.onBoardDeadline(noteDeadline); // a window opened here wakes us sooner
+  arm(FIRST_SWEEP_DELAY_MS);
+  console.log(`[board-expiry] started (sleeps until the soonest deadline, at most ${Math.round(MAX_WAIT_MS / 1000)}s; first sweep in ${Math.round(FIRST_SWEEP_DELAY_MS / 1000)}s)`);
+}
+
+function arm(delay) {
+  if (timer) clearTimeout(timer);
+  dueAt = Date.now() + delay;
+  timer = setTimeout(() => {
+    timer = null;
+    dueAt = null;
+    tick().catch((e) => console.error(`[board-expiry] sweep crashed: ${e && e.message}`));
+  }, delay);
+  if (timer.unref) timer.unref(); // never hold the process open on a restart
+}
+
+// One run: the sweep, then the one MIN(closes_at) read that sets the alarm.
+// A run that starts while the previous one is still in flight is skipped —
+// the running one re-arms when it finishes, so nothing is lost.
+async function tick(deps = startDeps) {
+  if (running) return { skipped: true };
+  running = true;
+  let soonest = null;
+  try {
+    const out = await runSweep(deps);
+    try {
+      soonest = await (deps.soonestFn || db.msUntilSoonestOpenDeadline)();
+    } catch (e) {
+      (deps.error || console.error)(`[board-expiry] soonest-deadline read failed: ${e && e.message}`);
+      soonest = 0; // unknown: fall back to the one-minute retry, not the 5-minute cap
+    }
+    return out;
+  } finally {
+    running = false;
+    if (hintAt != null) {
+      const hint = hintAt - Date.now();
+      soonest = soonest == null ? hint : Math.min(soonest, hint);
+      hintAt = null;
+    }
+    if (started) arm(nextDelayMs(soonest));
+  }
+}
+
+// A window was opened that closes msUntilClose from now: wake sooner if the
+// armed alarm is later than that deadline. Mid-sweep, remember it for the re-arm.
+function noteDeadline(msUntilClose) {
+  if (!started || msUntilClose == null || !Number.isFinite(Number(msUntilClose))) return;
+  const ms = Math.max(0, Number(msUntilClose));
+  if (running) {
+    const at = Date.now() + ms;
+    hintAt = hintAt == null ? at : Math.min(hintAt, at);
+    return;
+  }
+  const delay = Math.min(MAX_WAIT_MS, ms + GRACE_MS);
+  if (dueAt == null || Date.now() + delay < dueAt) arm(delay);
 }
 
 function stop() {
-  if (firstTimer) { clearTimeout(firstTimer); firstTimer = null; }
-  if (intervalTimer) { clearInterval(intervalTimer); intervalTimer = null; }
+  started = false;
+  hintAt = null;
+  if (unlisten) { unlisten(); unlisten = null; }
+  if (timer) { clearTimeout(timer); timer = null; }
+  dueAt = null;
+}
+
+// For tests: what is armed right now.
+function _state() {
+  return { started, running, msUntilNextRun: dueAt == null ? null : dueAt - Date.now() };
 }
 
-module.exports = { start, stop, runSweep, INTERVAL_MS, SWEEP_LIMIT };
+module.exports = {
+  start, stop, runSweep, tick, noteDeadline, nextDelayMs, _state,
+  INTERVAL_MS, MAX_WAIT_MS, RETRY_MS, GRACE_MS, SWEEP_LIMIT,
+};

package/modules/government/protected-surfaces.json

@@ -30,6 +30,7 @@
     { "glob": "src/bongos/auth-config.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/auth-discord.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/auth-github.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
+    { "glob": "src/bongos/auth-google.js", "group": "authz", "why": "task 1004993 (ADR 0396). The Google sign-in beside auth-github.js: it checks Google's ID token, runs the admission gate for a Google person and mints their web session, so it is the same trust surface as the GitHub flow." },
     { "glob": "src/bongos/auth-idp.js", "group": "authz", "why": "task 1004024. Carved out of auth.js (task 1003206): the OAuth flows, session-token minting, admission and IdP checks auth.js now delegates to. Registering auth.js alone protected the facade and none of them." },
     { "glob": "src/bongos/db.js", "group": "authz", "why": "rank tiers, REQUIRES_RANK_TIER — the CASE edited in the SEC #863 incident" },
     { "glob": "src/bongos/db-kernel.js", "group": "authz", "why": "task 1004024. The kernel db slice carved out of db.js (BV1.R69 / ADR 0091): builder identity and the rank reads the SEC #863 entry above exists for." },

package/modules/government/routes/government.js

@@ -434,40 +434,50 @@ module.exports = function buildGovernmentRouter() {
 
   // rank: perm government.manage — add a RECOMMENDED RANK SET (task 1004400):
   // the custom ranks recommendations.js names for a project type and size, each
-  // with its grants. It is the create form and the grant toggle run in a loop,
-  // under the same checks: a rank that already exists is LEFT ALONE (never
+  // with its grants. It does what the create form and the grant toggle do, for
+  // every rank in the set, under the same checks: a rank that already exists is LEFT ALONE (never
   // re-granted, never relabelled — an owner may have edited it), and every grant
   // is re-checked with catalog.isGrantableTo, so a set can never write what the
   // toggle would refuse. Re-applying is safe; the reply says what was added.
+  //
+  // task 1004929: the whole set is written by db.applyRankSet in ONE transaction
+  // and three statements, instead of a read + insert + one insert per grant for
+  // every rank. A rank this route creates is always a CUSTOM rank (is_system
+  // false, no seeded_rank — what createRank returns), so each grant is screened
+  // against that shape before the write, exactly as the toggle would screen it.
+  // A failure now writes nothing, so a 500 reports empty created/skipped lists.
   router.post('/government/rank-sets/apply', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
     if (validateOrRespond(req, res, {
       type: { type: 'string', maxLength: 32 },
       headcount: { required: true, type: 'integer', min: 0, max: 100000 },
     })) return;
     const set = recommendations.recommendedRankSet(req.body.type, req.body.headcount);
-    const created = [];
-    const skipped = [];
+    const customRank = { is_system: false, seeded_rank: null };
     try {
+      const granted = await db.applyRankSet({
+        createdBy: req.builder.id,
+        ranks: set.ranks.map((r) => ({
+          rankKey: r.rank_key,
+          label: r.label,
+          description: r.description,
+          permissionKeys: r.permissions.filter((key) => catalog.byKey(key) && catalog.isGrantableTo(key, customRank)),
+        })),
+      });
+      const created = [];
+      const skipped = [];
       for (const r of set.ranks) {
-        if (await db.getRankByKey(r.rank_key)) { skipped.push({ rank_key: r.rank_key, label: r.label }); continue; }
-        let rank;
-        try {
-          rank = await db.createRank({ rankKey: r.rank_key, label: r.label, description: r.description, createdBy: req.builder.id });
-        } catch (err) {
-          if (err && err.code === '23505') { skipped.push({ rank_key: r.rank_key, label: r.label }); continue; }
-          throw err;
+        // delete-on-read: a key named twice in a set is created once, then skipped.
+        if (granted.has(r.rank_key)) {
+          created.push({ rank_key: r.rank_key, label: r.label, permissions: granted.get(r.rank_key) });
+          granted.delete(r.rank_key);
+        } else {
+          skipped.push({ rank_key: r.rank_key, label: r.label });
         }
-        const granted = [];
-        for (const key of r.permissions) {
-          if (!catalog.byKey(key) || !catalog.isGrantableTo(key, rank)) continue;
-          if (await db.grantRankPermission({ rankKey: r.rank_key, permissionKey: key })) granted.push(key);
-        }
-        created.push({ rank_key: r.rank_key, label: r.label, permissions: granted });
       }
       res.json({ ok: true, type: set.type, size: set.size, created, skipped });
     } catch (err) {
       log.error('[gds] POST /government/rank-sets/apply', err);
-      res.fail('rank_set_apply_failed', { status: 500, message: 'internal error', details: { created, skipped } });
+      res.fail('rank_set_apply_failed', { status: 500, message: 'internal error', details: { created: [], skipped: [] } });
     }
   });
 
@@ -757,6 +767,28 @@ module.exports = function buildGovernmentRouter() {
   // treasury; `rule` ∈ decide first consent majority unanimous signoff rule (or
   // null); `state` ∈ needs moving settled. Nothing is ever sample data: a source
   // with nothing recorded yet is `coming`, never a placeholder row.
+  // OPEN BLOCKERS UNDER PEOPLE (task 1004999): every open blocker grouped under each
+  // person its seat resolves to (routing.js, the City's own rule), and the viewer's own
+  // group. The docket's atom: it floors at xenos, so every builder can see whose a
+  // blocker is; resolving one keeps its own blocker.review gate.
+  router.get('/government/blockers/people', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      res.json(await docket.blockersByPerson(req.builder));
+    } catch (err) {
+      log.error('[gds] GET /government/blockers/people', err);
+      res.fail('blockers_people_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+  router.get('/government/blockers/for-me', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      const r = await docket.blockersByPerson(req.builder);
+      res.json({ available: r.available, reason: r.reason || null, ...r.yours });
+    } catch (err) {
+      log.error('[gds] GET /government/blockers/for-me', err);
+      res.fail('blockers_for_me_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   router.get('/government/docket', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
     try {
       res.json(await docket.docketFor(req.builder));