@bongos/core 1.23.22 → 1.24.1

package/src/bongos/payout-gates.js

@@ -0,0 +1,364 @@
+'use strict';
+
+// src/bongos/payout-gates.js — who may be paid at all: age tier, sanctions
+// screening, and a freeze that tells the person (task 1004914, goal 1000092 N10;
+// ADR 0385 decision 8).
+//
+// WHY. Two gates stand in front of every payout in the owner's legal framework
+// (cited by Article only). Art. VII, age: under 13 takes no part in pay; 13 to 15
+// is paid no money at all; 16 and 17 only with a guardian's co-signature and into
+// an account the guardian controls. Art. X, sanctions: the recipient is screened
+// and a match stops the payout. A stop that touches money someone is owed must
+// tell them and offer an appeal — pay is never withheld silently.
+//
+// HOW IT IS USED. gateRecipient() runs on EVERY money route (the N9 approval
+// routes in routes/payout-approvals.js, and checkRun / checkApproval, which the
+// paying tasks M04, N6 and N7 call at pay time) — in the API, not the screen. When
+// it refuses money that is owed, holdOwedPay() files a freeze whose notice and
+// appeal route are NOT NULL in the table, so a silent stop cannot be stored; the
+// person reads it at GET /me/payouts and appeals it there.
+//
+// WHAT WE DO NOT RELY ON. The processor is not chosen yet (task 1004906, N2).
+// Until someone has confirmed in writing what it screens, a screening the
+// processor reports is NOT accepted as the basis for paying: only a screening a
+// person with payout.approve recorded counts. PROCESSOR_SCREENING_CONFIRMED is the
+// one switch N2 flips, with a reference to that written confirmation.
+//
+// Pure first (decide), then the db half (pool injectable).
+
+const PROCESSOR_SCREENING_CONFIRMED = null; // e.g. { processor: 'x', scope: 'OFAC+EU+UN', confirmed_in: 'ADR NNNN' }
+
+const AGE_TIERS = Object.freeze(['under_13', '13_15', '16_17', 'adult']);
+const AGE_BASES = Object.freeze(['self_declared', 'verified_by_processor', 'verified_by_person']);
+const SCREEN_RESULTS = Object.freeze(['clear', 'match', 'error']);
+const FREEZE_REASONS = Object.freeze(['sanctions_match', 'sanctions_unscreened', 'age_no_money', 'age_needs_guardian', 'age_unknown', 'manual']);
+const APPEAL_ROUTE = 'POST /api/bongos/me/payout-freezes/:id/appeal';
+const MAX_SCREEN_DAYS = 365;
+
+// The words a frozen person reads. Plain, never accusing, always naming the way out.
+const NOTICES = Object.freeze({
+  sanctions_match: 'A payout to you is on hold because a required sanctions check flagged a possible match. This is often a false match. You can appeal and we will review it with you.',
+  sanctions_unscreened: 'A payout to you is waiting for a required sanctions check before it can be paid. Nothing is lost; it is paid once the check is done. You can appeal if it is taking too long.',
+  age_no_money: 'A payout to you cannot be paid in money because of the age recorded on your account. If the age is wrong, you can appeal and have it corrected.',
+  age_needs_guardian: 'A payout to you needs a parent or guardian to co-sign it and an account they control before it can be paid. You can appeal if this is wrong.',
+  age_unknown: 'A payout to you is waiting because your account has no age recorded yet. Record your age to continue, or appeal if you think this is wrong.',
+});
+
+const latest = (rows) => (rows && rows.length ? rows[rows.length - 1] : null);
+
+function screeningCounts(row) {
+  if (!row) return false;
+  if (row.screened_by.startsWith('person:')) return true;
+  return Boolean(PROCESSOR_SCREENING_CONFIRMED);
+}
+
+// Is this recipient payable in money right now? facts: their rows, oldest first.
+// Returns { ok: true, pay_to } or { ok: false, reason, freeze_id? }.
+function decide({ ageRecords = [], guardians = [], screenings = [], freezes = [], freezeEvents = [], now = new Date() }) {
+  const lifted = new Set(freezeEvents.filter((e) => e.kind === 'lifted').map((e) => String(e.freeze_id)));
+  const open = freezes.filter((f) => !lifted.has(String(f.id)));
+  if (open.length) return { ok: false, reason: 'frozen', freeze_id: String(open[open.length - 1].id), frozen_for: open[open.length - 1].reason };
+
+  const age = latest(ageRecords);
+  if (!age) return { ok: false, reason: 'age_unknown' };
+  if (age.tier === 'under_13' || age.tier === '13_15') return { ok: false, reason: 'age_no_money' };
+  let payTo = 'self';
+  if (age.tier === '16_17') {
+    const g = latest(guardians);
+    if (!g || !g.active || !g.guardian_account) return { ok: false, reason: 'age_needs_guardian' };
+    payTo = { guardian_id: String(g.guardian_id), guardian_account: g.guardian_account };
+  }
+
+  const counted = screenings.filter(screeningCounts);
+  const s = latest(counted);
+  if (s && s.result === 'match') return { ok: false, reason: 'sanctions_match' };
+  if (!s || s.result !== 'clear' || !s.valid_until || new Date(s.valid_until) < now) return { ok: false, reason: 'sanctions_unscreened' };
+
+  return { ok: true, pay_to: payTo, needs_guardian_cosign: payTo !== 'self' };
+}
+
+
+// ── db half ────────────────────────────────────────────────────────────────
+
+function defaultPool() { return require('./pool').pool; }
+
+const ids = (rows) => rows.map((r) => {
+  const o = { ...r };
+  for (const k of ['id', 'builder_id', 'guardian_id', 'recorded_by', 'frozen_by', 'freeze_id', 'actor_id']) if (o[k] != null) o[k] = String(o[k]);
+  if (o.owed_cents != null) o.owed_cents = Number(o.owed_cents);
+  return o;
+});
+
+// Everything the gate reads about one builder, oldest first per table.
+// Everything the gate reads about a SET of builders: five queries however many
+// recipients a run has (one per table, then the holds' events), never one round
+// of reads per person. Returns Map<builderId, facts>, each table oldest first.
+async function readFactsMany(builderIds, { pool = defaultPool() } = {}) {
+  const want = [...new Set(builderIds.map(String))];
+  const out = new Map(want.map((id) => [id, { ageRecords: [], guardians: [], screenings: [], freezes: [], freezeEvents: [] }]));
+  if (!want.length) return out;
+  // One recipient: every row is theirs. Many: rows carry builder_id.
+  const owner = (r) => (want.length === 1 ? want[0] : String(r.builder_id));
+  const q = (sql) => pool.query(sql, [want]).then((r) => ids(r.rows));
+  const [ageRecords, guardians, screenings, freezes] = await Promise.all([
+    q('SELECT id, builder_id, tier, basis, recorded_by, recorded_at FROM payout_age_records WHERE builder_id = ANY($1::bigint[]) ORDER BY id'),
+    q('SELECT id, builder_id, guardian_id, guardian_account, active, recorded_by, recorded_at FROM payout_guardians WHERE builder_id = ANY($1::bigint[]) ORDER BY id'),
+    q('SELECT id, builder_id, result, screened_by, reference, valid_until, recorded_by, screened_at FROM payout_screenings WHERE builder_id = ANY($1::bigint[]) ORDER BY id'),
+    q('SELECT id, builder_id, reason, notice_text, appeal_route, owed_cents, frozen_by, frozen_at FROM payout_freezes WHERE builder_id = ANY($1::bigint[]) ORDER BY id'),
+  ]);
+  for (const [key, rows] of [['ageRecords', ageRecords], ['guardians', guardians], ['screenings', screenings], ['freezes', freezes]]) {
+    for (const r of rows) { const b = out.get(owner(r)); if (b) b[key].push(r); }
+  }
+  if (freezes.length) {
+    const freezeOwner = new Map(freezes.map((fr) => [String(fr.id), owner(fr)]));
+    const events = ids((await pool.query('SELECT id, freeze_id, kind, actor_id, statement, created_at FROM payout_freeze_events WHERE freeze_id = ANY($1::bigint[]) ORDER BY id', [freezes.map((fr) => fr.id)])).rows);
+    for (const e of events) { const b = out.get(freezeOwner.get(String(e.freeze_id))); if (b) b.freezeEvents.push(e); }
+  }
+  return out;
+}
+
+async function readFacts(builderId, opts = {}) {
+  return (await readFactsMany([builderId], opts)).get(String(builderId));
+}
+
+async function gateRecipient(builderId, { now = new Date(), pool = defaultPool() } = {}) {
+  const facts = await readFacts(builderId, { pool });
+  return { ...decide({ ...facts, now }), facts };
+}
+
+// Money is owed and the gate said no: file the freeze that tells them (or reuse
+// the open one for the same reason). Never refuse owed pay without this.
+async function holdOwedPay(builderId, reason, opts = {}) {
+  if (!NOTICES[reason]) throw new Error(`holdOwedPay: no notice for ${reason}`);
+  const pool = opts.pool || defaultPool();
+  // Two money routes refusing the same person at once must not file two holds.
+  // A transaction-scoped advisory lock on the builder serialises the
+  // check-then-insert; under READ COMMITTED each statement after the lock sees
+  // the other's committed row. A caller that hands in a bare client (a test, or
+  // a caller already inside its own transaction) runs the two statements as is.
+  // A Pool has connect() and no release(); a checked-out client has both, and
+  // must not be connected again.
+  if (typeof pool.connect === 'function' && typeof pool.release !== 'function') {
+    const client = await pool.connect();
+    try {
+      await client.query('BEGIN');
+      await client.query('SELECT pg_advisory_xact_lock($1::int, hashtext($2::text))', [HOLD_LOCK_SPACE, String(builderId)]);
+      const out = await fileOrReuseHold(client, builderId, reason, opts);
+      await client.query('COMMIT');
+      return out;
+    } catch (err) {
+      await client.query('ROLLBACK').catch(() => {});
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
+  return fileOrReuseHold(pool, builderId, reason, opts);
+}
+
+const HOLD_LOCK_SPACE = 1004914;
+
+async function fileOrReuseHold(pool, builderId, reason, { owedCents = null, frozenBy = null } = {}) {
+  const { rows } = await pool.query(
+    `INSERT INTO payout_freezes (builder_id, reason, notice_text, appeal_route, owed_cents, frozen_by)
+     SELECT $1, $2, $3, $4, $5, $6
+      WHERE NOT EXISTS (
+        SELECT 1 FROM payout_freezes f
+         WHERE f.builder_id = $1 AND f.reason = $2
+           AND NOT EXISTS (SELECT 1 FROM payout_freeze_events e WHERE e.freeze_id = f.id AND e.kind = 'lifted'))
+     RETURNING id`,
+    [builderId, reason, NOTICES[reason], APPEAL_ROUTE, owedCents, frozenBy],
+  );
+  if (rows[0]) return { freeze_id: String(rows[0].id), filed: true };
+  const open = await pool.query(
+    `SELECT f.id FROM payout_freezes f WHERE f.builder_id = $1 AND f.reason = $2
+       AND NOT EXISTS (SELECT 1 FROM payout_freeze_events e WHERE e.freeze_id = f.id AND e.kind = 'lifted')
+     ORDER BY f.id DESC LIMIT 1`, [builderId, reason]);
+  return { freeze_id: open.rows[0] ? String(open.rows[0].id) : null, filed: false };
+}
+
+// The one call a money route makes per recipient: gate, and on a refusal of owed
+// money, hold it WITH a notice. Returns the gate verdict plus freeze_id.
+async function gateOwedPay(builderId, { owedCents = null, frozenBy = null, now = new Date(), pool = defaultPool() } = {}) {
+  const v = await gateRecipient(builderId, { now, pool });
+  if (v.ok) return { ok: true, pay_to: v.pay_to, needs_guardian_cosign: v.needs_guardian_cosign };
+  if (v.reason === 'frozen') return { ok: false, reason: 'frozen', freeze_id: v.freeze_id, notice: NOTICES[v.frozen_for] || null };
+  const hold = await holdOwedPay(builderId, v.reason, { owedCents, frozenBy, pool });
+  return { ok: false, reason: v.reason, freeze_id: hold.freeze_id, notice: NOTICES[v.reason] };
+}
+
+// gateOwedPay for a whole run: Map<recipientId, cents owed> in, Map<recipientId,
+// verdict> out, from one readFactsMany. Holds are filed only for the recipients
+// refused, which is the rare path.
+async function gateOwedPayMany(owed, { frozenBy = null, now = new Date(), pool = defaultPool() } = {}) {
+  const facts = await readFactsMany([...owed.keys()], { pool });
+  const out = new Map();
+  for (const [rid, cents] of owed) {
+    const v = decide({ ...facts.get(String(rid)), now });
+    if (v.ok) { out.set(rid, { ok: true, pay_to: v.pay_to, needs_guardian_cosign: v.needs_guardian_cosign }); continue; }
+    if (v.reason === 'frozen') { out.set(rid, { ok: false, reason: 'frozen', freeze_id: v.freeze_id, notice: NOTICES[v.frozen_for] || null }); continue; }
+    const hold = await holdOwedPay(rid, v.reason, { owedCents: cents, frozenBy, pool });
+    out.set(rid, { ok: false, reason: v.reason, freeze_id: hold.freeze_id, notice: NOTICES[v.reason] });
+  }
+  return out;
+}
+
+// Which of these recipients has their guardian's co-signature on this run line:
+// one query for the run.
+async function cosignedInRun({ ruleId, runKey, builderIds }, { pool = defaultPool() } = {}) {
+  if (!builderIds.length) return new Set();
+  const { rows } = await pool.query(
+    'SELECT DISTINCT builder_id FROM payout_guardian_cosigns WHERE rule_id = $1 AND run_key = $2 AND builder_id = ANY($3::bigint[])',
+    [ruleId, runKey, builderIds.map(String)],
+  );
+  return new Set(rows.map((r) => String(r.builder_id)));
+}
+
+async function insertRow(table, cols, vals, { pool = defaultPool() } = {}) {
+  const ph = vals.map((_, i) => `$${i + 1}`).join(', ');
+  const { rows } = await pool.query(`INSERT INTO ${table} (${cols.join(', ')}) VALUES (${ph}) RETURNING *`, vals);
+  return ids(rows)[0];
+}
+
+const recordAge = ({ builderId, tier, basis, recordedBy }, o) => insertRow('payout_age_records', ['builder_id', 'tier', 'basis', 'recorded_by'], [builderId, tier, basis, recordedBy], o);
+const recordGuardian = ({ builderId, guardianId, guardianAccount, active, recordedBy }, o) => insertRow('payout_guardians', ['builder_id', 'guardian_id', 'guardian_account', 'active', 'recorded_by'], [builderId, guardianId, guardianAccount, active, recordedBy], o);
+const recordScreening = ({ builderId, result, screenedBy, reference, validUntil, recordedBy }, o) => insertRow('payout_screenings', ['builder_id', 'result', 'screened_by', 'reference', 'valid_until', 'recorded_by'], [builderId, result, screenedBy, reference, validUntil, recordedBy], o);
+const freezeManually = ({ builderId, noticeText, owedCents, frozenBy }, o) => insertRow('payout_freezes', ['builder_id', 'reason', 'notice_text', 'appeal_route', 'owed_cents', 'frozen_by'], [builderId, 'manual', noticeText, APPEAL_ROUTE, owedCents, frozenBy], o);
+const addFreezeEvent = ({ freezeId, kind, actorId, statement }, o) => insertRow('payout_freeze_events', ['freeze_id', 'kind', 'actor_id', 'statement'], [freezeId, kind, actorId, statement], o);
+
+async function readFreeze(freezeId, { pool = defaultPool() } = {}) {
+  const f = ids((await pool.query('SELECT id, builder_id, reason, notice_text, appeal_route, owed_cents, frozen_by, frozen_at FROM payout_freezes WHERE id = $1', [freezeId])).rows)[0];
+  if (!f) return null;
+  const events = ids((await pool.query('SELECT id, freeze_id, kind, actor_id, statement, created_at FROM payout_freeze_events WHERE freeze_id = $1 ORDER BY id', [freezeId])).rows);
+  return { ...f, events, lifted: events.some((e) => e.kind === 'lifted') };
+}
+
+const recordCosign = ({ builderId, guardianId, approvalId, ruleId, runKey, sessionId }, o) => insertRow('payout_guardian_cosigns', ['builder_id', 'guardian_id', 'approval_id', 'rule_id', 'run_key', 'session_id', 'session_source'], [builderId, guardianId, approvalId, ruleId, runKey, sessionId, 'web'], o);
+
+// Co-sign as a guardian: find whose payout this is from the payout itself (a
+// one-off's recipient, or the run's noticed lines), keep only the builders whose
+// CURRENT guardian is guardianId, and record one co-signature each. Returns the
+// rows written ([] when the payout is not to any of their wards). The insert
+// trigger checks the guardianship again, so this can only narrow.
+async function cosignAsGuardian({ guardianId, sessionId, approvalId = null, ruleId = null, runKey = null }, { pool = defaultPool() } = {}) {
+  let recipients = [];
+  if (approvalId) {
+    const { rows } = await pool.query("SELECT recipient_id FROM payout_approvals WHERE id = $1 AND kind = 'payout_approved'", [approvalId]);
+    recipients = rows.map((r) => String(r.recipient_id));
+  } else {
+    const { rows } = await pool.query("SELECT terms FROM payout_approvals WHERE rule_id = $1 AND run_key = $2 AND kind = 'run_noticed'", [ruleId, runKey]);
+    const lines = rows[0] && rows[0].terms && Array.isArray(rows[0].terms.payouts) ? rows[0].terms.payouts : [];
+    recipients = [...new Set(lines.map((p) => String(p.recipient_id)))];
+  }
+  if (!recipients.length) return [];
+  const { rows: wards } = await pool.query(
+    `SELECT g.builder_id FROM payout_guardians g
+      WHERE g.builder_id = ANY($1::bigint[])
+        AND g.id = (SELECT max(id) FROM payout_guardians x WHERE x.builder_id = g.builder_id)
+        AND g.active AND g.guardian_id = $2`,
+    [recipients, guardianId],
+  );
+  const out = [];
+  for (const w of wards) {
+    out.push(await recordCosign({ builderId: String(w.builder_id), guardianId, approvalId, ruleId, runKey, sessionId }, { pool }));
+  }
+  return out;
+}
+
+async function hasCosign({ builderId, approvalId = null, ruleId = null, runKey = null }, { pool = defaultPool() } = {}) {
+  const { rows } = approvalId
+    ? await pool.query('SELECT 1 FROM payout_guardian_cosigns WHERE builder_id = $1 AND approval_id = $2 LIMIT 1', [builderId, approvalId])
+    : await pool.query('SELECT 1 FROM payout_guardian_cosigns WHERE builder_id = $1 AND rule_id = $2 AND run_key = $3 LIMIT 1', [builderId, ruleId, runKey]);
+  return rows.length > 0;
+}
+
+// What an approver sees about a recipient.
+function present(v) {
+  return {
+    payable: Boolean(v.ok),
+    reason: v.ok ? null : v.reason,
+    notice: v.ok ? null : (NOTICES[v.reason === 'frozen' ? v.frozen_for : v.reason] || null),
+    freeze_id: v.freeze_id || null,
+    pay_to: v.ok ? v.pay_to : null,
+    needs_guardian_cosign: Boolean(v.needs_guardian_cosign),
+  };
+}
+
+// What the person sees about themselves: every hold, its words, what happened since.
+function presentOwn(v) {
+  const f = v.facts || {};
+  const age = latest(f.ageRecords || []);
+  const g = latest(f.guardians || []);
+  const s = latest((f.screenings || []).filter(screeningCounts));
+  const events = f.freezeEvents || [];
+  return {
+    payable: Boolean(v.ok),
+    reason: v.ok ? null : v.reason,
+    age_tier: age ? age.tier : null,
+    guardian: g ? { guardian_id: g.guardian_id, active: g.active } : null,
+    screening: s ? { result: s.result, valid_until: s.valid_until || null } : null,
+    holds: (f.freezes || []).map((fr) => {
+      const mine = events.filter((e) => String(e.freeze_id) === String(fr.id));
+      return {
+        id: fr.id,
+        reason: fr.reason,
+        notice: fr.notice_text,
+        owed_cents: fr.owed_cents ?? null,
+        frozen_at: fr.frozen_at,
+        lifted: mine.some((e) => e.kind === 'lifted'),
+        events: mine.map((e) => ({ kind: e.kind, statement: e.statement, at: e.created_at })),
+        appeal: APPEAL_ROUTE.replace(':id', fr.id),
+      };
+    }),
+  };
+}
+
+// How many holds on this builder's pay are still open, for the /me needs list:
+// { count, first_id }. One indexed read on the session hot path.
+async function openHoldsFor(builderId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `SELECT count(*)::int AS count, min(f.id) AS first_id FROM payout_freezes f
+      WHERE f.builder_id = $1
+        AND NOT EXISTS (SELECT 1 FROM payout_freeze_events e WHERE e.freeze_id = f.id AND e.kind = 'lifted')`,
+    [builderId],
+  );
+  const r = rows[0] || {};
+  return { count: Number(r.count) || 0, first_id: r.first_id == null ? null : String(r.first_id) };
+}
+
+// One object, required whole by its callers (routes/payout-gates.js,
+// routes/payout-approvals.js, payout-approvals.js, routes/me.js), each of which
+// takes it as an injectable dependency so tests can stand in for the database.
+const api = {
+  PROCESSOR_SCREENING_CONFIRMED,
+  AGE_TIERS,
+  AGE_BASES,
+  SCREEN_RESULTS,
+  FREEZE_REASONS,
+  NOTICES,
+  APPEAL_ROUTE,
+  MAX_SCREEN_DAYS,
+  screeningCounts,
+  decide,
+  present,
+  presentOwn,
+  readFacts,
+  readFactsMany,
+  gateOwedPayMany,
+  cosignedInRun,
+  gateRecipient,
+  holdOwedPay,
+  gateOwedPay,
+  recordAge,
+  recordGuardian,
+  recordScreening,
+  recordCosign,
+  cosignAsGuardian,
+  hasCosign,
+  freezeManually,
+  addFreezeEvent,
+  readFreeze,
+  openHoldsFor,
+};
+
+module.exports = api;

package/src/bongos/prelaunch-gate.js

@@ -87,14 +87,13 @@ const SUBMIT_PATHS = [SUBMIT_PATH, LEGACY_SUBMIT_PATH];
 //             instance without the raise module the path is simply a 404.
 const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/, /^\/raise(\/|$)/];
 
-// PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. This
-// is the ONE read site for either, which is what makes honouring both a single
-// expression rather than a migration — and why the rename could be taken at all
-// without an outage window on a live instance already running the old name.
-function password() {
-  const p = process.env.PRELAUNCH_PASSWORD || process.env.STEALTH_PASSWORD;
-  return typeof p === 'string' && p.length ? p : null;
-}
+// PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. The ONE
+// read site for either is ./prelaunch-switch.js (moved there by task 1004998 so the
+// module doorway can ask "is pre-launch on?" without this file joining the kernel),
+// which is what makes honouring both a single expression rather than a migration —
+// and why the rename could be taken at all without an outage window on a live
+// instance already running the old name.
+const { password, enabled } = require('./prelaunch-switch');
 
 // Named once at mount, never per request: a warning on every gated request would
 // be a log flood on exactly the instance that is hardest to look at. Dropping the
@@ -109,7 +108,6 @@ function warnIfLegacyEnv(log = console.warn) {
   return true;
 }
 
-function enabled() { return password() !== null; }
 
 // The token a valid cookie must carry. Keyed by the password, so the password
 // itself never leaves the server and a rotation invalidates every cookie.

package/src/bongos/prelaunch-switch.js

@@ -0,0 +1,20 @@
+// src/bongos/prelaunch-switch.js — is this instance in pre-launch (stealth)? (task 1004998)
+//
+// WHY. The pre-launch password gate (./prelaunch-gate.js) decides whether a
+// stranger may see the instance at all; other doors need to ask only whether it
+// is ON — the provisioning module refuses public project repos while it is
+// (through src/module-api.js prelaunchActive). The gate itself cannot be a kernel
+// file (it names the `raise` module's exempt path), so the one question both
+// share lives here, imports nothing, and the gate reads its password from it.
+// PRELAUNCH_PASSWORD wins; STEALTH_PASSWORD is the deprecated alias still set on
+// live (see the gate's header).
+'use strict';
+
+function password() {
+  const p = process.env.PRELAUNCH_PASSWORD || process.env.STEALTH_PASSWORD;
+  return typeof p === 'string' && p.length ? p : null;
+}
+
+function enabled() { return password() !== null; }
+
+module.exports = { password, enabled };

package/src/bongos/route-rank-check.js

@@ -301,6 +301,9 @@ const GOVERNMENT_PINS = {
   // task 1004523: the governor's docket — every matter awaiting a governor. The
   // coarse gate is the room's; each source inside is scoped to its own atom.
   'GET /government/docket': 'perm:board.vote.cast',
+  // task 1004999: open blockers under the people they wait on, and the viewer's own.
+  'GET /government/blockers/people': 'perm:board.vote.cast',
+  'GET /government/blockers/for-me': 'perm:board.vote.cast',
   // task 1004529: who decides what — a change to the decision-rules table is an
   // amendment by another door (same atom as proposing one), and a building's
   // matter is put to its sitting by the same atom. Only a passed amendment