@bongos/core 1.24.45 → 1.24.46

package/modules/ui-design/public/tokens.css

@@ -0,0 +1,125 @@
+/* modules/ui-design/public/tokens.css — THE SHARED TOKEN SHEET (task 1005081,
+   goal 1000138 "One Cloud Bongos design system").
+
+   One sheet every Cloud Bongos surface loads — the hall, the landing + the
+   projects hub, the status page and the raise page — served at the one stable
+   path /modules/ui-design/public/tokens.css on every host (serve-internal.js's
+   module-asset route; the kit's stub serves the same path).
+
+   WHAT IS HERE: the named SCALES — type sizes, spacing, corners, shadows,
+   motion and stacking layers. Every value was already in use (the hall's token
+   block, DESIGN.md's rhythm/shapes/motion), so loading this sheet moves nothing.
+
+   WHAT IS NOT HERE: the fifteen brand tokens (thirteen colours + two font
+   stacks). Those are the instance pack's API — serve-internal.js themeMarkup()
+   splices config/branding.*.json theme.ui as a plain :root at the END of <head>,
+   after every sheet, so the pack always wins. This sheet declares none of the
+   fifteen, so there is nothing for it to win against. No colour literal lives
+   here except black with alpha (the shadows) — the Fifteen Rule's one exception.
+
+   WHY --ds-*: the surfaces grew their own scale names, and some collide with a
+   DIFFERENT meaning (cosmos.css spends --line as a colour; raise.css sets
+   --radius to 10px). A shared name would silently change whichever surface did
+   not define it, so every scale is namespaced and each surface keeps its own
+   names as aliases until a later task migrates it (the hall's aliases live in
+   modules/hall-ui/public/style.css: --radius → --ds-radius-panel, …).
+
+   DARK TWINS: the one mode-dependent scale (the shadow) is written twice,
+   byte-identical — the switch rule (the hall's html[data-theme], the apex's
+   :root[data-mode]) and the prefers-color-scheme twin for first paint.
+
+   KILL SWITCH: each surface keeps its own `animation/transition: none
+   !important` rule; this sheet additionally zeroes its durations under
+   prefers-reduced-motion so a rule built on them stays still too. */
+
+:root {
+  /* ---- type sizes: the steps the hall's 113 literal sizes cluster on, small
+          to large. The "-plus" half steps are the ones a later migration
+          should collapse into their neighbours. The four fluid roles are
+          DESIGN.md's display/headline/figure/title. ---- */
+  --ds-text-3xs:       10.5px;
+  --ds-text-2xs:       11px;
+  --ds-text-2xs-plus:  11.5px;
+  --ds-text-xs:        12px;
+  --ds-text-xs-plus:   12.5px;
+  --ds-text-sm:        13px;
+  --ds-text-sm-plus:   13.5px;
+  --ds-text-md:        14px;
+  --ds-text-md-plus:   14.5px;
+  --ds-text-lg:        15px;
+  --ds-text-xl:        16px;
+  --ds-text-2xl:       17px;
+  --ds-text-3xl:       20px;
+  --ds-text-4xl:       22px;
+  --ds-text-5xl:       26px;
+  --ds-text-title:     clamp(23px, 2.4vw, 32px);
+  --ds-text-headline:  clamp(26px, 3.1vw, 42px);
+  --ds-text-figure:    clamp(30px, 3.7vw, 52px);
+  --ds-text-display:   clamp(34px, 6.7vw, 96px);
+
+  /* ---- spacing: DESIGN.md's rhythm (6/10/14/22/34/52) + the band gutters ---- */
+  --ds-space-hair:          6px;
+  --ds-space-xs:            10px;
+  --ds-space-sm:            14px;
+  --ds-space-md:            22px;
+  --ds-space-lg:            34px;
+  --ds-space-xl:            52px;
+  --ds-space-gutter:        26px;
+  --ds-space-gutter-narrow: 20px;
+
+  /* ---- the hairline: a WIDTH, never a colour ---- */
+  --ds-line: 1px;
+
+  /* ---- corners: pill or nothing for controls; panels and tiles ---- */
+  --ds-radius-pill:  999px;
+  --ds-radius-panel: 16px;
+  --ds-radius-tile:  10px;
+
+  /* ---- shadows: the world has no UI shadow vocabulary; this is spent only
+          where an element floats over a scrim. Black with alpha. ---- */
+  --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .28);
+
+  /* ---- motion: state changes take the one easing; an authored entrance
+          takes the exponential ease-out (DESIGN.md, Motion). ---- */
+  --ds-dur-fast:    150ms;
+  --ds-dur-base:    200ms;
+  --ds-dur-slow:    320ms;
+  --ds-dur-slower:  420ms;
+  --ds-dur-arrive:  700ms;
+  --ds-stagger:     70ms;
+  --ds-ease:        cubic-bezier(.2, .7, .3, 1);
+  --ds-ease-arrive: cubic-bezier(.16, 1, .3, 1);
+
+  /* ---- stacking layers, low to high: the reading hairline under the top
+          bar, the chrome, the phone drawer over its scrim, a confirm dialog
+          over the drawer, the fullscreen diagram over everything. ---- */
+  --ds-z-progress:     25;
+  --ds-z-topbar:       30;
+  --ds-z-sidebar:      40;
+  --ds-z-scrim:        140;
+  --ds-z-drawer:       150;
+  --ds-z-modal:        160;
+  --ds-z-diagram-full: 9999;
+}
+
+/* ---------- dark: written twice, byte-identical ---------- */
+html[data-theme="dark"], :root[data-mode="dark"] {
+  --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .62);
+}
+@media (prefers-color-scheme: dark) {
+  html:not([data-theme]):not([data-mode="light"]) {
+    --ds-shadow-pop: 0 18px 40px rgba(0, 0, 0, .62);
+  }
+}
+
+/* ---------- the kill switch, for the motion scale ---------- */
+@media (prefers-reduced-motion: reduce) {
+  :root {
+    --ds-dur-fast:   0ms;
+    --ds-dur-base:   0ms;
+    --ds-dur-slow:   0ms;
+    --ds-dur-slower: 0ms;
+    --ds-dur-arrive: 0ms;
+    --ds-stagger:    0ms;
+  }
+}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.45",
+  "version": "1.24.46",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.45",
+      "version": "1.24.46",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.45",
+  "version": "1.24.46",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11233,5 +11233,19 @@
       "id": "1005070",
       "text": "The hall's sidebar now appears instantly on every page instead of popping in late, and Building mode shows a single Home button."
     }
+  ],
+  "1.24.46": [
+    {
+      "id": "1005081",
+      "text": "Cloud Bongos now has one shared set of design measurements (text sizes, spacing, corner shapes, shadows, animation timing and layering) that the builders hall, the landing page, the projects map, the status page and the invest"
+    },
+    {
+      "id": "1004547",
+      "text": "An Autobongos PC can now sign in with a login of its own, so the server always knows its work is automatic and it can never move a live version or flip its own off switch."
+    },
+    {
+      "id": "1005080",
+      "text": "The screenshot checker builders use before shipping a design change shows the real hall pages again, instead of a pop-up covering every page. Two small accessibility fixes came with it: a few tiny links are now big enough to t"
+    }
   ]
 }

package/scripts/bongos/fitness.js

@@ -540,7 +540,7 @@ const KERNEL_FILES = [
   'src/bongos/auth-admission.js',            // membership kind, admission gate, first-admin seating
   'src/bongos/auth-github.js',               // GitHub device + web OAuth flows
   'src/bongos/auth-idp.js',                  // hub federation, assertion + logout-token verification
-  'src/bongos/auth-discord.js',              // Discord OAuth link + guild membership
+  'src/bongos/auth-discord.js', 'src/bongos/runner-login.js', // Discord OAuth link + guild membership; an Autobongos PC's own login + its limits (task 1004547; requires only pool/db-kernel)
   'src/bongos/route-rank-check.js',          // deterministic route→rank classification
   'src/bongos/permission-path-check.js',     // protected-path matcher (PROTECTED_GLOBS, ADR 0043)
   'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)

package/scripts/bongos/run-unit-tests.js

@@ -140,6 +140,9 @@ const INTEGRATION = new Set([
   // task 1004677: two marked auto-pickup claims racing for the last slot of the
   // monthly cap; only real connections prove the advisory lock. Scratch DB only.
   'autopickup_cap_db',
+  // task 1004547: an Autobongos runner's one-time code works once, even when two
+  // PCs race it, and not after it expires; only real SQL proves both. Scratch DB.
+  'autobongos_runner_login_db',
   'claims_requested_worktree_db',
   'clawback_confirmed_backlog',
   // task 1003113: the copy_desk_flags schema half. The module's own tests are

package/src/bongos/auth.js

@@ -51,6 +51,8 @@ const { pool } = require('./pool');
 // the optional `?.` degrades to a no-op when the module is off (the stage tick is
 // best-effort anyway).
 const seams = require('../module-seams');
+// task 1004547: an Autobongos runner's own login holds no SYSTEM permission.
+const { isRunnerSession, withoutSystemPermissions, capRunnerRank } = require('./runner-login');
 const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
@@ -284,7 +286,11 @@ async function requireBuilder(req, res, next) {
     // rank is the single source of authority (ADR 0016). Read fresh from the
     // DB on every request via lookupSession — never cached, never from the
     // token — so demotion takes effect on the builder's very next request.
-    rank: session.rank,
+    // An Autobongos runner's own login acts at Metic at most (task 1004547,
+    // runner-login.js capRunnerRank), so every requireRank gate and every handler
+    // that reads this field sees the capped rank; `runner` says why.
+    rank: isRunnerSession(session) ? capRunnerRank(session.rank, RANKS) : session.rank,
+    runner: isRunnerSession(session),
     // system_role identifies a non-human service principal (NULL for every
     // human builder). The BFG cross-builder write gate (requireBfgPrincipal)
     // keys on this EXACT value — never on rank — so an Archon token cannot
@@ -456,7 +462,22 @@ async function pageGateAlsoAdmits(name, session) {
 // query fold, not the cross-request memo ADR 0016 forbids. Anything unexpected —
 // no raw keys on the row, an older port without the pure half, a throw — falls
 // through to the DB resolve, so the fold can only ever be an optimization.
-async function resolveHeldPermissions(builderId, rawKeys) {
+//
+// A RUNNER SESSION HOLDS NO SYSTEM PERMISSION (task 1004547). `session` is the
+// caller's session row; when its source is 'runner' (an Autobongos PC's own login,
+// src/bongos/runner-login.js) every key the catalog marks system:true is dropped —
+// core.pin.move, autonomy.fence.manage, builder.rank.set and the rest. The owner
+// rule (ADR 0307 §6) is that an unattended machine never moves a live version or
+// touches its own kill switch; this is where the server, which the PC cannot edit,
+// makes that true. An unknown key, or a port without isSystem, drops too.
+async function resolveHeldPermissions(builderId, rawKeys, session = null) {
+  const held = await resolveHeldPermissionsForBuilder(builderId, rawKeys);
+  if (held === null || !isRunnerSession(session)) return held;
+  const governance = seams.resolveOptional('government');
+  return withoutSystemPermissions(held, governance && governance.isSystem);
+}
+
+async function resolveHeldPermissionsForBuilder(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
   const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
@@ -506,7 +527,7 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
-  const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys);
+  const held = await resolveHeldPermissions(session.builder_id, session.raw_permission_keys, session);
   if (held === null || !held.has(permission)) {
     // The rank door said no. A page whose data route admits a SECOND audience
     // asks that door before redirecting (ADR 0210) — consulted here and nowhere
@@ -770,7 +791,7 @@ function requirePermission(...perms) {
     // (no port / malformed port / a throwing resolver) and is always a denial.
     // req.rawPermissionKeys rides the fold (task 1002556) when the session query
     // carried the grant keys; absent, the DB resolve runs exactly as before.
-    const held = await resolveHeldPermissions(builderId, req.rawPermissionKeys);
+    const held = await resolveHeldPermissions(builderId, req.rawPermissionKeys, req.gdsSession);
     if (held === null) return deny(null);
     if (required.every((key) => held.has(key))) return next();
     return deny(required.filter((key) => held.has(key)));

package/src/bongos/route-rank-check.js

@@ -199,6 +199,11 @@ const EXPECTED_RANKS = {
   // session revocation (kill another builder's / all sessions)
   'POST /auth/revoke': 'perm:auth.session.revoke',
   'POST /auth/revoke-all': 'perm:auth.session.revoke',
+  // An Autobongos runner's own login (task 1004547). Issuing the one-time code is
+  // Metic+ (who may run a runner); pinned so a widening cannot hand a Xenos a
+  // machine login. The exchange is a public auth-establishment route like
+  // /auth/device/exchange (the code IS the credential), so it carries no pin.
+  'POST /auth/runner-code/issue': 'metic+archon',
   // deliberately any-builder (task 1003341) — the OWN-scoped half of the same
   // capability. These reach only the caller's own sessions (every statement is
   // keyed on req.builder.id), so a rank floor here would just put an Archon back

package/src/bongos/routes/auth.js

@@ -35,6 +35,8 @@ const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 // endpoint refuses. Same composed answer the gate itself reads.
 const { effectiveJoinDoor } = require('../project-door.js');
 const db = require('../db');
+// task 1004547: an Autobongos PC's own login, from a one-time code.
+const { issueCode: issueRunnerCode, exchangeCode: exchangeRunnerCode } = require('../runner-login');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
@@ -1364,6 +1366,52 @@ module.exports = function buildAuthRouter() {
     }
   });
 
+  // POST /auth/runner-code/issue — task 1004547 (goal 1000139). A ONE-TIME CODE an
+  // Autobongos PC trades for its own login (src/bongos/runner-login.js). Body:
+  // { label? } — the PC's name, shown later in the builder's sessions list.
+  //
+  // rank: metic+archon — running a runner is Metic+ today (owner, 2026-11-06).
+  // Cookie ONLY, like /auth/cli-token/issue: a bearer — a CLI token or a runner's
+  // own login — must never be able to mint another login. The code is returned
+  // once; only its hash is stored. It works once and expires in 15 minutes.
+  router.post('/auth/runner-code/issue', auth.requireBuilder, auth.requireRank('metic', 'archon'), async (req, res) => {
+    if (validateOrRespond(req, res, { label: { type: 'string', maxLength: 200 } })) return;
+    if (!sessionCookieToken(req)) {
+      return res.fail('cookie_required', { status: 403, message: 'A runner code is issued from the builders hall in a browser (Settings), never from a token, so a leaked token cannot mint a login.' });
+    }
+    try {
+      const out = await issueRunnerCode({ builderId: req.builder.id, label: req.body && req.body.label });
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '').trim().replace(/\/+$/, '');
+      res.status(201).json({ ok: true, code: out.code, expires_at: out.expires_at, api_base: issuer || null });
+    } catch (err) {
+      log.error('[gds] POST /auth/runner-code/issue', err && err.message);
+      res.fail('runner_code_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // POST /auth/runner-code/exchange — task 1004547. The PC sends the one-time code
+  // and gets back its own login (a 'runner' session). Body: { code }.
+  //
+  // rank: public — auth establishment; the one-time code is the bearer. A wrong,
+  // used or expired code all answer the same 401, so nothing is learned from which.
+  // The router's per-IP write limit (rateLimitMiddleware) is its abuse ceiling; the
+  // code is 256 bits, so guessing one is not a race worth a limiter of its own.
+  router.post('/auth/runner-code/exchange', async (req, res) => {
+    if (validateOrRespond(req, res, { code: { required: true, type: 'string', maxLength: 200 } })) return;
+    try {
+      const out = await exchangeRunnerCode({ code: req.body.code, userAgent: req.headers['user-agent'] ?? null });
+      if (out.refused === 'builder_inactive') return res.fail('builder_inactive', 403);
+      if (out.refused) {
+        return res.fail('runner_code_invalid', { status: 401, message: 'That runner code is wrong, already used or expired. Make a new one in Settings.' });
+      }
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '').trim().replace(/\/+$/, '');
+      res.json({ ok: true, token: out.token, session_id: out.session_id, builder_login: out.github_login, label: out.label, api_base: issuer || null });
+    } catch (err) {
+      log.error('[gds] POST /auth/runner-code/exchange', err && err.message);
+      res.fail('runner_code_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // POST /auth/revoke — V3.R38 / #259. Archon-only. Kill a SINGLE session by
   // its primary-key id. Used for surgical lockouts (e.g. a compromised CLI on
   // a known builder's laptop) without disturbing that builder's other sessions.

package/src/bongos/runner-login.js

@@ -0,0 +1,151 @@
+'use strict';
+
+// src/bongos/runner-login.js — an Autobongos runner's OWN login (task 1004547, goal
+// 1000139, ADR 0307 §6).
+//
+// WHY. A runner used to run under its builder's CLI session. The server then could
+// not tell a runner's work from the person's, except by the worktree name the runner
+// chose, and the worker carried the person's full authority (it could move a live
+// core pin, task 1004974). Now the PC gets a login of its own:
+//
+//   1. In the builders hall (a browser, so a cookie session), a Metic+ builder asks
+//      for a ONE-TIME CODE (issueCode). The plaintext is shown once; only its sha256
+//      is stored. It expires after CODE_TTL_MS and works once.
+//   2. The setup command on the PC trades the code for a session whose source is
+//      'runner' (exchangeCode). That session belongs to the same builder, so the
+//      ledger credits them, but the server knows it is a machine working alone.
+//   3. What 'runner' changes, server-side, where the PC cannot reach:
+//        - every claim it makes is marked autonomous (claims.autonomous), whatever
+//          the worktree is called, and the publish guard reads that mark;
+//        - it holds no SYSTEM permission (core.pin.move, autonomy.fence.manage, …),
+//          and the project-owner door to a core move is shut to it (auth.js,
+//          provisioning core-upgrade-authz.js);
+//        - it may not mint another login: issuing a code needs a browser cookie.
+//   4. "Remove this PC" is the ordinary own-session revoke; the next call is a 401.
+//
+// The exchange is unauthenticated by design (the PC has no login yet); the code IS
+// the credential, so it is 256 bits of CSPRNG, single-use, short-lived and looked up
+// by its full digest, exactly as a session bearer is (db-kernel sessionTokenHash).
+
+const crypto = require('node:crypto');
+const { pool } = require('./pool');
+const { sessionTokenHash } = require('./db-kernel');
+
+const RUNNER_SOURCE = 'runner';
+const CODE_TTL_MS = 15 * 60 * 1000; // 15 minutes: long enough to paste, short enough to waste if leaked
+const CODE_PREFIX = 'abr_'; // recognisable in a pasted command, never part of the secret's entropy
+const LABEL_MAX = 80;
+
+const isRunnerSession = (session) => !!session && session.source === RUNNER_SOURCE;
+
+function cleanLabel(label) {
+  if (typeof label !== 'string') return null;
+  const s = label.replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, LABEL_MAX);
+  return s || null;
+}
+
+// Issue a one-time code for `builderId`. Returns { code, expires_at, id }. The
+// plaintext code exists only in this return value.
+async function issueCode({ builderId, label = null, now = Date.now() }, exec = pool) {
+  const code = CODE_PREFIX + crypto.randomBytes(32).toString('hex');
+  const expiresAt = new Date(now + CODE_TTL_MS);
+  const { rows } = await exec.query(
+    `INSERT INTO runner_enrollment_codes (builder_id, code_hash, label, expires_at)
+     VALUES ($1, $2, $3, $4)
+     RETURNING id, expires_at`,
+    [builderId, sessionTokenHash(code), cleanLabel(label), expiresAt]
+  );
+  return { id: rows[0].id, code, expires_at: rows[0].expires_at };
+}
+
+// Trade a code for a runner session. Returns { token, session_id, builder_id,
+// github_login, label } or a refusal { refused: 'code_invalid' | 'builder_inactive' }.
+// One transaction: the code is burned (used_at) by the same UPDATE that proves it
+// was live, so two PCs racing one code cannot both win. A wrong, used or expired
+// code all answer the same 'code_invalid', so the route leaks nothing about which.
+async function exchangeCode({ code, userAgent = null }, exec = pool) {
+  if (typeof code !== 'string' || !code.startsWith(CODE_PREFIX) || code.length > 200) {
+    return { refused: 'code_invalid' };
+  }
+  const client = typeof exec.connect === 'function' ? await exec.connect() : exec;
+  const release = () => { if (client !== exec && typeof client.release === 'function') client.release(); };
+  try {
+    await client.query('BEGIN');
+    const { rows } = await client.query(
+      `UPDATE runner_enrollment_codes c
+          SET used_at = now()
+         FROM builders b
+        WHERE c.code_hash = $1
+          AND c.used_at IS NULL
+          AND c.expires_at > now()
+          AND b.id = c.builder_id
+        RETURNING c.id, c.builder_id, c.label, b.github_login, b.status`,
+      [sessionTokenHash(code)]
+    );
+    const hit = rows[0];
+    if (!hit) {
+      await client.query('ROLLBACK');
+      return { refused: 'code_invalid' };
+    }
+    if (hit.status === 'inactive') {
+      await client.query('ROLLBACK');
+      return { refused: 'builder_inactive' };
+    }
+    const token = crypto.randomBytes(32).toString('hex');
+    const ua = [hit.label ? `runner:${hit.label}` : 'runner', userAgent].filter(Boolean).join(' · ').slice(0, 400);
+    const ins = await client.query(
+      `INSERT INTO builder_sessions (builder_id, token_hash, source, user_agent, expires_at)
+       VALUES ($1, $2, $3, $4, NULL)
+       RETURNING id`,
+      [hit.builder_id, sessionTokenHash(token), RUNNER_SOURCE, ua]
+    );
+    await client.query(
+      `UPDATE runner_enrollment_codes SET used_session_id = $2 WHERE id = $1`,
+      [hit.id, ins.rows[0].id]
+    );
+    await client.query('COMMIT');
+    return { token, session_id: ins.rows[0].id, builder_id: hit.builder_id, github_login: hit.github_login, label: hit.label };
+  } catch (err) {
+    try { await client.query('ROLLBACK'); } catch (_) { /* the original error wins */ }
+    throw err;
+  } finally {
+    release();
+  }
+}
+
+// The highest rank a runner session ACTS at (task 1004547). A runner does its
+// builder's ordinary work (claim, ship, grade, publish, file a blocker), and every
+// one of those routes is open at Metic. Anything gated above that is an owner's
+// decision, which an unattended machine does not make. `ranks` is the ladder,
+// highest authority first (db-kernel RANKS); an unknown rank is returned as is,
+// because requireRank already fails it closed.
+const RUNNER_RANK_CAP = 'metic';
+function capRunnerRank(rank, ranks) {
+  const i = ranks.indexOf(rank);
+  const cap = ranks.indexOf(RUNNER_RANK_CAP);
+  if (i === -1 || cap === -1) return rank;
+  return i < cap ? RUNNER_RANK_CAP : rank;
+}
+
+// Drop every SYSTEM permission from a held set, for a runner session. `isSystem` is
+// the government port's catalog.isSystem: true = system, false = not, null =
+// unknown key. Anything but an explicit false is dropped, so an unreadable catalog
+// leaves a runner with less, never more. Without a port at all every key goes.
+function withoutSystemPermissions(held, isSystem) {
+  const out = new Set();
+  if (typeof isSystem !== 'function') return out;
+  for (const key of held) {
+    let sys = null;
+    try { sys = isSystem(key); } catch (_) { sys = null; }
+    if (sys === false) out.add(key);
+  }
+  return out;
+}
+
+module.exports = {
+  isRunnerSession,
+  issueCode,
+  exchangeCode,
+  withoutSystemPermissions,
+  capRunnerRank,
+};

package/src/bongos/serve-internal.js

@@ -1214,10 +1214,15 @@ function mountInternalSurfaces(app) {
   // static handler. Gated per-request on the live enabled set so a disabled module's
   // assets 404 (defense in depth behind the no-injection above). Same Cache-Control
   // posture as the hall's own scripts.
+  //
+  // Served on EVERY host, the generic surface hosts (status.) included (task
+  // 1005081): the shared token sheet /modules/ui-design/public/tokens.css is one
+  // URL the hall, the landing, the status page and raise all load. A surface host
+  // still answers its own files first — its static handler above falls through
+  // only when the surface dir has no such file.
   const MODULE_ASSET_RE = /^\/modules\/([a-z][a-z0-9-]*)\/public\/(.+)$/;
   const MODULES_ROOT = path.join(ROOT, 'modules');
   app.get(MODULE_ASSET_RE, (req, res, next) => {
-    if (isModuleSurfaceHost(req)) return next();
     const m = req.path.match(MODULE_ASSET_RE);
     const key = m[1];
     let enabled = false;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.45'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');