@bongos/core 1.24.95 → 1.25.1

package/docs/api/openapi.json

@@ -2946,6 +2946,54 @@
         ]
       }
     },
+    "/autonomy/me/goals/{goalId}/stats": {
+      "get": {
+        "operationId": "get_autonomy_me_goals_goalId_stats",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "GET /autonomy/me/goals/:goalId/stats",
+        "description": "ONE GOAL, SEEN FROM THE CALLER'S RUNNER (task 1005243): the game's runner card on Home — tasks it shipped there, the tokens they took, the average task length and what is left, so the card can say roughly how long the rest takes. Read-only and the caller's own, behind `autonomy.run` like the picks.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `autonomy.run` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.run"
+        ],
+        "parameters": [
+          {
+            "name": "goalId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `goalId`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/precheck": {
       "get": {
         "operationId": "get_autonomy_precheck",
@@ -16807,6 +16855,105 @@
         ]
       }
     },
+    "/me/passkeys/authenticate/options": {
+      "post": {
+        "operationId": "post_me_passkeys_authenticate_options",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/authenticate/options",
+        "description": "POST /api/bongos/me/passkeys/authenticate/options — start a card check. rank: any-builder (own identity only). The challenge is bound to the caller.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysAuthenticateOptionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/me/passkeys/authenticate/verify": {
+      "post": {
+        "operationId": "post_me_passkeys_authenticate_verify",
+        "tags": [
+          "me"
+        ],
+        "summary": "POST /me/passkeys/authenticate/verify",
+        "description": "POST /api/bongos/me/passkeys/authenticate/verify — finish a card check. Body: { response } the browser's assertion. On success the CALLER'S session row is stamped; that stamp (never anything the client sends) is the step-up proof. rank: any-builder (own identity only).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/my-passkeys.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostMePasskeysAuthenticateVerifyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostMePasskeysAuthenticateVerifyResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/passkeys/browser.js": {
       "get": {
         "operationId": "get_me_passkeys_browser_js",
@@ -39720,6 +39867,35 @@
         },
         "additionalProperties": false
       },
+      "PostMePasskeysAuthenticateOptionsResponse": {
+        "type": "object",
+        "properties": {
+          "options": {}
+        },
+        "required": [
+          "options"
+        ]
+      },
+      "PostMePasskeysAuthenticateVerifyRequest": {
+        "type": "object",
+        "properties": {
+          "response": {}
+        },
+        "additionalProperties": false
+      },
+      "PostMePasskeysAuthenticateVerifyResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "valid_for_seconds": {}
+        },
+        "required": [
+          "ok",
+          "valid_for_seconds"
+        ]
+      },
       "PostMePasskeysRegisterOptionsResponse": {
         "type": "object",
         "properties": {
@@ -43561,9 +43737,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 696,
-  "x-schema-count": 731,
+  "x-endpoint-count": 699,
+  "x-schema-count": 734,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 462,
+  "x-response-schemas": 464,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 696 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 699 endpoints across 117 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -106,7 +106,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
-## `autonomy` (16)
+## `autonomy` (17)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -118,6 +118,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/autonomy/fence/priority` | `archon` | `goal_id` | The priority goal (task 1004453): which allowlisted goal the runner works first. |
 | POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id`, `working_goal_id`, `head`, `disk_head`, `main_head`, `claude_account`, `hold_until` | The runner's check-in, once per loop. |
 | PUT | `/api/bongos/autonomy/me/goals` | `metic+archon` | `goal_ids` | A builder picks which allowlisted goals THEIR runner works. |
+| GET | `/api/bongos/autonomy/me/goals/:goalId/stats` | `metic+archon` | — | ONE GOAL, SEEN FROM THE CALLER'S RUNNER (task 1005243): the game's runner card on Home — tasks it shipped there, the tokens they took, th… |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runner-setup.ps1` | `public` | — | the Windows first lines; see the note above. |
 | GET | `/api/bongos/autonomy/runner-setup.sh` | `public` | — | the Mac first lines; see the note above. |
@@ -567,7 +568,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/market-watch/settings/key` | `metic+archon` | `key` |  |
 | DELETE | `/api/bongos/market-watch/settings/key` | `metic+archon` | — |  |
 
-## `me` (63)
+## `me` (65)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -608,6 +609,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
 | GET | `/api/bongos/me/passkeys` | `any-builder` | — | GET /api/bongos/me/passkeys — the caller's registered cards. |
+| POST | `/api/bongos/me/passkeys/authenticate/options` | `any-builder` | validated | POST /api/bongos/me/passkeys/authenticate/options — start a card check. |
+| POST | `/api/bongos/me/passkeys/authenticate/verify` | `any-builder` | `response` | POST /api/bongos/me/passkeys/authenticate/verify — finish a card check. |
 | GET | `/api/bongos/me/passkeys/browser.js` | `any-builder` | — | GET /api/bongos/me/passkeys/browser.js — the vetted @simplewebauthn/browser bundle, served same-origin so the page needs no CDN and no bu… |
 | POST | `/api/bongos/me/passkeys/register/options` | `any-builder` | validated | POST /api/bongos/me/passkeys/register/options — start adding a card. |
 | POST | `/api/bongos/me/passkeys/register/verify` | `any-builder` | `response`, `nickname` | POST /api/bongos/me/passkeys/register/verify — finish adding a card. |

package/docs/architecture.md

@@ -273,6 +273,8 @@ store_module_prices(id, module_key, price_cents, price_credits, set_by, set_at)
 
 Passkey foundation (migration `core_277`, task 1004750, [ADR 0382](adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) D1/D6 — storage only; the ceremonies and routes are their own tasks; code in `src/bongos/passkeys.js`):
 
+Card step-up gate (migration `core_298`, task 1004747, ADR 0382 D2/D5; code in `src/bongos/step-up.js`): `builders.require_card` (default false) + `builder_sessions.card_verified_at`, stamped only by `POST /me/passkeys/authenticate/verify`. `requireCardStepUp` (also `api.requireCardStepUp` for modules) refuses 403 `card_required` when the builder's flag is on and the session has no card tap in the last 10 minutes; it fails closed. Mounted on rank set, admin session revoke (the own-session panic button stays open), render-deploy act + PUT app, treasury pots/borrow answers. The Archon switch that sets the flag is task 1004748.
+
 ```
 passkey_credentials(id, credential_id UNIQUE, builder_id FK, public_key bytea, sign_count,
               transports[], aaguid, nickname, created_at, last_used_at)
@@ -322,7 +324,7 @@ payout_tax_details(id, builder_id, status collected|incomplete, collected_by pro
               -- POST /payouts/ndas, POST /payouts/tax-details (payout.approve + web session).
 ```
 
-Builder payouts (migration `core_290`, task 1003183, [ADR 0397](adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) D7 — a builder is paid for a task exactly once; `src/bongos/builder-payouts.js`, routes `GET`/`POST /payouts/builder-payouts` gated `payout.approve` plus the person's own web session for the POST; the `payout` movement is booked through the economy module's `economy.account` port in the same transaction. No processor adapter exists yet, so every payout is recorded owed and held `no_processor`):
+Builder payouts (migration `core_298`, task 1003183, [ADR 0397](adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) D7 — a builder is paid for a task exactly once; `src/bongos/builder-payouts.js`, routes `GET`/`POST /payouts/builder-payouts` gated `payout.approve` plus the person's own web session for the POST; the `payout` movement is booked through the economy module's `economy.account` port in the same transaction. No processor adapter exists yet, so every payout is recorded owed and held `no_processor`):
 
 ```
 builder_payouts_owed(id, builder_id FK, task_id FK, approval_id FK payout_approvals,

package/docs/copy-inventory.md

@@ -10,7 +10,7 @@
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 180 | 2072 |
+| `builders-hall` | `modules/hall-ui/public` | 181 | 2072 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 89 |
 | `landing` | `modules/public-landing/public` | 10 | 1023 |
 
@@ -316,7 +316,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4df46e2be815` | certain | Clear the key? | `modules/hall-ui/public/market-watch-settings.js:218` |
 | `593dda3178eb` | certain | Click to copy | `modules/hall-ui/public/copy-on-click.js:137` |
 | `34624d39ff29` | certain | Clone the project to your machine and run | `modules/hall-ui/public/setup-gate.js:34` |
-| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:235` |
+| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:293` |
 | `70f6a704d504` | certain | Close it | `modules/hall-ui/public/copy-desk.html:140` |
 | `053e576ba9a3` | certain | Close options | `modules/hall-ui/public/shell-game.js:454` |
 | `d12a2fb5730d` | certain | Close this flag | `modules/hall-ui/public/copy-desk.html:116` |
@@ -513,7 +513,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `89d9c0962048` | certain | Everything that fell out of it | `modules/hall-ui/public/idea.js:420` |
 | `57d5ba0fdefb` | certain | Exit full screen | `modules/hall-ui/public/shell.js:622` |
 | `94339ddaeeea` | certain | Explore: the sky reveals itself as you follow routes from where you begin. | `modules/hall-ui/public/goal-map.html:75` |
-| `75bf2f13e4c0` | certain | Fast forward | `modules/hall-ui/public/home-city.js:336` |
+| `75bf2f13e4c0` | certain | Fast forward | `modules/hall-ui/public/home-city.js:337` |
 | `8608a2dfdf61` | certain | File a blocker | `modules/hall-ui/public/blockers.js:316` |
 | `de62f4cc7d2e` | certain | File a bug or idea | `modules/hall-ui/public/ideas.html:55` |
 | `297a6d0a8608` | certain | File conflicts in your goals | `modules/hall-ui/public/goal-inbox.js:125` |
@@ -1411,7 +1411,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:37` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:83` |
 | `08ec02eb31fb` | certain | The project city building up, week by week | `modules/hall-ui/public/shell-game.js:181` |
-| `ca10fbab561e` | certain | The project this week | `modules/hall-ui/public/home-city.js:324` |
+| `ca10fbab561e` | certain | The project this week | `modules/hall-ui/public/home-city.js:325` |
 | `dc2d6fd0350a` | certain | The project’s life so far | `modules/hall-ui/public/genesis-home.js:156` |
 | `169a03d777a1` | certain | The rank above yours is {…}. | `modules/hall-ui/public/profile-own.js:101` |
 | `c0034db3281c` | certain | The reason is recorded in the audit log. This is recoverable: a retired task can be restored to the backlog wi | `modules/hall-ui/public/task.js:840` |
@@ -1486,7 +1486,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:237` |
 | `e7a289134dc3` | certain | This page shows no words the reader could find. | `modules/hall-ui/public/tweak-editor.js:246` |
 | `d4b3b5556986` | certain | This page's reference docs | `modules/hall-ui/public/page-notes.js:166` |
-| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:237` |
+| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:295` |
 | `5bdcbec770dd` | certain | This project has no slash commands yet. | `modules/hall-ui/public/commands.js:37` |
 | `f53b83bfbe54` | certain | This project has no watch rules yet. | `modules/hall-ui/public/market-watch-rules.js:62` |
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:412` |
@@ -1499,10 +1499,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:426` |
 | `9333d71e3e15` | certain | This speciality offers no skills to choose. | `modules/hall-ui/public/speciality-tools.js:125` |
 | `62b0940efd7d` | certain | This task is already retired. Promote restores it to the backlog. | `modules/hall-ui/public/task.js:816` |
-| `1d77cc332601` | certain | This week's builders, ranked by what they did | `modules/hall-ui/public/home-city.js:327` |
+| `1d77cc332601` | certain | This week's builders, ranked by what they did | `modules/hall-ui/public/home-city.js:328` |
 | `4301ecd67891` | certain | This would fail. | `modules/hall-ui/public/deploy.js:524` |
 | `2ad5823d2cd7` | certain | Three dials, all settings rather than code: | `modules/hall-ui/public/government.html:55` |
-| `3fe05a59a64d` | certain | Time, from the start of the version to live | `modules/hall-ui/public/home-city.js:339` |
+| `3fe05a59a64d` | certain | Time, from the start of the version to live | `modules/hall-ui/public/home-city.js:340` |
 | `f158ed1c24a2` | certain | Toggle fullscreen | `modules/hall-ui/public/diagram-viewer.js:105` |
 | `7dfdc26f9f79` | certain | Tokens refresh on use; re-issuing never signs you out anywhere else. | `modules/hall-ui/public/settings.html:183` |
 | `8f38bbae750b` | certain | Tool errors | `modules/hall-ui/public/watch.html:199` |

package/docs/copy-registry.json

@@ -12,7 +12,7 @@
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 180,
+      "files": 181,
       "strings": 2072
     },
     "status-dashboard": {
@@ -5208,7 +5208,7 @@
       "surface": "builders-hall",
       "text": "Close actions",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 235,
+      "line": 293,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6981,7 +6981,7 @@
       "surface": "builders-hall",
       "text": "Fast forward",
       "file": "modules/hall-ui/public/home-city.js",
-      "line": 336,
+      "line": 337,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15063,7 +15063,7 @@
       "surface": "builders-hall",
       "text": "The project this week",
       "file": "modules/hall-ui/public/home-city.js",
-      "line": 324,
+      "line": 325,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15738,7 +15738,7 @@
       "surface": "builders-hall",
       "text": "This place",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 237,
+      "line": 295,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15855,7 +15855,7 @@
       "surface": "builders-hall",
       "text": "This week's builders, ranked by what they did",
       "file": "modules/hall-ui/public/home-city.js",
-      "line": 327,
+      "line": 328,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15882,7 +15882,7 @@
       "surface": "builders-hall",
       "text": "Time, from the start of the version to live",
       "file": "modules/hall-ui/public/home-city.js",
-      "line": 339,
+      "line": 340,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3438,5 +3438,11 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.93 with no explicit bump. run 43302410261. (task 1002620)
   1.24.95 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.94 with no explicit bump. run 43304959846. (task 1002620)
+  1.24.96 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.95 with no explicit bump. run 43307125735. (task 1002620)
+  1.25.0 — adds `requireCardStepUp`, the hardware-card step-up gate a module mounts
+        after its permission gate (task 1004747, ADR 0382). Additive, so MINOR.
+  1.25.1 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.25.0 with no explicit bump. run 43313162829. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-inventory.json

@@ -570,6 +570,8 @@
         "modules/hall-ui/public/home-city-draw.js",
         "modules/hall-ui/public/home-gallery.js",
         "modules/hall-ui/public/home-idea-box.js",
+        "modules/hall-ui/public/runner-button.js",
+        "modules/hall-ui/public/home-runner.js",
         "modules/hall-ui/public/home-city.js",
         "modules/hall-ui/public/hall-ask.js",
         "modules/hall-ui/public/blockers-lib.js",

package/docs/page-readings.json

@@ -283,7 +283,7 @@
       "surface": "builders",
       "title": "The city",
       "states_read": ["city","fullscreen","focus","pins","living","card","card-ask"],
-      "files_hash": "804ce56d156d7046",
+      "files_hash": "0367a0e57f2fcfb1",
       "reading_hash": "277096d903879a57",
       "counts": {"lines":26,"placed":9,"shared":6,"unplaced":11},
       "omitted": {"data":7},
@@ -613,7 +613,7 @@
       "surface": "builders",
       "title": "The sky",
       "states_read": ["tour","sky","wells","ledger","full","full-back","out"],
-      "files_hash": "a5f2d9cada6d1773",
+      "files_hash": "9de2854d844d990f",
       "reading_hash": "4a879397a84631e3",
       "counts": {"lines":50,"placed":25,"shared":6,"unplaced":19},
       "omitted": {"data":10},
@@ -954,8 +954,8 @@
       "surface": "builders",
       "title": "Builders' Hall",
       "states_read": ["home","out","founding","genesis","decide","demo"],
-      "files_hash": "057978d931dfd529",
-      "reading_hash": "c46b0ff89002a2d9",
+      "files_hash": "36c7410d9c8aeae0",
+      "reading_hash": "45468116976bf674",
       "counts": {"lines":32,"placed":12,"shared":8,"unplaced":12},
       "omitted": {"data":5},
       "notes": ["founding: an action failed (page.focus: Timeout 6000ms exceeded.); read as it stood"],
@@ -977,7 +977,7 @@
         {"key":"L0015","section":"Needs your attention13","text":"Ideas awaiting triage","placement":"placed","file":"modules/hall-ui/public/builders.js","line":320,"string_id":"e181637c5a5e"},
         {"key":"L0016","section":"Needs your attention13","text":"Requires project {…} fix","placement":"unplaced"},
         {"key":"L0017","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":514,"string_id":"1883ad7f07fc"},
-        {"key":"L0018","section":"Needs your attention13","text":"core 1.24.93","placement":"unplaced"},
+        {"key":"L0018","section":"Needs your attention13","text":"core 1.24.94","placement":"unplaced"},
         {"key":"L0019","section":"Needs your attention13","text":"Skip","placement":"unplaced"},
         {"key":"L0020","section":"Needs your attention13","text":"Built on","placement":"placed","file":"modules/hall-ui/public/welcome-boot.js","line":183,"string_id":"fef59346ffee"},
         {"key":"L0021","section":"Needs your attention13","text":"cloudbongos.com","placement":"unplaced"},
@@ -3159,7 +3159,7 @@
       "surface": "builders",
       "title": "Your thinking",
       "states_read": ["tour","sky","list","simple","full-idea","full","full-list","full-back","out"],
-      "files_hash": "fa151338327f0a86",
+      "files_hash": "96c460b71d47125f",
       "reading_hash": "b73f848b46b0f9b8",
       "counts": {"lines":50,"placed":25,"shared":6,"unplaced":19},
       "omitted": {"data":10},

package/migrations/core_298_card_step_up.sql

@@ -0,0 +1,16 @@
+-- core_298 card step-up: the per-builder requirement flag and the per-session proof
+-- Applied under task 1004747 (ADR 0382 D2, D4).
+--
+-- WHY. A builder who has a registered hardware card can be required to tap it before
+-- the sensitive actions (rank changes, deploy, session revoke, payouts). The server
+-- needs two things to keep: whether the requirement is on for a builder, and when a
+-- given session last proved a card.
+--
+--  * builders.require_card  default false: nothing changes for anybody until an
+--    Archon switches it on (that switch is its own task). Read fresh per request.
+--  * builder_sessions.card_verified_at  set ONLY by the card verify route, on the
+--    server-side session row. Nothing the client sends counts as proof, and a new
+--    session starts with none.
+
+ALTER TABLE builders         ADD COLUMN IF NOT EXISTS require_card boolean NOT NULL DEFAULT false;
+ALTER TABLE builder_sessions ADD COLUMN IF NOT EXISTS card_verified_at timestamptz;

package/modules/autonomy/db.js

@@ -429,6 +429,53 @@ async function removeRunner({ builderId, host }) {
   return r ? { host: r.host, session_id: r.session_id ? String(r.session_id) : null } : null;
 }
 
+// ── one goal, seen from the builder's runner (task 1005243) ──────────────────
+//
+// readRunnerGoalStats — what the game's runner card says about ONE goal: how
+// many tasks there the builder's runner has shipped, the tokens those sessions
+// spent, their average length, and how many tasks are still to build. All of it
+// is the ledger's answer: a runner's claim carries `autonomous` (set by the
+// server from the claiming session, core_295), a shipped claim is outcome
+// 'shipped', and a session's tokens and length are what ship.js uploaded to
+// session_records. SCOPED TO ONE BUILDER, like the heartbeat read: nobody reads
+// another builder's runner.
+//
+// ITS COST. `mine` starts from the caller's claims through core_263's
+// idx_claims_builder_history (builder_id, claimed_at), so it reads one builder's
+// claims, never the table; session_records goes through idx_session_records_builder,
+// and the tasks count through the goal's own rows. The card asks only while it is
+// open (home-runner.js, every 15 s while the tab is visible).
+async function readRunnerGoalStats(builderId, goalId) {
+  const { rows } = await pool.query(
+    `WITH mine AS (
+       SELECT DISTINCT c.task_id
+         FROM claims c JOIN tasks t ON t.id = c.task_id
+        WHERE c.builder_id = $1 AND c.autonomous AND c.outcome = 'shipped' AND t.goal_id = $2
+     ), spent AS (
+       SELECT COALESCE(SUM(sr.total_tokens), 0)::bigint AS tokens,
+              AVG(sr.duration_seconds) FILTER (WHERE sr.duration_seconds > 0) AS avg_s
+         FROM session_records sr
+        WHERE sr.builder_id = $1 AND sr.task_ids && ARRAY(SELECT task_id FROM mine)
+     )
+     SELECT (SELECT COUNT(*) FROM mine)::int AS tasks_done,
+            spent.tokens, spent.avg_s,
+            -- what is left is told only for a goal the project opened to runners, so
+            -- the read is no window onto a goal's size the caller could not send to
+            CASE WHEN EXISTS (SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = $2)
+                 THEN (SELECT COUNT(*) FROM tasks WHERE goal_id = $2 AND status IN ('ready', 'active'))::int END AS tasks_left
+       FROM spent`,
+    [builderId, goalId]
+  );
+  const r = rows[0] || {};
+  const avg = r.avg_s == null ? null : Math.round(Number(r.avg_s));
+  return {
+    tasks_done: Number(r.tasks_done) || 0,
+    tokens: Number(r.tokens) || 0,
+    avg_task_seconds: Number.isFinite(avg) && avg > 0 ? avg : null,
+    tasks_left: r.tasks_left == null ? null : Number(r.tasks_left) || 0,
+  };
+}
+
 module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
@@ -449,4 +496,5 @@ module.exports = {
   setBuilderGoals,
   setBuilderPause,
   readAllRunnerScopes,
+  readRunnerGoalStats,
 };

package/modules/autonomy/routes/autonomy.js

@@ -376,6 +376,21 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // ONE GOAL, SEEN FROM THE CALLER'S RUNNER (task 1005243): the game's runner
+  // card on Home — tasks it shipped there, the tokens they took, the average
+  // task length and what is left, so the card can say roughly how long the rest
+  // takes. Read-only and the caller's own, behind `autonomy.run` like the picks.
+  router.get('/autonomy/me/goals/:goalId/stats', auth.requireBuilder, auth.requirePermission('autonomy.run'), async (req, res) => {
+    const goalId = Number(req.params.goalId);
+    if (!Number.isSafeInteger(goalId) || goalId <= 0) return res.fail('goal_id_invalid', { status: 400, message: 'goal id must be a positive integer' });
+    try {
+      res.json({ goal_id: goalId, ...(await db.readRunnerGoalStats(req.builder.id, goalId)) });
+    } catch (err) {
+      log.error('[gds] GET /autonomy/me/goals/:goalId/stats', err);
+      res.fail('runner_stats_unreadable', { status: 503, message: 'could not read the runner stats' });
+    }
+  });
+
   // The owner pauses or resumes ONE builder's runner without throwing the master
   // switch. Same atom as the kill switch: stopping a machine is the same act
   // whether it is everyone's or one person's, and the paused builder must not be

package/modules/economy/module.json

@@ -8,6 +8,6 @@
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "migrations": true, "routes": ["cost", "credits", "earnings", "leaderboard", "project-account", "balances", "reward"], "pollers": ["ledger-check"] },
-  "provides": ["reward", "economy.account"],
+  "provides": ["reward", "economy.account", "economy.processor"],
   "consumes": []
 }