@bongos/core 1.19.1072 → 1.19.1074

package/modules/economy/routes/credits.js

@@ -93,8 +93,7 @@ async function respondWithLedger(res, builderId, opts) {
 module.exports = function buildCreditsRouter() {
   const router = express.Router();
 
-  // Route ORDER is deliberate, and the same rule modules/dev-box/routes/box.js
-  // documents: the route-rank auditor classifies from a lookahead window that
+  // Route ORDER is deliberate: the route-rank auditor classifies from a lookahead window that
   // checks requireRank/requirePermission before requireBuilder, so the
   // PRIVILEGED route is declared FIRST. Below the own-scoped one, its gate
   // would bleed upward and mislabel that route as privileged.

package/modules/government/catalog.js

@@ -47,8 +47,8 @@
 // one; the Archon tab reads `PRINCIPALS` to SHOW them and has no counterpart write.
 //
 // OWNERSHIP SCOPE — the third AXIS (BV1.R100, ADR 0151 §3). "May act on OWN X" is a
-// PARAMETERIZED permission, not a global grant: box.manage.own ≠ the cross-owner
-// box authority. Two optional fields make that axis explicit DATA (the way
+// PARAMETERIZED permission, not a global grant: task.abandon.own ≠ the cross-owner
+// task authority. Two optional fields make that axis explicit DATA (the way
 // `principal` made the identity axis data) rather than something inferred from a
 // key's spelling:
 //   • scope    — 'own'  = ownership-scoped. Holding it authorizes acting ONLY on a
@@ -62,11 +62,11 @@
 //                'any' = the CROSS-OWNER counterpart over the same resource: it
 //                         reaches every owner's row, so no predicate applies.
 //                null  = not ownership-scoped (the resource has no owner axis).
-//   • resource — WHAT is owned ('claim', 'box', 'memory', …). It is what LINKS an
+//   • resource — WHAT is owned ('claim', 'task', 'memory', …). It is what LINKS an
 //                'own' key to its 'any' counterpart, which a name cannot: the
-//                cross-owner box authority is spelled `box.fleet.manage`, while
-//                `task.claim.any` ends in `.any` and means "any task in the pool",
-//                not "any owner's resource". Inferring the axis from the suffix
+//                cross-owner authority over `task.abandon.own` is spelled plain
+//                `task.abandon`, while `task.claim.any` ends in `.any` and means
+//                "any task in the pool", not "any owner's resource". Inferring the axis from the suffix
 //                would get both of those wrong — hence data.
 // Asserted at load: scope ⟺ resource; a `.own`-suffixed key MUST declare scope
 // 'own' (a namespace can never outrun the data); a scoped key needs a real rank
@@ -220,7 +220,6 @@ const PERMISSIONS = [
   { key: 'llm_cache.use', system: false, floor: 'metic', guards: 'POST /llm-cache/{lookup,store}' },
   { key: 'backup.manage', system: false, floor: 'metic', guards: 'GET /backup/status, POST /backup/trigger' },
   { key: 'source.clone.local', system: false, floor: 'metic', guards: 'Metic+ local clone / collaborator invite (ADR 0035)' },
-  { key: 'box.source.full', system: false, floor: 'metic', guards: 'GET /box/source-access → full (vs starter); boxScopeForRank' },
   // Agent authoring, split in two because the two acts differ in consequence
   // (task 1002493). Authoring writes a definition; ARMING is what turns a piece
   // of text into something that spends money and reads the repo, and it is the
@@ -252,7 +251,6 @@ const PERMISSIONS = [
   { key: 'criterion.unsatisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/unsatisfy (ADR 0157, was archon)' },
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
-  { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', verb: 'manage', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
   { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon); also GET /autonomy/runs, the gate\'s past decisions (task 1002669)' },
   { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
   // Metic by the discord.channels.manage analogue — configuring a project-wide
@@ -334,9 +332,6 @@ const PERMISSIONS = [
   // against another builder's claim. A future `claim.manage.any` (verb `manage`)
   // would dominate `act` and belongs here; `claim.release.any` never does.
   { key: 'task.act.own', system: false, floor: 'xenos', scope: 'own', resource: 'claim', verb: 'act', counterpart: [], guards: 'act on OWN active claim (release, cost, notes) — ownership-scoped' },
-  // The one family whose counterpart is REAL: `box.fleet.manage` is the same `manage`
-  // verb over every owner's box, so it genuinely subsumes managing your own.
-  { key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage'], guards: 'own dev-box lifecycle — ownership-scoped' },
   // Empty for the same reason as task.act.own: `memory.read.any` READS every
   // builder's memory, which is not the authority to MANAGE one. This is the pair the
   // task-1002671 verification probed (finding 12) — a read grant was admitting a
@@ -373,12 +368,12 @@ const PERMISSIONS = [
   { key: 'blocker.file', system: false, floor: 'xenos', guards: 'POST /blockers' },
   { key: 'idea.file', system: false, floor: 'xenos', guards: 'POST /inbox (own idea capture)' },
   { key: 'page.view.public', system: false, floor: 'xenos', guards: 'public read surfaces (incl. xenos)' },
-  // ADR 0157: floor archon→metic, which is what opens /watch, /harbor and /gate to the
+  // ADR 0157: floor archon→metic, which is what opens /watch and /gate to the
   // working rank. The gate FUNCTION was renamed to match (`requireArchonPage` →
   // `requireGovernmentPage`) once the floor moved. Viewing is all this grants: every
   // write those pages reach is its own atom, and `government.manage` (the
   // ranks/permissions tab) stayed archon.
-  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /harbor, /gate, /government (requireGovernmentPage; write = government.manage, archon)' },
+  { key: 'page.view.government', system: false, floor: 'metic', guards: 'the government/monitoring pages — /watch, /gate, /government (requireGovernmentPage; write = government.manage, archon)' },
 ];
 
 // ── invariants asserted at module load (fail loud on an authoring typo) ─────────
@@ -394,8 +389,9 @@ const OWNERSHIP_SCOPES = Object.freeze(['own', 'any']);
 // row — a read grant admitting a write.
 //
 // The verb is DECLARED, never parsed out of the key string. A positional parse is
-// wrong on the live population (`box.fleet.manage` is resource `box`, verb `manage`
-// — the middle segment is not the verb), and the same reason `scope` is data:
+// wrong on the live population (`task.abandon` is verb `act`, a word the key never
+// spells; `me.wandering.set` is resource `builder_prefs`, not `me`), and the same
+// reason `scope` is data:
 // "the namespace can never outrun the data".
 const OWNERSHIP_VERBS = Object.freeze(['read', 'set', 'release', 'act', 'manage']);
 // Which verbs a verb SUBSUMES, beyond itself (every verb dominates itself). Kept
@@ -549,7 +545,7 @@ for (const [resource, fam] of _byResource) {
     throw new Error(`government catalog: resource "${resource}" declares a cross-owner permission (${fam.any.join(', ')}) with no ownership-scoped counterpart`);
   }
   // Reaching EVERY owner's row must never be cheaper than reaching your own. If it
-  // were, a rank could manage the whole fleet but not its own box — the model
+  // were, a rank could act on everyone's rows but not its own — the model
   // inverted, and the Government tab would render the wider grant as the safer one.
   for (const anyKey of fam.any) {
     for (const ownKey of fam.own) {
@@ -740,7 +736,7 @@ function crossOwnerKeys() {
   return PERMISSIONS.filter((p) => p.scope === 'any').map((p) => p.key);
 }
 // The DECLARED escalation path for `key` — what a route offers as the alternative
-// to owning the row ("your own box, or box.fleet.manage"). Empty when nothing may
+// to owning the row ("a task you created, or task.abandon"). Empty when nothing may
 // escalate past it, which is the common case.
 //
 // Read straight off the key's own `counterpart`, NOT derived from its resource

package/modules/government/migrations/government_019_retire_box_permissions.sql

@@ -0,0 +1,33 @@
+-- government_019_retire_box_permissions.sql — REVOKE the three dev-box permission
+-- keys from every rank that holds them (task 1003894, goal 1000120).
+--
+-- Goal 1000120 removed the dev box: its module and routes (task 1003892), and in
+-- task 1003894 the three catalog keys that gated them — `box.source.full`,
+-- `box.fleet.manage` and `box.manage.own`. The catalog is the DECLARATION; the
+-- grant rows are what a builder's permission set is folded from. With the keys
+-- gone from modules/government/catalog.js the resolver already drops these rows
+-- (a key the catalog does not define grants nothing), so this changes no one's
+-- effective authority. It keeps the grant table honest: every row in it names a
+-- permission that exists.
+--
+-- ONE statement for EVERY rank, seeded and custom. The three keys were
+-- `system: false`, so an Archon could have granted them to a custom rank, and a
+-- per-rank DELETE would leave those rows behind. tests/government_seed.mjs reads
+-- this shape (no `rank_key` predicate) as "revoked from every rank" when it folds
+-- the grant migrations into the effective seed.
+--
+-- NOT governance_002 or governance_007: those granted the keys and are applied
+-- history — migrations are run-once and never rewritten.
+--
+-- NOT idempotent by ON CONFLICT — a DELETE needs none. Re-running it deletes zero
+-- rows and raises nothing.
+--
+-- `government_rank_permissions`, NOT the `governance_*` spelling:
+-- government_001_rename_from_governance renamed the table with no shim.
+
+BEGIN;
+
+DELETE FROM government_rank_permissions
+ WHERE permission_key IN ('box.source.full', 'box.fleet.manage', 'box.manage.own');
+
+COMMIT;

package/modules/government/module.json

@@ -2,6 +2,7 @@
   "key": "government",
   "title": "Government (configurable ranks & permissions)",
   "description": "Discord-style configurable ranks and permissions (ADR 0151, BONGOS-V1 goal 1000030; renamed governance\u2192government by ADR 0174). Permissions are the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; this module owns the code-defined permission catalog (each key flagged `system` = trust-boundary, `substrate` = enforced out of band, or operational = delegable) plus the compatibility seed that reproduces the rank thresholds exactly. A core-domain module, default-on: a Cloud Bongos instance ships configurable ranks the way it ships its status page. The word `role` is deliberately absent here \u2014 it is reserved for the three crafts (Artist, Ideator, Builder). Preserves ADR 0016 (authority resolved server-side, per request, uncached).",
+  "version": "1.0.0",
   "coreVersion": "^1.18.0",
   "default": true,
   "maintenance": {

package/modules/government/protected-surfaces.json

@@ -41,17 +41,9 @@
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
     { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/government/ entry directly above (ADR 0086 §4)." },
-    { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
-    { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },
-    { "glob": "modules/dev-box/box-credential.js", "group": "box-access", "why": "mints the box source credential" },
-    { "glob": "scripts/gds/provision-config.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. The group already protects who DECIDES box access (boxes.js, box-access.js, box-credential.js) but protected nothing that HOLDS the infrastructure credentials those decisions spend — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
-    { "glob": "scripts/gds/provision-net.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/gds/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
-    { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
-    { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
-    { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
-    { "glob": "scripts/gds/box-auth-check.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
-    { "glob": "scripts/gds/box-sync.js", "group": "box-access", "why": "task 1004024. Split out of the box.js family and never registered; box-infra.js was already listed by name above." },
-    { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
+    { "glob": "scripts/gds/provision-config.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. Before this entry nothing that HOLDS the control plane's infrastructure credentials was protected at any rank — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
+    { "glob": "scripts/gds/provision-net.js", "group": "control-plane", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/gds/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
+    { "glob": "scripts/gds/do-api.js", "group": "control-plane", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the two above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
     { "glob": "modules/grading/grader-config.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },
     { "glob": "modules/grading/grader-model.js", "group": "pipeline", "why": "task 1004024. Carved out of grader.js: the deterministic permission-path pre-pass, the server-side score guards a model cannot talk past, the subagent spawn and the prompt. grader.js alone protected the facade and none of the gate." },

package/modules/government/resolver.js

@@ -29,7 +29,6 @@
 
 const catalog = require('./catalog');
 const db = require('./db');
-const sessionScopes = require('./session-scopes');
 
 // Pure core of the RANK axis, split out so it is unit-testable without a database.
 //
@@ -93,7 +92,7 @@ async function resolveBuilderPermissions(builderId) {
 // false so a mis-authored gate denies rather than admits (the same posture
 // requireRank takes on an all-unknown allow-list).
 //
-// It also REFUSES ownership-scoped keys (R100). "Do you hold box.manage.own" has
+// It also REFUSES ownership-scoped keys (R100). "Do you hold task.abandon.own" has
 // no unconditional answer — the permission is parameterized by a resource this
 // function was never given — and returning true would be precisely the collapse
 // of `.own` into an unconditional grant the axis exists to prevent. The caller
@@ -116,7 +115,7 @@ async function builderHasPermissions(builderId, required) {
 //                       handler that loaded the row knows it)
 //
 // The resolver structurally cannot know (2): it is handed a builder id, never a
-// box/claim/memory row. So the caller SUPPLIES the owner and the model refuses to
+// claim/memory/task row. So the caller SUPPLIES the owner and the model refuses to
 // answer without it — `ownerId` is not an option, it is the second half of the
 // question. That is what keeps `.own` from degrading into `.any`: there is no code
 // path here that turns an ownership-scoped key into an admit on its own.
@@ -156,7 +155,7 @@ async function authorizeOwned(builderId, key, context) {
 
 // The composition every own-scoped route actually wants: reach this row because it
 // is YOURS, or because you hold the cross-owner permission over its resource
-// family (claim.release.any, memory.read.any, box.fleet.manage). One resolve, both
+// family (task.abandon for task.abandon.own). One resolve, both
 // branches. A resource with no cross-owner form by design (credential) simply has
 // no second branch, so the answer stays own-only.
 async function authorizeOwnedOrAny(builderId, ownKey, context) {
@@ -167,46 +166,6 @@ async function authorizeOwnedOrAny(builderId, ownKey, context) {
   return sameOwner(context && context.ownerId, builderId) && held.includes(ownKey);
 }
 
-// ── the SESSION-SCOPE axis (R99, ADR 0151 §3) ───────────────────────────────────
-// The FOURTH entry point, separate for the same reason the other three are: it
-// answers a different question with a different input. Ranks answer "what may this
-// PERSON do"; a principal answers "what may this MACHINE do"; an ownership scope
-// answers "whose row may it be done to"; a session-scope answers "how much of that
-// does THIS CREDENTIAL carry". A dev-box token is minted onto a machine outside the
-// ADR 0016 trust boundary (#919/SR#2, ADR 0053), so it must stay limited even when
-// its builder is an Archon — which no rank-shaped answer can express.
-//
-// A SESSION-SCOPE CAN ONLY EVER NARROW, in both directions:
-//   • INTERSECTION, never union. The scope may not GRANT a permission the ranks do
-//     not confer — so the composition below is written as a FILTER of the RANK
-//     answer. There is no branch here that can add a key, which is what makes
-//     "a box token cannot escalate" structural rather than merely intended.
-//   • DENY-BY-DEFAULT. A key the allow-list does not name is denied; an
-//     unrecognised session source resolves to NOTHING rather than to "full".
-// Widening is therefore not expressible without deleting the filter, and R103's
-// parity is untouched: effectivePermissions is the unchanged RANK answer this
-// composes ON TOP of, never inside.
-//
-// Pure and DB-free (the DB half is resolveBuilderPermissions'), so an unknown key
-// on an allow-list is inert as well as refused at load: it can never appear in the
-// catalog-filtered rank answer, so it can never survive the intersection.
-function narrowToSessionScope(rawKeys, source) {
-  const scope = sessionScopes.scopeFor(source);
-  if (!scope) return Object.freeze([]); // unrecognised source → no authority at all
-  const held = effectivePermissions(rawKeys);
-  if (scope.unscoped) return held; // this credential narrows nothing (cli/web)
-  const allowed = new Set(scope.permissions);
-  return Object.freeze(held.filter((key) => allowed.has(key)));
-}
-
-// What can THIS SESSION actually do? The builder's ranks ∩ this session's scope,
-// as a frozen sorted array of catalog keys. Fails closed BEFORE touching the DB on
-// a source the registry does not declare.
-async function resolveSessionPermissions(builderId, source) {
-  if (!sessionScopes.scopeFor(source)) return Object.freeze([]);
-  return narrowToSessionScope(await resolveBuilderPermissions(builderId), source);
-}
-
 module.exports = {
   resolveBuilderPermissions,
   builderHasPermissions,
@@ -216,6 +175,4 @@ module.exports = {
   sameOwner,
   authorizeOwned,
   authorizeOwnedOrAny,
-  narrowToSessionScope,
-  resolveSessionPermissions,
 };

package/modules/government/routes/government.js

@@ -78,8 +78,6 @@ const governmentPort = {
   sameOwner: resolver.sameOwner,
   isOwnershipScoped: catalog.isOwnershipScoped,
   crossOwnerKeysFor: catalog.crossOwnerKeysFor,
-  resolveSessionPermissions: resolver.resolveSessionPermissions,
-  narrowToSessionScope: resolver.narrowToSessionScope,
   sessionScopeFor: sessionScopes.scopeFor,
   listSessionScopes: () => sessionScopes.SESSION_SCOPES,
   // The Board Room's membership axis (R06 of goal 1000069): who governs, right

package/modules/government/session-scopes.js

@@ -1,127 +1,87 @@
 'use strict';
 
-// modules/government/session-scopes.js — the SESSION-SCOPE axis (ADR 0151 §3, BV1.R99).
+// modules/government/session-scopes.js — the SESSION-SOURCE registry (ADR 0151 §3, BV1.R99).
 //
-// The FOURTH axis, and the only one attached to the TOKEN rather than to the
-// builder. Ranks say what a person may do (R95); a principal's identity says what
-// a machine may do (R98); an ownership scope says whose row it may be done to
-// (R100); a SESSION-SCOPE says how much of that authority this particular
-// credential carries. A dev-box session is minted onto a machine OUTSIDE the ADR
-// 0016 trust boundary (#919/SR#2, ADR 0053), so it must stay limited even when its
-// builder is an Archon.
+// The one government axis attached to the TOKEN rather than to the builder: which
+// kinds of session may authenticate at all. Every builder_sessions row carries a
+// `source`; session-scopes.json (next to this file) declares the sources this
+// instance accepts, and a session whose source it does not declare is DENIED by the
+// kernel on every route and page. Every declared source carries its builder's full
+// rank authority.
 //
-// A SESSION-SCOPE CAN ONLY EVER NARROW. That is the whole load-bearing property,
-// and it has two halves that fail in opposite directions:
-//   • INTERSECTION, never union — the scope may not GRANT a permission the
-//     builder's ranks do not already confer, or a box token would escalate;
-//   • DENY-BY-DEFAULT — a permission the allow-list does not name is denied, or an
-//     unlisted permission leaks through.
-// resolver.narrowToSessionScope() is the one place the two compose, and it is
-// written as a FILTER of the rank answer so widening is not expressible there.
+// It used to be more. A row could declare a NARROWING scope — a deny-by-default
+// permissions allow-list, composed with the rank answer as an intersection — for a
+// token living outside the ADR 0016 trust boundary. Its only user was the
+// machine-baked token (ADR 0053) that goal 1000120 retired, so the allow-list form,
+// its catalog cross-check and the resolver's narrowing left with it (task 1003894).
+// A row that still declares one is REFUSED at load: with the enforcement gone, it
+// would read as a restriction while granting full authority.
 //
-// EXPLICIT DATA, not `if (source === 'box')`. session-scopes.json (next to this
-// file) is the declaration; this module validates it against the permission
-// catalog at load. GOVERNMENT OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER —
-// the same split R101 draws for the protected-surface registry: src/bongos/auth.js
-// reads the same JSON as DATA (fs, never `require` — ADR 0083's one-way rule) and
-// requireBuilder remains the gate every route composes. Nothing here enforces
-// anything; re-mapping a scope here changes what the gate admits, it can never
-// move the gate.
+// GOVERNMENT OWNS THE LIST, THE KERNEL STAYS THE ENFORCER — the same split R101
+// draws for the protected-surface registry: src/bongos/auth.js reads the same JSON
+// as DATA (fs, never `require` — ADR 0083's one-way rule) and requireBuilder remains
+// the gate every route composes. Nothing here enforces anything.
 //
-// FAIL-CLOSED at load: a key the catalog does not define, a `system: true`
-// trust-boundary key, or a machine-principal key on a session-scope allow-list all
-// THROW. Silently dropping the row would quietly shrink (or, for a principal,
-// blur) the surface a token outside the trust boundary may reach — an unreadable
-// policy is a broken install, not an opted-out one.
+// FAIL-CLOSED at load: an empty registry, a duplicate or malformed source, or a row
+// declaring a scope all THROW. An unreadable policy is a broken install, not an
+// opted-out one.
 
-const catalog = require('./catalog');
 const registry = require('./session-scopes.json');
 
-// Normalize the declared rows into the same shape the kernel loader produces:
-// `source` null for the legacy sourceless row, `permissions` always an array.
+// Normalize a declared row into the same shape the kernel loader produces:
+// `source` null for the legacy sourceless row.
 function normalizeScope(row) {
   return Object.freeze({
     source: row && row.source !== undefined ? row.source : null,
     label: row && typeof row.label === 'string' ? row.label : null,
-    unscoped: !!(row && row.unscoped === true),
-    permissions: Object.freeze(row && Array.isArray(row.permissions) ? [...row.permissions] : []),
+    declaresScope: !!(row && (row.permissions !== undefined || row.unscoped !== undefined)),
   });
 }
 
-// The catalog cross-check. Exported so the shipped assertion itself is what the
-// tests exercise, rather than a re-implementation of it (the fixture would
-// otherwise have to rewrite this file on disk to be loaded).
-function validateAgainstCatalog(scopes) {
+// The load-time assertions. Exported so the shipped check itself is what the tests
+// exercise, rather than a re-implementation of it.
+function validateScopes(scopes) {
+  if (!Array.isArray(scopes) || scopes.length === 0) {
+    throw new Error('session-scope registry declares no session sources. Refusing to run with no session-source model (ADR 0151).');
+  }
+  const seen = new Set();
   for (const scope of scopes) {
-    const where = `session-scope registry: scope "${scope.source}"`;
-    // unscoped XOR an allow-list. Both would be ambiguous (does it narrow?);
-    // neither would be a scope that can never admit anything.
-    if (scope.unscoped === (scope.permissions.length > 0)) {
-      throw new Error(`${where} must declare EITHER unscoped:true OR a non-empty permissions allow-list, never both/neither`);
+    const where = `session-scope registry: source "${scope.source}"`;
+    if (scope.source !== null && (typeof scope.source !== 'string' || !scope.source)) {
+      throw new Error('session-scope registry: every row needs a non-empty session source string, or null for the legacy sourceless row');
     }
-    for (const key of scope.permissions) {
-      if (!catalog.byKey(key)) {
-        throw new Error(`${where} allows "${key}", which the permission catalog does not define`);
-      }
-      // R98's rule, kept structural: a machine principal's capability comes from
-      // its exact system_role, never from a rank — so a box-scoped session
-      // carrying one must not be expressible on a scope allow-list either.
-      if (catalog.isPrincipalKey(key)) {
-        throw new Error(`${where} allows the machine-principal permission "${key}" — a session-scope narrows a builder's RANK authority and never composes with the identity axis`);
-      }
-      // A session-scope IS the surface a credential outside the ADR 0016 trust
-      // boundary may reach. A trust-boundary permission must never appear on one,
-      // even though the intersection would make listing it inert today.
-      if (catalog.isSystem(key)) {
-        throw new Error(`${where} allows the system:true permission "${key}" — a session-scope may only list operational capability (a scoped token lives outside the trust boundary)`);
-      }
+    if (seen.has(scope.source)) throw new Error(`${where} is declared twice`);
+    seen.add(scope.source);
+    if (scope.declaresScope) {
+      throw new Error(`${where} declares a scope (permissions/unscoped). Narrowing session scopes were removed (task 1003894); a row may only declare a source that carries its builder's full authority.`);
     }
   }
   return scopes;
 }
 
 const SESSION_SCOPES = Object.freeze(
-  validateAgainstCatalog(Object.freeze((registry.scopes || []).map(normalizeScope))),
+  validateScopes(Object.freeze((registry.scopes || []).map(normalizeScope))),
 );
 
 const _bySource = new Map(SESSION_SCOPES.map((s) => [s.source, s]));
 
-// The scope a session's `source` declares, or null when the registry does not
-// declare it. An UNRECOGNISED source resolves to null and therefore to NO
-// permissions — it never defaults to "full" (a null/absent source is a DECLARED
-// row here, not an implicit default: it predates the box source existing).
+// The declared row for a session's `source`, or null when the registry does not
+// declare it — which the kernel treats as DENY, never as "full" (a null/absent
+// source is a DECLARED row here, not an implicit default).
 function scopeFor(source) {
   const key = source === undefined ? null : source;
   if (key !== null && typeof key !== 'string') return null;
   return _bySource.get(key) || null;
 }
 
-// Does this session's scope narrow at all? Unknown source → true (fail-closed:
-// treated as narrowing to nothing, which is what scopeFor/narrowToSessionScope do).
-function isScoped(source) {
-  const scope = scopeFor(source);
-  return !scope || !scope.unscoped;
-}
-
-// The deny-by-default allow-list for a source; empty for an unscoped source (it
-// narrows nothing) AND for an unrecognised one (it admits nothing) — callers must
-// consult scopeFor()/isScoped() to tell those apart, exactly as the resolver does.
-const NO_KEYS = Object.freeze([]);
-function allowedKeys(source) {
-  const scope = scopeFor(source);
-  return scope ? scope.permissions : NO_KEYS;
-}
-
 function sources() {
   return SESSION_SCOPES.map((s) => s.source);
 }
 
 module.exports = {
   SESSION_SCOPES,
-  validateAgainstCatalog,
+  validateScopes,
   normalizeScope,
   scopeFor,
-  isScoped,
-  allowedKeys,
   sources,
 };

package/modules/government/session-scopes.json

@@ -1,38 +1,28 @@
 {
   "_comment": [
-    "The SESSION-SCOPE registry (BV1.R99, ADR 0151 §3; the model behind ADR 0053).",
-    "A session's scope is capability attached to the TOKEN, orthogonal to the builder's ranks.",
-    "Each row declares EITHER unscoped:true (the session narrows nothing) OR a deny-by-default",
-    "permissions allow-list (unlisted => denied). A scope can only ever NARROW: effective",
-    "authority is (the builder's rank permissions) INTERSECT (this allow-list), never a union.",
-    "Every key here is validated against modules/government/catalog.js at load by",
-    "modules/government/session-scopes.js — unknown, system:true and principal keys are refused.",
-    "Read as DATA by src/bongos/auth.js (fs, never require — ADR 0083's one-way rule)."
+    "The SESSION-SOURCE registry (BV1.R99, ADR 0151 §3): which kinds of session token may authenticate.",
+    "Every builder_sessions row carries a `source`. A session whose source is declared here carries its",
+    "builder's full rank authority; a session whose source is NOT declared is DENIED on every route and page.",
+    "Rows declare a source only. The narrowing form (a deny-by-default permissions allow-list) was removed",
+    "with its last user in task 1003894, and both loaders refuse a row that still declares one.",
+    "Read as DATA by src/bongos/auth.js (fs, never require — ADR 0083's one-way rule) and by",
+    "modules/government/session-scopes.js."
   ],
   "scopes": [
     {
       "source": "cli",
       "label": "CLI session",
-      "unscoped": true,
       "note": "Device Flow token on a builder's own machine — inside the trust boundary, carries the builder's full rank authority."
     },
     {
       "source": "web",
       "label": "web session",
-      "unscoped": true,
       "note": "Hall browser cookie — same authority as the CLI session."
     },
     {
       "source": null,
       "label": "legacy session",
-      "unscoped": true,
-      "note": "Rows minted before migration 090 added a source column; they predate the 'box' source existing, so they were never box tokens. Declared explicitly rather than defaulted — an UNRECOGNISED source denies."
-    },
-    {
-      "source": "box",
-      "label": "box-scoped session",
-      "permissions": ["box.manage.own"],
-      "note": "Baked into cloud-init so a dev box can bootstrap (#818/SR#2, ADR 0053). The token lives ON the box — OUTSIDE the ADR 0016 trust boundary — so it reaches only its own box record, whatever its builder's rank."
+      "note": "Rows minted before migration 090 added a source column. Declared explicitly rather than defaulted — an UNRECOGNISED source denies."
     }
   ]
 }

package/modules/grading/module.json

@@ -2,6 +2,7 @@
   "key": "grading",
   "title": "Grading",
   "description": "The grade-a-diff adversarial worker panel (Narc/Quality/Hacker/Efficiency) + deterministic route-rank/permission-path pre-passes + the scoring rubric. A core-domain module carved out of the GDS core in BV1.R73 (ADR 0091); default-on because every instance grades its own ships. Registers the `grade` kernel PORT the lifecycle resolves at confirm/ship time.",
+  "version": "1.0.0",
   "coreVersion": "^1.6.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/module.json

@@ -2,6 +2,7 @@
   "key": "hall-ui",
   "title": "Builders' Hall",
   "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, and the Archon-only watch/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
+  "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/public/board-lib.js

@@ -133,8 +133,8 @@
   // ---- shared row pieces ---------------------------------------------------
   //
   // board-room.js's header called these per-page boilerplate "by convention
-  // (gate.js, harbor.js and watch.js each carry their own)". That is not what
-  // the tree says: those three write .fact-pill markup inline and carry no such
+  // (gate.js and watch.js each carry their own)". That is not what the tree
+  // says: those pages write .fact-pill markup inline and carry no such
   // helper. This exact trio is declared in precisely two files — these two — as
   // byte-identical copies, so it is a two-file duplication like the rest.