@bongos/core 1.19.1072 → 1.19.1074

package/tests/fitness.mjs

@@ -261,7 +261,7 @@ test('module boundary: both checks pass (green) on the current tree', () => {
   const b = fitness.checkModulesImportOnlyApi();
   assert.equal(a.hardFail, false, a.violations.concat(a.warnings).join('\n'));
   assert.equal(b.hardFail, false, b.violations.concat(b.warnings).join('\n'));
-  // modules/ now holds dev-box + art-pipeline (the M07/M08 moves); both import
+  // modules/ holds the carved modules (the M07/M08 moves onward); each imports
   // only the doorway and the core imports neither → zero findings even though
   // the ratchet is now ENFORCING (BV1.R45).
   assert.equal(a.violations.length + a.warnings.length, 0, 'core→module findings: ' + a.warnings.concat(a.violations).join('; '));
@@ -282,7 +282,7 @@ test('module boundary ratchet is FLIPPED — enforcing by default (BV1.R45)', ()
 
 test('resolvesToModule: a core require into modules/<key>/ is detected', () => {
   const coreFile = path.join(ROOT, 'src', 'bongos', 'x.js');
-  assert.equal(fitness.resolvesToModule(coreFile, '../../modules/dev-box/box.js'), 'dev-box');
+  assert.equal(fitness.resolvesToModule(coreFile, '../../modules/art-pipeline/stage.js'), 'art-pipeline');
   assert.equal(fitness.resolvesToModule(coreFile, './sibling.js'), null);
 });
 
@@ -292,7 +292,7 @@ test('moduleImportViolation: doorway + intra-module OK; deep-core + sibling flag
   assert.equal(fitness.moduleImportViolation(f, '../db.js'), null, 'intra-module relative is allowed');
   assert.equal(fitness.moduleImportViolation(f, 'express'), null, 'bare npm specs are allowed');
   assert.match(fitness.moduleImportViolation(f, '../../../src/bongos/db') || '', /core internals/);
-  assert.match(fitness.moduleImportViolation(f, '../../dev-box/box') || '', /sibling module/);
+  assert.match(fitness.moduleImportViolation(f, '../../art-pipeline/stage') || '', /sibling module/);
 });
 
 test('module boundary actually CATCHES violations when enforcing (ratchet flip)', () => {
@@ -301,7 +301,7 @@ test('module boundary actually CATCHES violations when enforcing (ratchet flip)'
   try {
     const f = path.join(ROOT, 'modules', 'demo', 'x.js');
     assert.ok(fitness.moduleImportViolation(f, '../../src/bongos/db'), 'deep-core import must be a violation');
-    // the live checks stay green (dev-box + art-pipeline are clean) even when enforcing
+    // the live checks stay green (every carved module is clean) even when enforcing
     assert.equal(fitness.checkCoreNeverImportsModule().hardFail, false);
     assert.equal(fitness.checkModulesImportOnlyApi().hardFail, false);
   } finally {
@@ -390,15 +390,15 @@ test('the discovered-module roster is derived from a NON-EMPTY disk read (mutati
 
 test('core-carries-no-module-code actually CATCHES a hardcoded key (and ignores comments)', () => {
   // a key named in CODE is a violation
-  const hit = fitness.scanKernelForModuleKeys("if (key === 'dev-box') mountSpecially();", ['dev-box', 'art-pipeline']);
-  assert.ok(hit.some((v) => /dev-box/.test(v)), 'a hardcoded module key in code must be flagged');
+  const hit = fitness.scanKernelForModuleKeys("if (key === 'art-pipeline') mountSpecially();", ['art-pipeline', 'discord']);
+  assert.ok(hit.some((v) => /art-pipeline/.test(v)), 'a hardcoded module key in code must be flagged');
   // the same key in a comment / doc-example line is NOT a violation
-  const clean = fitness.scanKernelForModuleKeys("// e.g. logger('dev-box')\n * the dev-box doorway\nconst x = 1;", ['dev-box']);
+  const clean = fitness.scanKernelForModuleKeys("// e.g. logger('art-pipeline')\n * the art-pipeline doorway\nconst x = 1;", ['art-pipeline']);
   assert.deepEqual(clean, [], 'a key on a comment line must be ignored: ' + clean.join('; '));
-  // token-delimited: `dev-box` must not fire inside the larger token `dev-boxes`
-  assert.deepEqual(fitness.scanKernelForModuleKeys("const x = 'dev-boxes';", ['dev-box']), [], 'a substring inside a larger token must not fire');
+  // token-delimited: `art-pipeline` must not fire inside the larger token `art-pipelines`
+  assert.deepEqual(fitness.scanKernelForModuleKeys("const x = 'art-pipelines';", ['art-pipeline']), [], 'a substring inside a larger token must not fire');
   // no keys discovered → never fires (vacuous-safe before the first move)
-  assert.deepEqual(fitness.scanKernelForModuleKeys("mount('dev-box')", []), []);
+  assert.deepEqual(fitness.scanKernelForModuleKeys("mount('art-pipeline')", []), []);
 });
 
 // --- kernel imports no domain (BV1.R70, ADR 0091 §1) ---
@@ -442,45 +442,45 @@ test('module-migrations-additive: the live tree is clean (no module migrations y
 });
 
 test('module-migrations-additive actually CATCHES destructive + non-namespaced DDL', () => {
-  // the SQL namespace prefix derives from the key: dev-box → dev_box
-  assert.equal(fitness.moduleNamespace('dev-box'), 'dev_box');
+  // the SQL namespace prefix derives from the key: art-pipeline → art_pipeline
+  assert.equal(fitness.moduleNamespace('art-pipeline'), 'art_pipeline');
 
   // additive + namespaced → clean (table, index-on-own-table, additive ALTER)
-  const good = fitness.moduleMigrationViolations('dev-box',
-    'CREATE TABLE IF NOT EXISTS dev_box_runs (id serial primary key);\n' +
-    'CREATE INDEX idx_dev_box_runs_id ON dev_box_runs (id);\n' +
-    'ALTER TABLE dev_box_runs ADD COLUMN note text;');
+  const good = fitness.moduleMigrationViolations('art-pipeline',
+    'CREATE TABLE IF NOT EXISTS art_pipeline_runs (id serial primary key);\n' +
+    'CREATE INDEX idx_art_pipeline_runs_id ON art_pipeline_runs (id);\n' +
+    'ALTER TABLE art_pipeline_runs ADD COLUMN note text;');
   assert.deepEqual(good, [], 'an additive, namespaced migration must pass: ' + good.join('; '));
 
   // destructive DDL is rejected
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'DROP TABLE dev_box_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE must be flagged');
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP COLUMN note;').some((v) => /destructive/i.test(v)), 'ALTER … DROP must be flagged');
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'TRUNCATE dev_box_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'DROP TABLE art_pipeline_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'ALTER TABLE art_pipeline_runs DROP COLUMN note;').some((v) => /destructive/i.test(v)), 'ALTER … DROP must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'TRUNCATE art_pipeline_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE must be flagged');
 
   // a CHECK-enum WIDENING (drop-if-exists + re-add the SAME-named constraint) is
   // additive-in-spirit and ALLOWED (task 1978: provisioning gains 'standalone')
-  const widen = fitness.moduleMigrationViolations('dev-box',
-    'ALTER TABLE dev_box_runs DROP CONSTRAINT IF EXISTS dev_box_runs_shape_check;\n' +
-    "ALTER TABLE dev_box_runs ADD CONSTRAINT dev_box_runs_shape_check CHECK (shape IN ('a','b','c'));");
+  const widen = fitness.moduleMigrationViolations('art-pipeline',
+    'ALTER TABLE art_pipeline_runs DROP CONSTRAINT IF EXISTS art_pipeline_runs_shape_check;\n' +
+    "ALTER TABLE art_pipeline_runs ADD CONSTRAINT art_pipeline_runs_shape_check CHECK (shape IN ('a','b','c'));");
   assert.deepEqual(widen, [], 'a CHECK-enum widening (drop+re-add same constraint) must pass: ' + widen.join('; '));
   // but a BARE drop constraint (no matching re-add) is STILL destructive
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT (no re-add) must still be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'ALTER TABLE art_pipeline_runs DROP CONSTRAINT art_pipeline_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT (no re-add) must still be flagged');
 
   // an ACKNOWLEDGED contract-phase column drop (task 1003092, ADR 0177's expand-then-
   // contract) is the ONE destructive shape allowed: the file carries the same
   // `-- forward-unsafe:` pragma lint-migrations.js requires, the statement is exactly
   // one DROP COLUMN, and the table is the module's own.
-  const PRAGMA = '-- forward-unsafe: drop-column on dev_box_runs — the contract phase of a two-step rename\n';
-  const contract = fitness.moduleMigrationViolations('dev-box',
-    PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN IF EXISTS note;\nALTER TABLE dev_box_runs ALTER COLUMN note2 SET NOT NULL;');
+  const PRAGMA = '-- forward-unsafe: drop-column on art_pipeline_runs — the contract phase of a two-step rename\n';
+  const contract = fitness.moduleMigrationViolations('art-pipeline',
+    PRAGMA + 'ALTER TABLE art_pipeline_runs DROP COLUMN IF EXISTS note;\nALTER TABLE art_pipeline_runs ALTER COLUMN note2 SET NOT NULL;');
   assert.deepEqual(contract, [], 'an acknowledged own-table DROP COLUMN must pass: ' + contract.join('; '));
   // the pragma is per-STATEMENT permission for that one shape, not a per-file switch
-  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'DROP TABLE dev_box_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE stays flagged even under the pragma');
-  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'TRUNCATE dev_box_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE stays flagged even under the pragma');
-  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT stays flagged even under the pragma');
-  assert.ok(fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE dev_box_runs DROP COLUMN note, DROP COLUMN note2;').some((v) => /destructive/i.test(v)), 'a multi-clause drop is not the one allowed shape');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', PRAGMA + 'DROP TABLE art_pipeline_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', PRAGMA + 'TRUNCATE art_pipeline_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', PRAGMA + 'ALTER TABLE art_pipeline_runs DROP CONSTRAINT art_pipeline_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT stays flagged even under the pragma');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', PRAGMA + 'ALTER TABLE art_pipeline_runs DROP COLUMN note, DROP COLUMN note2;').some((v) => /destructive/i.test(v)), 'a multi-clause drop is not the one allowed shape');
   // and a column drop on a table OUTSIDE the namespace is refused twice over
-  const foreign = fitness.moduleMigrationViolations('dev-box', PRAGMA + 'ALTER TABLE builders DROP COLUMN note;');
+  const foreign = fitness.moduleMigrationViolations('art-pipeline', PRAGMA + 'ALTER TABLE builders DROP COLUMN note;');
   assert.ok(foreign.some((v) => /destructive/i.test(v)), 'a core-table DROP COLUMN is still destructive under the pragma');
   assert.ok(foreign.some((v) => /namespace/i.test(v)), 'and still a namespace violation');
   // the real contract migration is the shape's first user — it must pass the REAL check
@@ -489,13 +489,13 @@ test('module-migrations-additive actually CATCHES destructive + non-namespaced D
     'platform_identity_021 is the acknowledged contract phase and must be clean');
 
   // a created object outside the <key>_ namespace is rejected
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'CREATE TABLE runs (id int);').some((v) => /namespace/i.test(v)), 'a table outside dev_box_ must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'CREATE TABLE runs (id int);').some((v) => /namespace/i.test(v)), 'a table outside art_pipeline_ must be flagged');
   // a module migration altering a CORE table is rejected (reach core via the seam)
-  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE builders ADD COLUMN x int;').some((v) => /namespace/i.test(v)), 'altering a core table must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('art-pipeline', 'ALTER TABLE builders ADD COLUMN x int;').some((v) => /namespace/i.test(v)), 'altering a core table must be flagged');
 
   // a commented-out destructive line is ignored
   assert.deepEqual(
-    fitness.moduleMigrationViolations('dev-box', '-- DROP TABLE dev_box_runs;\nCREATE TABLE dev_box_runs (id int);'),
+    fitness.moduleMigrationViolations('art-pipeline', '-- DROP TABLE art_pipeline_runs;\nCREATE TABLE art_pipeline_runs (id int);'),
     [], 'a commented-out DROP must be ignored',
   );
 });
@@ -781,12 +781,12 @@ test('demo proof module is live + clean (boundary + rank + migration green)', ()
   assert.equal(fitness.checkModuleMigrationsAdditive().hardFail, false, 'demo migration is additive + namespaced');
 });
 
-test('demo RED-LINE (a): a cross-module import (demo → dev-box internals) is REJECTED', () => {
+test('demo RED-LINE (a): a cross-module import (demo → art-pipeline internals) is REJECTED', () => {
   // the exact violation the BV1.R52 transcript injects: demo deep-importing a
   // sibling module. moduleImportViolation runs on the real demo route path.
   const demoRoute = path.join(ROOT, 'modules', 'demo', 'routes', 'demo.js');
-  const v = fitness.moduleImportViolation(demoRoute, '../../dev-box/box');
-  assert.ok(v && /sibling module "dev-box"/.test(v), 'demo importing dev-box internals must be flagged: ' + v);
+  const v = fitness.moduleImportViolation(demoRoute, '../../art-pipeline/stage');
+  assert.ok(v && /sibling module "art-pipeline"/.test(v), 'demo importing art-pipeline internals must be flagged: ' + v);
   // the doorway is still allowed (the legitimate single core import)
   assert.equal(fitness.moduleImportViolation(demoRoute, '../../../src/module-api'), null, 'the doorway import is allowed');
 });
@@ -922,11 +922,13 @@ test('write-route validation check actually CATCHES an unvalidated write route (
   assert.ok(/POST \/widgets/.test(flagged[0]), 'the offending route is named');
 });
 
-test('write-route validation exemptions are the known dynamic-key prefs routes, plus the one raw-file upload', () => {
-  // The .docx upload (task 1004320) has no JSON body to hold a field schema: its
-  // body is the file's bytes, capped by the route's parser and read by
-  // docx.readUpload. Named here so a second raw-body exemption is a reviewed diff.
-  const RAW_FILE_UPLOADS = ['POST /copy-desk/pages/:pageId/draft.docx'];
+test('write-route validation exemptions are the known dynamic-key prefs routes, plus the named raw-file uploads', () => {
+  // The .docx upload (task 1004320) and the module-store tarball (task 1004271) have no
+  // JSON body to hold a field schema: each body is a file's bytes, capped by the route's
+  // own parser and read by a checker that refuses anything malformed (docx.readUpload,
+  // module-artifact.verifyModuleArtifact). Named here so each raw-body exemption is a
+  // reviewed diff.
+  const RAW_FILE_UPLOADS = ['POST /copy-desk/pages/:pageId/draft.docx', 'POST /store/modules/:key/versions'];
   const exempt = [...fitness.WRITE_VALIDATION_EXEMPT];
   assert.ok(exempt.length >= 1 && exempt.every((e) => e.startsWith('PATCH /me/') || RAW_FILE_UPLOADS.includes(e)),
     'exemptions are all /me/* prefs patches or a named raw-file upload: ' + exempt.join(', '));

package/tests/gate_approvals.mjs

@@ -439,7 +439,6 @@ await t('both routes are requireBuilder-gated and registered', async () => {
     assert.ok(layer, `${method.toUpperCase()} ${p} registered`);
     const handles = layer.route.stack.map((s) => s.handle);
     assert.ok(handles.includes(auth.requireBuilder), `${p} must be requireBuilder-gated`);
-    assert.ok(!handles.includes(auth.allowBoxScope), `${p} must NOT carry allowBoxScope`);
   }
 });
 

package/tests/go_live.mjs

@@ -44,7 +44,7 @@ const okTarget = {
 
 // A divergence result shaped like deploy-divergence.check() returns.
 const div = (over = {}) => ({
-  ok: true, onMain: '1.19.306', live: { coreVersion: '1.19.305' },
+  ok: true, onMain: '1.19.306', live: { version: '1.0.0', coreVersion: '1.19.305' },
   hasUnreleased: false, unreleased: { count: 0 }, ...over,
 });
 
@@ -82,14 +82,14 @@ test('--allow-unreleased downgrades that halt to a note rather than dropping it'
 
 test('a no-op bump is a halt, not a success', () => {
   const p = G.planGoLive({
-    div: div({ live: { coreVersion: '1.19.306' } }), target: okTarget, targetVersion: '1.19.306',
+    div: div({ live: { version: '1.0.0', coreVersion: '1.19.306' } }), target: okTarget, targetVersion: '1.19.306',
   });
   assert.ok(p.halts.find((x) => x.code === 'ALREADY_LIVE'));
 });
 
 test('live ahead of the target halts rather than silently downgrading', () => {
   const p = G.planGoLive({
-    div: div({ live: { coreVersion: '1.19.310' } }), target: okTarget, targetVersion: '1.19.306',
+    div: div({ live: { version: '1.0.0', coreVersion: '1.19.310' } }), target: okTarget, targetVersion: '1.19.306',
   });
   assert.ok(p.halts.find((x) => x.code === 'LIVE_AHEAD'));
 });

package/tests/government_abuse_matrix.mjs

@@ -19,11 +19,12 @@
 //         government.manage (the low-trust builder's own attempt)
 //     V6  config: a role template proposing system keys is stripped; a seeded
 //         role's template grants are dropped wholesale; env overrides labels only
-//     V7  session-scope: an allow-list naming a system or principal key THROWS
+//     V7  session-scope: a registry row that declares ANY allow-list THROWS (the
+//         narrowing form was removed with its last user, task 1003894)
 //
 //   The wall behind the wall (a grant row forced past every vector above):
 //     V8  a forced principal grant resolves to NOTHING (effectivePermissions)
-//     V9  a box-scoped session narrows away every forced system grant
+//     V9  a session of an undeclared source (a leftover dev-box token) is refused
 //     V10 no route consumes the substrate-enforced keys via requirePermission —
 //         a forced deploy/protected-path/ssh grant admits nothing in-app
 //     V11 the substrate blocks a sub-floor builder on EVERY protected surface,
@@ -328,27 +329,28 @@ test('V6: the env layer relabels only — it cannot add a permission or a role',
 });
 
 // ===========================================================================
-// V7 — the session-scope vector (an allow-list can never name system power)
+// V7 — the session-scope vector (a registry row can carry no allow-list at all)
 // ===========================================================================
 
-test('V7: a session-scope allow-list naming ANY system key throws at validation', () => {
-  for (const k of SYSTEM_KEYS) {
+test('V7: a session-scope row declaring an allow-list is refused at validation, whatever it names', () => {
+  // Enumerated from the catalog, as the rest of the matrix is: a system key, a
+  // principal key and a plain operational key are all refused, because the refusal
+  // is about the SHAPE (a narrowing scope with no enforcement behind it would read as
+  // a restriction while granting full authority), not about which key it names.
+  for (const k of [...SYSTEM_KEYS, ...catalog.principalKeys(), 'task.ship']) {
     assert.throws(
-      () => sessionScopes.validateAgainstCatalog([
+      () => sessionScopes.validateScopes([
         sessionScopes.normalizeScope({ source: 'evil', permissions: [k] }),
       ]),
-      new RegExp(k.replace(/\./g, '\\.')),
+      /Narrowing session scopes were removed/,
       `a scope allowing ${k} must be refused at load`,
     );
   }
 });
 
-test('V7: the LIVE session-scope registry carries no system or principal key', () => {
+test('V7: the LIVE session-scope registry declares no scope on any row', () => {
   for (const scope of sessionScopes.SESSION_SCOPES) {
-    for (const k of scope.permissions) {
-      assert.equal(catalog.isSystem(k), false, `scope "${scope.source}" allows system key ${k}`);
-      assert.equal(catalog.isPrincipalKey(k), false, `scope "${scope.source}" allows principal key ${k}`);
-    }
+    assert.equal(scope.declaresScope, false, `source "${scope.source}" declares a scope`);
   }
 });
 
@@ -362,14 +364,13 @@ test('V8: a forced principal grant resolves to nothing (structurally dropped)',
     'principal keys confer nothing through the role axis no matter how the row got written');
 });
 
-test('V9: a box-scoped session narrows away EVERY forced system grant', () => {
-  const forcedEverything = catalog.permissionKeys(); // as if every key were granted
-  const boxHolds = resolver.narrowToSessionScope(forcedEverything, 'box');
-  for (const k of boxHolds) {
-    assert.equal(catalog.isSystem(k), false, `a box token surfaced system key ${k}`);
+test('V9: an undeclared session source is refused outright, never treated as "full"', () => {
+  // Rows with source 'box' stay in builder_sessions until task 1003895 deletes them.
+  // They must be undeclared to BOTH loaders, which is what makes requireBuilder and
+  // the page gate refuse them (tests/government_session_scope.mjs runs the gate).
+  for (const source of ['box', 'not-a-source']) {
+    assert.equal(sessionScopes.scopeFor(source), null, `"${source}" must not be a declared session source`);
   }
-  assert.deepEqual([...resolver.narrowToSessionScope(forcedEverything, 'not-a-source')], [],
-    'an unrecognised source resolves to nothing, never to "full"');
 });
 
 // ===========================================================================

package/tests/government_ownership_scope.mjs

@@ -1,13 +1,13 @@
 // tests/government_ownership_scope.mjs — ownership-scoped permissions
 // ("act on OWN X") as a first-class axis (BV1.R100, ADR 0151 §3). DB-free.
 //
-// The thing being proved is a CONJUNCTION. `box.manage.own` is not a grant that
+// The thing being proved is a CONJUNCTION. `task.abandon.own` is not a grant that
 // happens to be named "own" — it is half a decision:
 //
 //   1. the ROLE fact  — the builder holds the key (resolved from the DB, uncached);
 //   2. the OWNER fact — the concrete row is theirs (a REQUEST-scoped fact the
 //                       resolver structurally cannot know: it is handed a builder
-//                       id, never a box).
+//                       id, never a task).
 //
 // The security failure mode this file exists to catch is (2) quietly disappearing,
 // leaving `.own` as an unconditional grant — i.e. `X.manage.own` silently becoming
@@ -103,20 +103,18 @@ test('A3: the modelled families are the ones the ownership sweep names', () => {
   // `task` joined the modelled families in task 1002443 (ADR 0297) — the first
   // family added because a ROUTE needed it rather than to complete the model.
   assert.deepEqual(Object.keys(RESOURCE_FAMILIES).sort(),
-    ['box', 'builder_prefs', 'claim', 'credential', 'goal', 'memory', 'task']);
+    ['builder_prefs', 'claim', 'credential', 'goal', 'memory', 'task']);
   assert.deepEqual([...ownershipScopedKeys()].sort(),
-    ['box.manage.own', 'credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.abandon.own', 'task.act.own']);
-  // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`,
-  // and `task.abandon` carries no suffix at all — it predates the axis and was given
+    ['credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.abandon.own', 'task.act.own']);
+  // The cross-owner side is NOT derivable from spelling: `task.abandon` carries no
+  // suffix at all — it predates the axis and was given
   // scope/resource/verb in place rather than renamed, because it is seeded in live
   // rank rows (governance_002) and a key rename is a migration, not a declaration.
   assert.deepEqual([...crossOwnerKeys()].sort(),
-    ['box.fleet.manage', 'claim.release.any', 'memory.read.any', 'task.abandon']);
+    ['claim.release.any', 'memory.read.any', 'task.abandon']);
   // The escalation path is DECLARED per key, never derived from the resource
-  // family (task 1003195). TWO real pairs now: `box.fleet.manage` is the same
-  // `manage` verb over every owner's box, and `task.abandon` the same `act` verb
-  // over every creator's task, so each genuinely subsumes doing it to your own.
-  assert.deepEqual(crossOwnerKeysFor('box.manage.own'), ['box.fleet.manage']);
+  // family (task 1003195). ONE real pair: `task.abandon` is the same `act` verb
+  // over every creator's task, so it genuinely subsumes retiring your own.
   assert.deepEqual(crossOwnerKeysFor('task.abandon.own'), ['task.abandon']);
   // claim and memory each HAVE an `any` key in their family and still declare no
   // counterpart — the distinction the family-derived version could not make.
@@ -152,7 +150,7 @@ test('A4: RESOURCE_FAMILIES is frozen and agrees with each row it lists', () =>
 // ═══ B — `.own` does NOT imply `.any` (oracle: floors × the real rank gate) ════
 
 test('B1: for every paired family some rank reaches its OWN row but not everyone else\'s', () => {
-  assert.ok(PAIRED.length >= 3, `expected the box/claim/memory pairs, saw ${PAIRED.length}`);
+  assert.ok(PAIRED.length >= 3, `expected the claim/memory/task pairs, saw ${PAIRED.length}`);
   for (const [resource, fam] of PAIRED) {
     for (const ownKey of fam.own) {
       for (const anyKey of fam.any) {
@@ -177,11 +175,11 @@ test('B2: the seed grants the own key to ranks it withholds the cross-owner key
     }
   }
   // The concrete claim, spelled out: a xenos may act on their own claim and their
-  // own box; they may not release another builder's claim or close another's box.
+  // own task; they may not release another builder's claim or abandon another's task.
   assert.ok(RANK_SEED.xenos.includes('task.act.own'));
   assert.ok(!RANK_SEED.xenos.includes('claim.release.any'));
-  assert.ok(RANK_SEED.xenos.includes('box.manage.own'));
-  assert.ok(!RANK_SEED.xenos.includes('box.fleet.manage'));
+  assert.ok(RANK_SEED.xenos.includes('task.abandon.own'));
+  assert.ok(!RANK_SEED.xenos.includes('task.abandon'));
 });
 
 test('B3: cross-owner authority is never CHEAPER than own-only authority', () => {
@@ -228,7 +226,7 @@ test('C3: no owner supplied = no admit, however the caller spells the omission',
   // question. A handler that forgets it gets a denial, never a pass-through.
   await holding(EVERYTHING, async () => {
     for (const context of [undefined, null, {}, { ownerId: null }, { ownerId: undefined }, { ownerId: '' }, { ownerId: {} }, { ownerId: [] }, { ownerId: true }, { ownerId: NaN }]) {
-      assert.equal(await authorizeOwned(ME, 'box.manage.own', context), false,
+      assert.equal(await authorizeOwned(ME, 'task.abandon.own', context), false,
         `an unidentifiable owner (${JSON.stringify(context)}) must deny`);
     }
   });
@@ -245,8 +243,8 @@ test('C4: authorizeOwned is the OWN entry point only — other keys fail closed'
     assert.equal(await authorizeOwned(ME, 'principal.bfg', { ownerId: ME }), false);
     assert.equal(await authorizeOwned(ME, 'nope.not.a.key', { ownerId: ME }), false);
     // A blank actor cannot own anything, even matching a blank owner.
-    assert.equal(await authorizeOwned(null, 'box.manage.own', { ownerId: null }), false);
-    assert.equal(await authorizeOwned('', 'box.manage.own', { ownerId: '' }), false);
+    assert.equal(await authorizeOwned(null, 'task.abandon.own', { ownerId: null }), false);
+    assert.equal(await authorizeOwned('', 'task.abandon.own', { ownerId: '' }), false);
   });
 });
 
@@ -257,7 +255,7 @@ test('C5: builderHasPermissions REFUSES an ownership-scoped key rather than answ
         `${key}: "do you hold it" has no unconditional answer — the caller wants authorizeOwned()`);
     }
     // One own key poisons the whole AND-list; unscoped keys still answer normally.
-    assert.equal(await builderHasPermissions(ME, ['idea.triage', 'box.manage.own']), false);
+    assert.equal(await builderHasPermissions(ME, ['idea.triage', 'task.abandon.own']), false);
     assert.equal(await builderHasPermissions(ME, ['idea.triage', 'cost.log']), true);
     assert.equal(await builderHasPermissions(ME, ['claim.release.any']), true);
   });
@@ -266,17 +264,17 @@ test('C5: builderHasPermissions REFUSES an ownership-scoped key rather than answ
 // ═══ D — `.any` DOES reach another builder's resource ═════════════════════════
 
 test('D1: a DECLARED cross-owner counterpart reaches a row the caller does not own', async () => {
-  // box is the catalog's one real pair, and it must keep working: `box.fleet.manage`
+  // task is the catalog's one real pair, and it must keep working: `task.abandon`
   // is the whole point of a cross-owner key. Asserted BOTH with and without the own
   // key, because the counterpart is a standalone admit — it does not merely widen a
   // grant the builder already has.
-  await holding(['box.manage.own', 'box.fleet.manage'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true,
-      'box.fleet.manage is exactly the authority to manage someone else\'s box');
-    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: ME }), true);
+  await holding(['task.abandon.own', 'task.abandon'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.abandon.own', { ownerId: SOMEONE_ELSE }), true,
+      'task.abandon is exactly the authority to abandon someone else\'s task');
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.abandon.own', { ownerId: ME }), true);
   });
-  await holding(['box.fleet.manage'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true);
+  await holding(['task.abandon'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.abandon.own', { ownerId: SOMEONE_ELSE }), true);
   });
 });
 
@@ -346,7 +344,7 @@ test('D1c: every declared counterpart is cross-owner, same-resource, and verb-do
         `${p.key}'s counterpart ${key} (verb ${c.verb}) must dominate verb ${p.verb}`);
     }
   }
-  assert.ok(declared >= 1, 'expected at least the box pair to be declared');
+  assert.ok(declared >= 1, 'expected at least the task pair to be declared');
   // A verb never dominates a wider one, and an unknown verb fails closed — the
   // relation is asserted directly so a future edit to the table is caught here.
   assert.equal(verbDominates('manage', 'read'), true);
@@ -447,8 +445,8 @@ function loadMutatedCatalog(label, mutate) {
 test('F1: a ".own" key that lost its declared scope throws at module load', () => {
   assert.throws(
     () => loadMutatedCatalog('missing scope', (s) => s.replace(
-      `{ key: 'box.manage.own', system: false, floor: 'xenos', scope: 'own', resource: 'box',`,
-      `{ key: 'box.manage.own', system: false, floor: 'xenos',`)),
+      `{ key: 'task.abandon.own', system: false, floor: 'xenos', scope: 'own', resource: 'task',`,
+      `{ key: 'task.abandon.own', system: false, floor: 'xenos',`)),
     /does not declare scope/,
   );
 });
@@ -456,7 +454,7 @@ test('F1: a ".own" key that lost its declared scope throws at module load', () =
 test('F2: an ownership scope with no resource family throws at module load', () => {
   assert.throws(
     () => loadMutatedCatalog('scope without resource', (s) => s.replace(
-      `scope: 'own', resource: 'box',`, `scope: 'own',`)),
+      `scope: 'own', resource: 'task',`, `scope: 'own',`)),
     /scope and resource must come together/,
   );
 });
@@ -522,13 +520,13 @@ test('F7: a counterpart that is dangling, cross-resource, or not cross-owner thr
   assert.throws(
     () => loadMutatedCatalog('cross-resource counterpart', (s) => s.replace(
       `resource: 'credential', verb: 'manage', counterpart: []`,
-      `resource: 'credential', verb: 'manage', counterpart: ['box.fleet.manage']`)),
+      `resource: 'credential', verb: 'manage', counterpart: ['task.abandon']`)),
     /never crosses resource families/,
   );
   assert.throws(
     () => loadMutatedCatalog('own key as counterpart', (s) => s.replace(
-      `resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage']`,
-      `resource: 'box', verb: 'manage', counterpart: ['memory.manage.own']`)),
+      `resource: 'task', verb: 'act', counterpart: ['task.abandon']`,
+      `resource: 'task', verb: 'act', counterpart: ['memory.manage.own']`)),
     /is not cross-owner/,
   );
 });
@@ -587,7 +585,7 @@ test('G2: the role resolve is untouched — own-scoped keys still resolve, princ
   for (const key of ownershipScopedKeys()) {
     assert.ok(resolved.includes(key), `${key} must still resolve — parity depends on it`);
   }
-  assert.deepEqual(effectivePermissions(['principal.bfg', 'box.manage.own']), ['box.manage.own']);
+  assert.deepEqual(effectivePermissions(['principal.bfg', 'task.abandon.own']), ['task.abandon.own']);
   assert.deepEqual(effectivePermissions(['idea.triage', 'not.a.real.permission']), ['idea.triage']);
   assert.deepEqual(effectivePermissions([]), []);
   assert.ok(Object.isFrozen(resolved));
@@ -601,7 +599,7 @@ test('G3: the kernel port carries the ownership axis on the ONE governance port'
   // still the same one object port the earlier slices registered
   assert.equal(typeof governmentPort.resolveBuilderPermissions, 'function');
   assert.equal(typeof governmentPort.resolvePrincipalPermissions, 'function');
-  assert.equal(governmentPort.isOwnershipScoped('box.manage.own'), true);
+  assert.equal(governmentPort.isOwnershipScoped('task.abandon.own'), true);
   assert.equal(governmentPort.isOwnershipScoped('claim.release.any'), false);
   assert.equal(governmentPort.isOwnershipScoped('nope.not.a.key'), false);
 });

package/tests/government_parity.mjs

@@ -399,8 +399,8 @@ test('parsePageGates reads permission wherever it sits, and never borrows a sibl
 
 // ONE-DIRECTIONAL, and deliberately so. A floor STRICTER than the route middleware
 // is legitimate and common: the wall lives in the handler (task.confirm.grade_bypass
-// on an any-builder POST /tasks/:id/confirm; goal.manage.own's owner|manager check;
-// box.source.full's boxScopeForRank). A floor LOOSER than the middleware is never
+// on an any-builder POST /tasks/:id/confirm; goal.manage.own's owner|manager check).
+// A floor LOOSER than the middleware is never
 // legitimate — it would tell the governance tab a permission is delegable below the
 // rank the route in fact demands.
 test('B1: no permission floor is LOOSER than the rank gate its route actually carries', () => {