@bongos/core 1.19.182 → 1.19.183

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.182",
-  "core_contract": "1.19.182",
-  "source_commit": "e5417ea88504c51b0cc9af06d143ec9b3d37c0ed",
+  "core_version": "1.19.183",
+  "core_contract": "1.19.183",
+  "source_commit": "37af85f9638cba28604263e9e629479bcd665d8b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T21:13:59.751Z",
+  "built_at": "2026-08-16T21:31:50.598Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 308,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1608,
-  "tree_sha256": "101a4745dd8d3b2a32eb0658b962706986782e31b92eb968862d929b7e5e05b7",
+  "tree_sha256": "38eea74a9e17746ec68a481e09daf00c98e4ae5c8ca74897cf299c09b09a70b1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2947,7 +2947,7 @@
     {
       "path": "modules/governance/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "4c7b1737c3f30d6c6f7916a2539f8b768d5a1a52357e361cde2618643a46e53e"
+      "sha256": "461e27529acfc69373354ec6fdf7dfeb2f8619af456d9be2470bb3653eeb4a37"
     },
     {
       "path": "modules/governance/rank-roles.js",
@@ -4247,12 +4247,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1817517e0566226b12320fb61a3a216cbb08c4536cd0e5b959567438b81f9993"
+      "sha256": "944c48f52c7c17f20ddf4de7d00b2ae145ed7f2b427339dcd61045d0ab664135"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "090d46542c940a8327bb953057f47a8e51e56c9ecc86755af99a7e941eea4247"
+      "sha256": "39ac6bb8918f513dca0cdf3139dcb6369ec0d727ec0fb0d471e9b2e0dbda06b2"
     },
     {
       "path": "public-docs/index.html",
@@ -5177,7 +5177,7 @@
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "46c017b3c133b02c1b22a83ee34e6132ca2d471a7afef2a9de056cbb6b4725a9"
+      "sha256": "93e1d1cf68ceb30c6fc188f8d53094c7498ba9f1e4eb95a64f8ba883ba3897cc"
     },
     {
       "path": "scripts/gds/pulse.js",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "dde61de24af4bdb3ed0d00267873ee700c959166a4f86ab3a3283e8813f65bc6"
+      "sha256": "162c15a20ee4ec9bfa0227b674efac51c7a11da65f9e8f612558fb023e2fe666"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5722,7 +5722,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "1802c2589279319abafbda1c3519dff39a43cb52d160b4c4610c6d6f3d79affd"
+      "sha256": "89cdc73dd76e6b296a7d6a43ea3946eb83d180eb4e14961991dd3d8352b76738"
     },
     {
       "path": "src/bongos/routes.js",
@@ -5857,7 +5857,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bcbce9e29c6f05fc39ad8e52b4aa13b170962a06dbd3b6b5befba810a48e29d8"
+      "sha256": "4acf151f0537e8948a570c7cf97a39964de64496c0e70d5b4000a47df85b23f5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6817,7 +6817,7 @@
     {
       "path": "tests/governance_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "d230c59b809cefd1a7502763a594f700ba723d8509faf9cb165b1b4ab49c6c16"
+      "sha256": "8e7cb6db6c08b16d79bd6567bcb8d6724817ce65460e5574bcaf7cb6432ee049"
     },
     {
       "path": "tests/governance_require_permission.mjs",

package/modules/governance/protected-surfaces.json

@@ -34,7 +34,8 @@
     { "glob": "modules/lifecycle/routes/", "group": "authz", "why": "BV1.R86: the lifecycle routes carved out of src/bongos/routes/ — the gates follow the routes" },
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
-    { "glob": "modules/governance/", "group": "authz", "why": "the governance module (ADR 0151) — its resolver, catalog, gates AND this registry ARE the authz core; the glob is the prospective carve so CREATION is gated as strictly as edits (ADR 0086 §4)" },
+    { "glob": "modules/governance/", "group": "authz", "why": "the governance module (ADR 0151) — its resolver, catalog, gates AND this registry ARE the authz core; the glob is the prospective carve so CREATION is gated as strictly as edits (ADR 0086 §4). Renamed to modules/government/ by goal 1000068 (ADR 0174); BOTH globs are listed for the transition and this one is dropped with the folder in R04." },
+    { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/governance/ entry directly above (ADR 0086 §4)." },
     { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
     { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },
     { "glob": "modules/dev-box/box-credential.js", "group": "box-access", "why": "mints the box source credential" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.182",
+  "version": "1.19.183",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.182",
+      "version": "1.19.183",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.182",
+  "version": "1.19.183",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-manifest.js

@@ -61,7 +61,8 @@ const PUBLISH_ALLOWLIST = [
   'modules/sessions/',
   'modules/autonomy/',
   'modules/security/',
-  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true.
+  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true. Renamed → modules/government/ (ADR 0174); dropped with the folder in goal 1000068 R04.
+  'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/dev-box/',

package/src/bongos/module-scope-map.js

@@ -174,8 +174,29 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
+  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
+  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
+  //     so the wall is identical whichever key a goal names and whichever name
+  //     the folder currently has on disk. The `government` key must land BEFORE
+  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
+  //     folder first would leave goal 1000068's own wall not matching the files
+  //     its remaining tasks need to touch, blocking the rename mid-goal.
+  //     `modules/government/` is registered in protected-surfaces.json in the
+  //     same change — `protected` DERIVES from that registry, so without it this
+  //     key would compute protected:false and silently drop the Archon gate.
+  government: [
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
+    'config/governance.json', 'config/governance.neutral.json',
+  ],
+  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
+  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
+  //     (task 1003006), the release that drops the /governance/* route aliases;
+  //     the two removals are the same compatibility window and should land
+  //     together.
   governance: [
-    'modules/governance/',
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
     'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---

package/src/bongos/route-rank-check.js

@@ -231,6 +231,21 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
+// The authz-core route pins, referenced by BOTH the `governance` and the
+// `government` module keys below while goal 1000068's rename is in flight
+// (ADR 0174, task 1003003). One object, two keys — never two literals.
+const GOVERNMENT_PINS = {
+  'GET /governance/roles': 'perm:governance.manage',
+  'GET /governance/permissions': 'perm:governance.manage',
+  'GET /governance/assignments': 'perm:governance.manage',
+  'POST /governance/roles': 'perm:governance.manage',
+  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
+  'POST /governance/assignments': 'perm:governance.manage',
+  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+};
+
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
 // MODULE (modules/<key>/routes/…), pinned like EXPECTED_RANKS but verified ONLY
 // when that module is in scope (its routes were discovered in this scan). So an
@@ -400,24 +415,28 @@ const MODULE_EXPECTED_RANKS = {
     'POST /security/reports/:id/fix': 'perm:security.report.adjudicate',
     'POST /security/reports/:id/link-fix': 'perm:security.report.adjudicate',
   },
-  // The governance tab's server half (BV1.R110, ADR 0151) — the routes that EDIT
-  // the role/permission graph itself. Every route, the three reads included, is
-  // pinned to the `governance.manage` ATOM rather than a rank: on this surface
-  // the atom IS the authority (it is the catalog's meta-escalation key), and a
-  // downgrade here is the model's worst case — the routes that write authority
-  // drifting below the wall that guards authority. Reads are pinned too because
-  // the full role/grant/assignment map is the authority model's blueprint.
-  governance: {
-    'GET /governance/roles': 'perm:governance.manage',
-    'GET /governance/permissions': 'perm:governance.manage',
-    'GET /governance/assignments': 'perm:governance.manage',
-    'POST /governance/roles': 'perm:governance.manage',
-    'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-    'POST /governance/assignments': 'perm:governance.manage',
-    'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
-  },
+  // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
+  // the routes that EDIT the rank/permission graph itself. Every route, the three
+  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // on this surface the atom IS the authority (it is the catalog's meta-escalation
+  // key), and a downgrade here is the model's worst case — the routes that write
+  // authority drifting below the wall that guards authority. Reads are pinned too
+  // because the full rank/grant/assignment map is the authority model's blueprint.
+  //
+  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
+  // 1003006), not here: R02 only makes the pins reachable under both module keys.
+  // Renaming the paths before the routes move would pin routes that do not exist
+  // and red the build for the whole window.
+  governance: GOVERNMENT_PINS,
+  // The same pins under the post-ADR-0174 module name (goal 1000068, task
+  // 1003003). Pins are applied only when the module directory is IN SCOPE — at
+  // least one route file was discovered under modules/<key>/ — so this entry is
+  // inert until R04 (task 1003005) moves the folder, and becomes load-bearing
+  // the moment it does, with no second edit needed. Both keys reference the SAME
+  // object rather than a copy: two literals here would be the "second list that
+  // drifts" failure mode this file exists to prevent, on the surface where a
+  // silent drift is worst.
+  government: GOVERNMENT_PINS,
 };
 
 // The rank a route's RANK middleware implies, or null when it carries none.

package/src/module-api.js

@@ -791,8 +791,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.180 with no explicit bump. run 31972686846. (task 1002620)
 //   1.19.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
+//   1.19.183 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.182'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.183'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/governance_protected_surfaces.mjs

@@ -83,14 +83,70 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
   '.claude/settings.json',
 ];
 
+// Globs added to the registry SINCE R101, each with the change that added it.
+// Kept separate from the verbatim pre-R101 array above so that array stays what
+// it claims to be — the literal pre-change constant. Overwriting it to make a
+// later addition pass would destroy the only evidence that R101 moved WHERE the
+// truth lives without changing WHAT is protected.
+//
+// Each entry is { after, glob, why }: `after` is the glob it is inserted
+// directly below, so the expected list is reconstructed in order rather than
+// re-pasted (a re-paste is how the two lists drift apart).
+const ADDED_SINCE_R101 = [
+  {
+    after: 'modules/governance/',
+    glob: 'modules/government/',
+    why: 'goal 1000068 / task 1003003 (ADR 0174) — the authz core is renamed '
+       + 'governance→government. The new glob is registered BEFORE the folder '
+       + 'moves because `protected` DERIVES from this registry: without it the '
+       + 'new module key computes protected:false and both the Archon gate on '
+       + 'goal creation and the pre-push block on these files would silently lapse.',
+  },
+];
+
+// The list the registry must produce TODAY: the pre-R101 set with each
+// documented addition spliced in at its declared position.
+const EXPECTED_GLOBS = (() => {
+  const out = [...EXPECTED_GLOBS_BEFORE_R101];
+  for (const a of ADDED_SINCE_R101) {
+    const at = out.indexOf(a.after);
+    assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
+    out.splice(at + 1, 0, a.glob);
+  }
+  return out;
+})();
+
 // ---------- behavior identity: the same globs, at the same floor ----------
 
-test('the registry reproduces the pre-R101 PROTECTED_GLOBS exactly, in order', () => {
-  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101);
-  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS_BEFORE_R101,
+test('nothing protected before R101 has been unprotected since', () => {
+  // The load-bearing half. Additions are ordinary policy; a REMOVAL silently
+  // unprotects a trust surface, so it is asserted separately and must never be
+  // satisfied by editing the pre-R101 array.
+  for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
+    assert.ok(
+      registry.PROTECTED_GLOBS.includes(glob),
+      `'${glob}' was protected before R101 and is no longer in the registry — `
+      + 'a protected surface cannot be dropped without an ADR saying why.',
+    );
+  }
+});
+
+test('the registry reproduces the expected glob list exactly, in order', () => {
+  assert.deepEqual(registry.PROTECTED_GLOBS, EXPECTED_GLOBS);
+  assert.deepEqual(ppc.PROTECTED_GLOBS, EXPECTED_GLOBS,
     'the kernel matcher must expose the same derived list the registry declares');
 });
 
+test('every glob added since R101 carries a documented reason', () => {
+  for (const a of ADDED_SINCE_R101) {
+    assert.ok(a.why && a.why.length > 40,
+      `${a.glob} must record WHY it became protected — an undocumented addition `
+      + 'is indistinguishable from a typo.');
+    assert.ok(registry.PROTECTED_GLOBS.includes(a.glob),
+      `${a.glob} is declared as added but is not in the registry`);
+  }
+});
+
 test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
   for (const s of registry.SURFACES) {
     assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
@@ -128,7 +184,7 @@ test('the registry loads synchronously from the repo with no DB and no server',
     "const p=require('./src/bongos/permission-path-check');" +
     "process.stdout.write(String(p.PROTECTED_GLOBS.length)+':'+String(p.floorFor('migrations/001.sql')));",
   ], { cwd: ROOT, encoding: 'utf8', env: { ...process.env, DATABASE_URL: '', PGHOST: '' } });
-  assert.equal(out, `${EXPECTED_GLOBS_BEFORE_R101.length}:metic`);
+  assert.equal(out, `${EXPECTED_GLOBS.length}:metic`);
 });
 
 test('the registry data file carries no DB/network dependency', () => {