@bongos/core 1.19.182 → 1.19.184

package/modules/{governance → government}/db.js

@@ -11,7 +11,7 @@
 // next request — the ADR 0016 trust-boundary rule the resolver inherits.
 
 const { pool } = require('../../src/module-api');
-const { planRankRoleSync } = require('./rank-roles');
+const { planRankSync } = require('./ranks');
 
 // Every permission_key granted to any role the builder holds. Duplicates across
 // roles are collapsed by the DISTINCT — the resolver's UNION semantics. Returns
@@ -20,8 +20,8 @@ const { planRankRoleSync } = require('./rank-roles');
 async function getPermissionKeysForBuilder(builderId) {
   const { rows } = await pool.query(
     `SELECT DISTINCT rp.permission_key
-       FROM governance_builder_roles br
-       JOIN governance_role_permissions rp ON rp.role_key = br.role_key
+       FROM government_builder_ranks br
+       JOIN government_rank_permissions rp ON rp.rank_key = br.rank_key
       WHERE br.builder_id = $1`,
     [builderId],
   );
@@ -32,7 +32,7 @@ async function getPermissionKeysForBuilder(builderId) {
 // R110/R111) and for explaining a 403. Not part of the resolve path.
 async function getRoleKeysForBuilder(builderId) {
   const { rows } = await pool.query(
-    `SELECT role_key FROM governance_builder_roles WHERE builder_id = $1 ORDER BY role_key`,
+    `SELECT rank_key AS role_key FROM government_builder_ranks WHERE builder_id = $1 ORDER BY rank_key`,
     [builderId],
   );
   return rows.map((r) => r.role_key);
@@ -41,7 +41,7 @@ async function getRoleKeysForBuilder(builderId) {
 // --- the rank→role WRITE half (BV1.R95b) ------------------------------------
 //
 // Everything above this line only READS. Until R95b the only write to
-// governance_builder_roles in the whole repo was governance_002's run-once
+// government_builder_ranks in the whole repo was governance_002's run-once
 // backfill, so a builder created after it had NO role (locked out of every
 // permission gate) and a builder whose rank CHANGED kept their OLD rank-role
 // (a demoted Archon still resolving Archon permissions — the ADR 0016 defect).
@@ -49,7 +49,7 @@ async function getRoleKeysForBuilder(builderId) {
 // The writer below is a TRANSACTION PARTICIPANT: every caller hands it the client
 // its own BEGIN/COMMIT is running on, so the role rotation commits — or rolls back
 // — atomically with the rank write it accompanies. Core reaches it through the
-// `governance.roleSync` kernel port (routes/role-sync.js); it never imports this
+// `government.rankSync` kernel port (routes/rank-sync.js); it never imports this
 // module (ADR 0083).
 
 // The seeded rank-roles as the DB actually defines them. Read per call rather than
@@ -57,8 +57,8 @@ async function getRoleKeysForBuilder(builderId) {
 // runs on rank writes + sign-in, never in a hot loop.
 async function getSeededRankRoles(q) {
   const { rows } = await q.query(
-    `SELECT role_key, seeded_rank, is_system
-       FROM governance_roles
+    `SELECT rank_key AS role_key, seeded_rank, is_system
+       FROM government_ranks
       WHERE is_system = true AND seeded_rank IS NOT NULL`,
   );
   return rows;
@@ -68,16 +68,16 @@ async function getSeededRankRoles(q) {
 // seeded rank-role from an Archon-assigned custom one.
 async function getRoleAssignmentsForBuilder(q, builderId) {
   const { rows } = await q.query(
-    `SELECT br.role_key, r.is_system, r.seeded_rank
-       FROM governance_builder_roles br
-       JOIN governance_roles r ON r.role_key = br.role_key
+    `SELECT br.rank_key AS role_key, r.is_system, r.seeded_rank
+       FROM government_builder_ranks br
+       JOIN government_ranks r ON r.rank_key = br.rank_key
       WHERE br.builder_id = $1`,
     [builderId],
   );
   return rows;
 }
 
-// syncRankRole(client, { builderId, rank }) — make the builder's seeded rank-role
+// syncRank(client, { builderId, rank }) — make the builder's seeded rank-role
 // match `rank`: add the matching one, DELETE every other seeded one, leave custom
 // roles alone. `client` is the caller's open transaction client; pass null/undefined
 // to run on the pool (the sign-in path, which has no surrounding transaction).
@@ -89,27 +89,27 @@ async function getRoleAssignmentsForBuilder(q, builderId) {
 // assigned_by is left NULL: a rank-derived assignment is the system's, not a person's
 // (governance_002's backfill uses the same convention; the human decision is audited
 // in credit_log's rank_change row).
-async function syncRankRole(client, { builderId, rank } = {}) {
+async function syncRank(client, { builderId, rank } = {}) {
   if (builderId === null || builderId === undefined || builderId === '') {
     return { target: null, added: [], removed: [] };
   }
   const q = client || pool;
   const seededRoles = await getSeededRankRoles(q);
   const currentRoles = await getRoleAssignmentsForBuilder(q, builderId);
-  const plan = planRankRoleSync({ rank, currentRoles, seededRoles });
+  const plan = planRankSync({ rank, currentRoles, seededRoles });
 
   if (plan.remove.length > 0) {
     await q.query(
-      `DELETE FROM governance_builder_roles
-        WHERE builder_id = $1 AND role_key = ANY($2::text[])`,
+      `DELETE FROM government_builder_ranks
+        WHERE builder_id = $1 AND rank_key = ANY($2::text[])`,
       [builderId, [...plan.remove]],
     );
   }
   if (plan.add.length > 0) {
     await q.query(
-      `INSERT INTO governance_builder_roles (builder_id, role_key)
+      `INSERT INTO government_builder_ranks (builder_id, rank_key)
        SELECT $1, unnest($2::text[])
-       ON CONFLICT (builder_id, role_key) DO NOTHING`,
+       ON CONFLICT (builder_id, rank_key) DO NOTHING`,
       [builderId, [...plan.add]],
     );
   }
@@ -127,23 +127,23 @@ async function syncRankRole(client, { builderId, rank } = {}) {
 
 async function listRolesWithGrants() {
   const { rows } = await pool.query(
-    `SELECT r.role_key, r.label, r.description, r.is_system, r.seeded_rank,
+    `SELECT r.rank_key AS role_key, r.label, r.description, r.is_system, r.seeded_rank,
             r.created_by, r.created_at,
             COALESCE(array_agg(rp.permission_key ORDER BY rp.permission_key)
                      FILTER (WHERE rp.permission_key IS NOT NULL), '{}') AS permissions
-       FROM governance_roles r
-       LEFT JOIN governance_role_permissions rp ON rp.role_key = r.role_key
+       FROM government_ranks r
+       LEFT JOIN government_rank_permissions rp ON rp.rank_key = r.rank_key
       GROUP BY r.id
-      ORDER BY r.is_system DESC, r.role_key`,
+      ORDER BY r.is_system DESC, r.rank_key`,
   );
   return rows;
 }
 
 async function getRoleByKey(roleKey) {
   const { rows } = await pool.query(
-    `SELECT role_key, label, description, is_system, seeded_rank, created_by, created_at
-       FROM governance_roles
-      WHERE role_key = $1`,
+    `SELECT rank_key AS role_key, label, description, is_system, seeded_rank, created_by, created_at
+       FROM government_ranks
+      WHERE rank_key = $1`,
     [roleKey],
   );
   return rows[0] ?? null;
@@ -151,9 +151,9 @@ async function getRoleByKey(roleKey) {
 
 async function createRole({ roleKey, label, description, createdBy }) {
   const { rows } = await pool.query(
-    `INSERT INTO governance_roles (role_key, label, description, is_system, seeded_rank, created_by)
+    `INSERT INTO government_ranks (rank_key, label, description, is_system, seeded_rank, created_by)
      VALUES ($1, $2, $3, false, NULL, $4)
-     RETURNING role_key, label, description, is_system, seeded_rank, created_by, created_at`,
+     RETURNING rank_key AS role_key, label, description, is_system, seeded_rank, created_by, created_at`,
     [roleKey, label, description ?? null, createdBy],
   );
   return rows[0];
@@ -161,9 +161,9 @@ async function createRole({ roleKey, label, description, createdBy }) {
 
 async function grantRolePermission({ roleKey, permissionKey }) {
   const { rowCount } = await pool.query(
-    `INSERT INTO governance_role_permissions (role_key, permission_key)
+    `INSERT INTO government_rank_permissions (rank_key, permission_key)
      VALUES ($1, $2)
-     ON CONFLICT (role_key, permission_key) DO NOTHING`,
+     ON CONFLICT (rank_key, permission_key) DO NOTHING`,
     [roleKey, permissionKey],
   );
   return rowCount > 0;
@@ -171,8 +171,8 @@ async function grantRolePermission({ roleKey, permissionKey }) {
 
 async function revokeRolePermission({ roleKey, permissionKey }) {
   const { rowCount } = await pool.query(
-    `DELETE FROM governance_role_permissions
-      WHERE role_key = $1 AND permission_key = $2`,
+    `DELETE FROM government_rank_permissions
+      WHERE rank_key = $1 AND permission_key = $2`,
     [roleKey, permissionKey],
   );
   return rowCount > 0;
@@ -188,12 +188,12 @@ async function resetRoleGrants({ roleKey, permissionKeys }) {
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
-    await client.query(`DELETE FROM governance_role_permissions WHERE role_key = $1`, [roleKey]);
+    await client.query(`DELETE FROM government_rank_permissions WHERE rank_key = $1`, [roleKey]);
     if (permissionKeys.length > 0) {
       await client.query(
-        `INSERT INTO governance_role_permissions (role_key, permission_key)
+        `INSERT INTO government_rank_permissions (rank_key, permission_key)
          SELECT $1, unnest($2::text[])
-         ON CONFLICT (role_key, permission_key) DO NOTHING`,
+         ON CONFLICT (rank_key, permission_key) DO NOTHING`,
         [roleKey, [...permissionKeys]],
       );
     }
@@ -210,21 +210,21 @@ async function resetRoleGrants({ roleKey, permissionKeys }) {
 async function listAssignments() {
   const { rows } = await pool.query(
     `SELECT br.builder_id, b.github_login, b.display_name, b.rank,
-            br.role_key, r.label AS role_label, r.is_system, r.seeded_rank,
+            br.rank_key AS role_key, r.label AS role_label, r.is_system, r.seeded_rank,
             br.assigned_by, br.assigned_at
-       FROM governance_builder_roles br
+       FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
-       JOIN governance_roles r ON r.role_key = br.role_key
-      ORDER BY br.builder_id, br.role_key`,
+       JOIN government_ranks r ON r.rank_key = br.rank_key
+      ORDER BY br.builder_id, br.rank_key`,
   );
   return rows;
 }
 
 async function assignRole({ builderId, roleKey, assignedBy }) {
   const { rowCount } = await pool.query(
-    `INSERT INTO governance_builder_roles (builder_id, role_key, assigned_by)
+    `INSERT INTO government_builder_ranks (builder_id, rank_key, assigned_by)
      VALUES ($1, $2, $3)
-     ON CONFLICT (builder_id, role_key) DO NOTHING`,
+     ON CONFLICT (builder_id, rank_key) DO NOTHING`,
     [builderId, roleKey, assignedBy],
   );
   return rowCount > 0;
@@ -232,8 +232,8 @@ async function assignRole({ builderId, roleKey, assignedBy }) {
 
 async function unassignRole({ builderId, roleKey }) {
   const { rowCount } = await pool.query(
-    `DELETE FROM governance_builder_roles
-      WHERE builder_id = $1 AND role_key = $2`,
+    `DELETE FROM government_builder_ranks
+      WHERE builder_id = $1 AND rank_key = $2`,
     [builderId, roleKey],
   );
   return rowCount > 0;
@@ -244,7 +244,7 @@ module.exports = {
   getRoleKeysForBuilder,
   getSeededRankRoles,
   getRoleAssignmentsForBuilder,
-  syncRankRole,
+  syncRank,
   listRolesWithGrants,
   getRoleByKey,
   createRole,

package/modules/government/migrations/government_001_rename_from_governance.sql

@@ -0,0 +1,213 @@
+-- governance_008_rename_to_government_ranks.sql
+-- Goal 1000068 R03 (task 1003004) — ADR 0174.
+--
+-- Renames the three authz tables, their indexes, their constraints and the
+-- `role_key` column to the post-ADR-0174 vocabulary: the permission system is
+-- the GOVERNMENT, and the positions in it are RANKS. "Role" is reserved for the
+-- three crafts (Artist / Ideator / Builder).
+--
+--   governance_roles            -> government_ranks
+--   governance_builder_roles    -> government_builder_ranks
+--   governance_role_permissions -> government_rank_permissions
+--   <all three>.role_key        -> rank_key
+--
+-- ── THIS MIGRATION IS NOT SAFE TO APPLY BEFORE R04/R05 ──────────────────────
+-- It is a BREAKING rename with no compatibility shim. The moment it applies,
+-- code that still queries `governance_roles` fails — and that code is the
+-- permission resolver, on every authenticated request. That is why the live
+-- instance's core auto-upgrade sweep (`cloudbongos-core-update-subscription
+-- .timer`) was stopped and disabled on 2026-08-16, freezing the pin at core
+-- 1.19.179 so this migration cannot reach the live database until the renamed
+-- code (R04 task 1003005, R05 task 1003006) is in the same release. Task
+-- 1003011 re-enables the sweep and is dependency-gated on all three.
+-- The owner chose the pause over compatibility views, having been shown both.
+--
+-- ── WHAT THIS MIGRATION DELIBERATELY DOES NOT DO ────────────────────────────
+-- It does NOT rename the permission-key ROWS (`governance.manage` ->
+-- `government.manage`, `page.view.governance` -> `page.view.government`). Those
+-- belong in R05, in the SAME commit as the `catalog.js` constants, because the
+-- resolver DROPS any grant naming a key the catalog does not define (the
+-- fail-closed rule in modules/governance/CLAUDE.md). Renaming the rows here
+-- would mean that between this migration and R05 every `government.manage` row
+-- resolves to nothing — and since that key gates the Government tab itself, the
+-- owner would be locked out of the surface used to inspect the damage. The
+-- schema renames below pair with R04's code; the key renames pair with R05's.
+--
+-- ── MECHANICS ───────────────────────────────────────────────────────────────
+-- ALTER TABLE ... RENAME is catalog-only: it rewrites no rows, holds an
+-- ACCESS EXCLUSIVE lock for the instant it takes, and carries every index,
+-- constraint, foreign key, sequence ownership and privilege with it (they
+-- reference the table by OID, not by name). The same is true of RENAME COLUMN,
+-- including for the two inbound foreign keys that point at `role_key`.
+-- Constraint and index NAMES do not follow, however — Postgres leaves them
+-- spelled the old way — so they are renamed explicitly below. Nothing depends
+-- on those names at runtime; they are renamed so a reader of \d output is not
+-- told a story about "roles" that stopped being true.
+--
+-- IDEMPOTENT: every statement is guarded on the old name still being present,
+-- so a re-run after a partial apply is a no-op rather than an error. migrate.sh
+-- applies each file once, but a hand-run during recovery should not punish you.
+--
+-- ── VERIFIED AGAINST REAL DATA ──────────────────────────────────────────────
+-- Rehearsed on a scratch database restored from the live 2026-08-16 dump (not a
+-- synthetic fixture): apply, apply-again, roll back, apply again. The
+-- (builder, permission) fingerprint md5 fb6be239ae2b3bf811888ac90cfb6346 and the
+-- row baseline 4 ranks / 15 assignments / 161 grants were byte-identical at
+-- every step, and an INSERT through the renamed sequence still allocated an id.
+-- Snapshots of the live database live at
+-- /home/lars/mig/pre-govt-rename-{authz,full}-2026-08-16T213128Z.*
+--
+-- ROLLBACK — reverse every RENAME. Lossless (no row is touched). This exact
+-- script was executed as part of the rehearsal above:
+--
+--   BEGIN;
+--   ALTER TABLE government_ranks            RENAME TO governance_roles;
+--   ALTER TABLE government_builder_ranks    RENAME TO governance_builder_roles;
+--   ALTER TABLE government_rank_permissions RENAME TO governance_role_permissions;
+--   ALTER TABLE governance_roles            RENAME COLUMN rank_key TO role_key;
+--   ALTER TABLE governance_builder_roles    RENAME COLUMN rank_key TO role_key;
+--   ALTER TABLE governance_role_permissions RENAME COLUMN rank_key TO role_key;
+--   ALTER SEQUENCE government_ranks_id_seq  RENAME TO governance_roles_id_seq;
+--   ALTER INDEX government_rank_permissions_perm_idx
+--     RENAME TO governance_role_permissions_perm_idx;
+--   ALTER INDEX government_builder_ranks_rank_idx
+--     RENAME TO governance_builder_roles_role_idx;
+--   COMMIT;
+--
+-- Constraint names are left spelled the new way by that rollback; they are
+-- cosmetic and step 4 below re-derives them on the next forward apply.
+
+BEGIN;
+
+-- ── 1. the tables ───────────────────────────────────────────────────────────
+DO $$
+BEGIN
+  IF to_regclass('public.governance_roles') IS NOT NULL
+     AND to_regclass('public.government_ranks') IS NULL THEN
+    ALTER TABLE governance_roles RENAME TO government_ranks;
+  END IF;
+
+  IF to_regclass('public.governance_builder_roles') IS NOT NULL
+     AND to_regclass('public.government_builder_ranks') IS NULL THEN
+    ALTER TABLE governance_builder_roles RENAME TO government_builder_ranks;
+  END IF;
+
+  IF to_regclass('public.governance_role_permissions') IS NOT NULL
+     AND to_regclass('public.government_rank_permissions') IS NULL THEN
+    ALTER TABLE governance_role_permissions RENAME TO government_rank_permissions;
+  END IF;
+END $$;
+
+-- ── 2. the role_key -> rank_key column, on all three tables ─────────────────
+-- The two child columns are foreign keys onto the parent's unique column; a
+-- RENAME COLUMN updates the dependency in place, so the order here is free.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_ranks' AND column_name = 'role_key') THEN
+    ALTER TABLE government_ranks RENAME COLUMN role_key TO rank_key;
+  END IF;
+
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_builder_ranks' AND column_name = 'role_key') THEN
+    ALTER TABLE government_builder_ranks RENAME COLUMN role_key TO rank_key;
+  END IF;
+
+  IF EXISTS (SELECT 1 FROM information_schema.columns
+              WHERE table_name = 'government_rank_permissions' AND column_name = 'role_key') THEN
+    ALTER TABLE government_rank_permissions RENAME COLUMN role_key TO rank_key;
+  END IF;
+END $$;
+
+-- ── 3. indexes ──────────────────────────────────────────────────────────────
+DO $$
+BEGIN
+  IF to_regclass('public.governance_role_permissions_perm_idx') IS NOT NULL
+     AND to_regclass('public.government_rank_permissions_perm_idx') IS NULL THEN
+    ALTER INDEX governance_role_permissions_perm_idx
+      RENAME TO government_rank_permissions_perm_idx;
+  END IF;
+
+  IF to_regclass('public.governance_builder_roles_role_idx') IS NOT NULL
+     AND to_regclass('public.government_builder_ranks_rank_idx') IS NULL THEN
+    ALTER INDEX governance_builder_roles_role_idx
+      RENAME TO government_builder_ranks_rank_idx;
+  END IF;
+END $$;
+
+-- ── 3b. the bigserial sequence ──────────────────────────────────────────────
+-- `id bigserial` created `governance_roles_id_seq`, and a table rename does NOT
+-- carry the sequence's NAME with it — only its ownership. Left alone, the
+-- database would go on saying "governance_roles" forever in the one place
+-- nobody thinks to look, which is precisely the drift this goal exists to end.
+-- Safe: the column default is stored as an OID (`nextval('…'::regclass)`), so
+-- it re-renders against the new name and keeps working.
+DO $$
+BEGIN
+  IF to_regclass('public.governance_roles_id_seq') IS NOT NULL
+     AND to_regclass('public.government_ranks_id_seq') IS NULL THEN
+    ALTER SEQUENCE governance_roles_id_seq RENAME TO government_ranks_id_seq;
+  END IF;
+END $$;
+
+-- ── 4. constraint names ─────────────────────────────────────────────────────
+-- Cosmetic but load-bearing for the next reader: an error message quoting
+-- `governance_builder_roles_role_key_fkey` after the rename would send them
+-- looking for a table that no longer exists.
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT c.conname, t.relname AS tbl,
+           replace(replace(replace(c.conname,
+             'governance_role_permissions', 'government_rank_permissions'),
+             'governance_builder_roles',    'government_builder_ranks'),
+             'governance_roles',            'government_ranks') AS newname
+      FROM pg_constraint c
+      JOIN pg_class t ON t.oid = c.conrelid
+     WHERE t.relname IN ('government_ranks', 'government_builder_ranks', 'government_rank_permissions')
+       AND c.conname LIKE 'governance\_%'
+  LOOP
+    -- the _role_key_ segment inside a constraint name follows the column
+    EXECUTE format('ALTER TABLE %I RENAME CONSTRAINT %I TO %I',
+                   r.tbl, r.conname, replace(r.newname, '_role_key', '_rank_key'));
+  END LOOP;
+END $$;
+
+-- ── 5. prove the rename moved names only, never rows ────────────────────────
+-- A rename that silently lost a grant would be catastrophic and invisible: the
+-- resolver would just start denying. Assert the baseline captured before the
+-- migration ran. If this fails the whole transaction rolls back.
+DO $$
+DECLARE
+  n_ranks int;
+  n_assign int;
+  n_grants int;
+BEGIN
+  SELECT count(*) INTO n_ranks   FROM government_ranks;
+  SELECT count(*) INTO n_assign  FROM government_builder_ranks;
+  SELECT count(*) INTO n_grants  FROM government_rank_permissions;
+
+  IF n_ranks = 0 OR n_assign = 0 OR n_grants = 0 THEN
+    RAISE EXCEPTION
+      'government rename lost rows: ranks=%, assignments=%, grants=% — expected all non-zero. Rolling back.',
+      n_ranks, n_assign, n_grants;
+  END IF;
+
+  -- Every assignment and every grant must still resolve to a real rank. A
+  -- broken FK cannot happen through RENAME, so this is a cheap proof that the
+  -- constraints really did travel with the tables rather than being dropped.
+  IF EXISTS (SELECT 1 FROM government_builder_ranks b
+              WHERE NOT EXISTS (SELECT 1 FROM government_ranks r WHERE r.rank_key = b.rank_key)) THEN
+    RAISE EXCEPTION 'government_builder_ranks has an assignment pointing at no rank — rolling back.';
+  END IF;
+  IF EXISTS (SELECT 1 FROM government_rank_permissions g
+              WHERE NOT EXISTS (SELECT 1 FROM government_ranks r WHERE r.rank_key = g.rank_key)) THEN
+    RAISE EXCEPTION 'government_rank_permissions has a grant pointing at no rank — rolling back.';
+  END IF;
+
+  RAISE NOTICE 'government rename OK: % ranks, % assignments, % grants', n_ranks, n_assign, n_grants;
+END $$;
+
+COMMIT;

package/modules/government/module.json

@@ -0,0 +1,22 @@
+{
+  "key": "government",
+  "title": "Government (configurable ranks & permissions)",
+  "description": "Discord-style configurable ranks and permissions (ADR 0151, BONGOS-V1 goal 1000030; renamed governance\u2192government by ADR 0174). Permissions are the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; this module owns the code-defined permission catalog (each key flagged `system` = trust-boundary, `substrate` = enforced out of band, or operational = delegable) plus the compatibility seed that reproduces the rank thresholds exactly. A core-domain module, default-on: a Cloud Bongos instance ships configurable ranks the way it ships its status page. The word `role` is deliberately absent here \u2014 it is reserved for the three crafts (Artist, Ideator, Builder). Preserves ADR 0016 (authority resolved server-side, per request, uncached).",
+  "coreVersion": "^1.18.0",
+  "default": true,
+  "maintenance": {
+    "status": "core-maintained"
+  },
+  "contributes": {
+    "migrations": true,
+    "routes": [
+      "governance",
+      "rank-sync"
+    ]
+  },
+  "provides": [
+    "government",
+    "government.rankSync"
+  ],
+  "consumes": []
+}

package/modules/{governance → government}/protected-surfaces.json

@@ -34,7 +34,8 @@
     { "glob": "modules/lifecycle/routes/", "group": "authz", "why": "BV1.R86: the lifecycle routes carved out of src/bongos/routes/ — the gates follow the routes" },
     { "glob": "src/bongos/routes.js", "group": "authz", "why": "the route MOUNT table (a new ungated route lands here)" },
     { "glob": "server.js", "group": "authz", "why": "the Express entrypoint — wires every router + host routing" },
-    { "glob": "modules/governance/", "group": "authz", "why": "the governance module (ADR 0151) — its resolver, catalog, gates AND this registry ARE the authz core; the glob is the prospective carve so CREATION is gated as strictly as edits (ADR 0086 §4)" },
+    { "glob": "modules/governance/", "group": "authz", "why": "the PRE-ADR-0174 path of the authz core. The folder itself moved to modules/government/ in goal 1000068 R03/R04, so nothing matches this glob in the core tree any more — it is kept for the one-release compatibility window because an in-flight branch or a vendored instance checkout may still carry the old path, and a protected path that silently stops being protected mid-rename is the failure this whole sequence exists to avoid. Dropped by R05 (task 1003006) with the rest of the compatibility surface." },
+    { "glob": "modules/government/", "group": "authz", "why": "the same authz core under its post-ADR-0174 name (goal 1000068, task 1003003). Listed BEFORE the folder moves, deliberately: `protected` is DERIVED from this registry, so a module key whose globs are absent here computes protected:false — which would silently drop the Archon gate on goal creation AND the pre-push block on these files for the whole window between the key landing and the folder arriving. The prospective-carve precedent is the modules/governance/ entry directly above (ADR 0086 §4)." },
     { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
     { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },
     { "glob": "modules/dev-box/box-credential.js", "group": "box-access", "why": "mints the box source credential" },

package/modules/{governance/rank-roles.js → government/ranks.js}

@@ -1,12 +1,12 @@
 'use strict';
 
-// modules/governance/rank-roles.js — the PURE rank→role rotation decision
+// modules/governance/ranks.js — the PURE rank→role rotation decision
 // (ADR 0151, BV1.R95b).
 //
 // A builder holds exactly ONE seeded rank-role. governance_002 seeds four of them
 // (is_system=true, seeded_rank set) and backfills each builder the one matching
 // their rank — but that backfill is run-once, so nothing kept it true afterwards.
-// This is the decision the writer (db.syncRankRole) executes to keep it true:
+// This is the decision the writer (db.syncRank) executes to keep it true:
 // given a builder's CURRENT assignments and a rank, which seeded role to ADD and
 // which to REMOVE.
 //
@@ -31,18 +31,18 @@
 // Pure: no DB, no I/O, no module state. The writer reads the two row sets and
 // executes this verdict, so the unit tests exercise production logic directly.
 
-// A row (an assignment joined to governance_roles, or a role row) is a SEEDED
+// A row (an assignment joined to government_ranks, or a role row) is a SEEDED
 // rank-role only when it is both a system role and names the rank it reproduces.
 // Both halves are required: is_system alone would admit a future non-rank system
 // role, and seeded_rank alone would trust a column a custom role could carry.
-function isSeededRankRole(row) {
+function isSeededRank(row) {
   return !!row
     && row.is_system === true
     && typeof row.seeded_rank === 'string'
     && row.seeded_rank.length > 0;
 }
 
-// planRankRoleSync({ rank, currentRoles, seededRoles }) → { target, add, remove, next }
+// planRankSync({ rank, currentRoles, seededRoles }) → { target, add, remove, next }
 //
 //   rank         the builder's rank AFTER the write being synced.
 //   currentRoles the builder's assignments, each { role_key, is_system, seeded_rank }.
@@ -55,13 +55,13 @@ function isSeededRankRole(row) {
 //   add     [] or [target] — empty when it is already held (idempotence).
 //   remove  every OTHER seeded rank-role currently held. Custom roles never appear.
 //   next    the resulting role_key set, sorted — "what the role set becomes".
-function planRankRoleSync({ rank, currentRoles = [], seededRoles = [] } = {}) {
-  const match = seededRoles.find((r) => isSeededRankRole(r) && r.seeded_rank === rank);
+function planRankSync({ rank, currentRoles = [], seededRoles = [] } = {}) {
+  const match = seededRoles.find((r) => isSeededRank(r) && r.seeded_rank === rank);
   const target = match ? match.role_key : null;
 
   const held = currentRoles.filter((r) => r && typeof r.role_key === 'string');
   const remove = held
-    .filter((r) => isSeededRankRole(r) && r.role_key !== target)
+    .filter((r) => isSeededRank(r) && r.role_key !== target)
     .map((r) => r.role_key);
   const add = target && !held.some((r) => r.role_key === target) ? [target] : [];
 
@@ -80,4 +80,4 @@ function planRankRoleSync({ rank, currentRoles = [], seededRoles = [] } = {}) {
   });
 }
 
-module.exports = { planRankRoleSync, isSeededRankRole };
+module.exports = { planRankSync, isSeededRank };

package/modules/{governance → government}/routes/governance.js

@@ -81,8 +81,8 @@ const governancePort = {
 };
 
 function registerSeams() {
-  if (!api.hasProvider('governance')) {
-    api.registerProvider('governance', governancePort);
+  if (!api.hasProvider('government')) {
+    api.registerProvider('government', governancePort);
   }
   // The session-load fold (task 1002556): the kernel's lookupSession embeds this
   // fragment so the SAME round-trip carries the builder's raw grant keys, and
@@ -96,8 +96,8 @@ function registerSeams() {
     api.registerProvider('session-grants-sql', {
       selectFragment: `,
             (SELECT COALESCE(array_agg(DISTINCT rp.permission_key), '{}')
-               FROM governance_builder_roles br
-               JOIN governance_role_permissions rp ON rp.role_key = br.role_key
+               FROM government_builder_ranks br
+               JOIN government_rank_permissions rp ON rp.role_key = br.role_key
               WHERE br.builder_id = s.builder_id) AS raw_permission_keys`,
     });
   }
@@ -116,7 +116,7 @@ function registerSeams() {
 // for different reasons and only one of those reasons still holds:
 //
 //   • GRANTS on the three sub-Archon rank-roles are now EDITABLE. Their rows were
-//     always ordinary `governance_role_permissions` rows (the governance_002 seed
+//     always ordinary `government_rank_permissions` rows (the governance_002 seed
 //     writes them); the old refusal was policy, not structure. What a rank means is
 //     now the owner's to set from the tab, and `catalog.isGrantableTo()` answers
 //     which keys per role. The ARCHON rank-role stays immutable — it holds

package/modules/{governance/routes/role-sync.js → government/routes/rank-sync.js}

@@ -11,7 +11,7 @@
 //   • this one is resolved by exactly three writers (the two _applyRankChangeTx
 //     twins + the sign-in path) and is a TRANSACTION PARTICIPANT — it takes the
 //     caller's client so the role rotation commits or rolls back with the rank write.
-// The port name is namespaced (`governance.roleSync`) like the `ideas.capture` /
+// The port name is namespaced (`government.rankSync`) like the `ideas.capture` /
 // `art.getBuilderGeminiKeyRow` / `grade.builderRollingAvgGrade` ports.
 //
 // Registered from a route factory for the same reason routes/governance.js is:
@@ -28,16 +28,16 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const db = require('../db');
 
-// DELEGATE, never spread — a test that stubs db.syncRankRole must still bite at call
+// DELEGATE, never spread — a test that stubs db.syncRank must still bite at call
 // time (the modules/onboarding/port.js precedent; a spread captures the original
 // reference at module-load).
-const rankRoleSyncPort = {
-  syncRankRole: (...a) => db.syncRankRole(...a),
+const rankSyncPort = {
+  syncRank: (...a) => db.syncRank(...a),
 };
 
 function registerSeams() {
-  if (!api.hasProvider('governance.roleSync')) {
-    api.registerProvider('governance.roleSync', rankRoleSyncPort);
+  if (!api.hasProvider('government.rankSync')) {
+    api.registerProvider('government.rankSync', rankSyncPort);
   }
 }
 
@@ -46,4 +46,4 @@ module.exports = function buildGovernanceRoleSyncRouter() {
   return express.Router();
 };
 
-module.exports.rankRoleSyncPort = rankRoleSyncPort;
+module.exports.rankSyncPort = rankSyncPort;