@bongos/core 1.19.182 → 1.19.184

package/modules/lifecycle/db.js

@@ -220,7 +220,7 @@ function xenosClaimAllowed(rank, newcomerFriendly) {
 // 0016 — resolved server-side, uncached), and taking a second pool connection while
 // a tx holds FOR UPDATE locks is a needless deadlock/exhaustion hazard.
 async function claimPermissionsFor(builderId) {
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   try {
     const keys = await governance.resolveBuilderPermissions(builderId);
@@ -408,12 +408,12 @@ function disambiguateWorktreeName(desired, taken) {
 //
 // Returns the updated builder row, or throws { code:'BUILDER_NOT_FOUND' } /
 // { code:'RANK_UNCHANGED' }.
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
 // (BV1.R95b, ADR 0151). This module's rank writer backs the automatic xenos→thetes
 // graduation, which had the same hole as the Archon-driven path: the rank moved and
 // the role did not, so a freshly-graduated Thetes kept the xenos role.
 //
-// Resolved through the `governance.roleSync` kernel port (never a sibling require —
+// Resolved through the `government.rankSync` kernel port (never a sibling require —
 // ADR 0083) and run on the CALLER's transaction client, so the rotation commits
 // atomically with the ship + graduation. A missing port (governance disabled) skips:
 // no role ⇒ zero permissions, fail-closed.
@@ -421,9 +421,9 @@ function disambiguateWorktreeName(desired, taken) {
 // TWINNED with src/bongos/db.js (the boundary-forced _applyRankChangeTx duplication,
 // ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 // _applyRankChangeTx — the in-transaction CORE of a rank change, shared by the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.182",
+  "version": "1.19.184",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.182",
+      "version": "1.19.184",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.182",
+  "version": "1.19.184",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -732,6 +732,16 @@ const LEGACY_NAMESPACED = {
   // game module: world_events + players were created before the module system (V1 schema). The
   // schema_migrations table is a core tracking table that every migration may re-create idempotently.
   game: new Set(['world_events', 'players', 'schema_migrations']),
+  // government module: the module KEY was renamed governance→government (ADR 0174, goal 1000068),
+  // so its own historical migrations now read as "outside the namespace" purely because the key
+  // moved underneath them. These three tables ARE this module's — under the name it used to have.
+  // They are not renamed in place because schema_migrations is keyed by filename STEM: renaming an
+  // already-applied migration file makes it look unapplied and re-runs it, and governance_002 is a
+  // seed/backfill. government_001_rename_from_governance.sql renames the live tables forward; these
+  // entries let the historical files that created them keep describing what actually happened.
+  government: new Set([
+    'governance_roles', 'governance_builder_roles', 'governance_role_permissions',
+  ]),
 };
 const DESTRUCTIVE_DDL = [
   { re: /\bdrop\s+table\b/i, label: 'DROP TABLE' },
@@ -1141,7 +1151,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
 // this check nothing in CI could see it.
 //
 // Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
-// branding.json, config/governance.json) is host content that legitimately names
+// branding.json, config/government.json) is host content that legitimately names
 // its host, and is boundary-excluded from the published core anyway.
 function checkNeutralConfigsNoHostIdentity() {
   const violations = [];

package/scripts/gds/migration-namespace.js

@@ -57,6 +57,15 @@ const LEGACY_BARE_CORE_MAX = 187;
 // module migrations must be `<key>_`-prefixed; these stay bare (already applied on prod).
 const LEGACY_BARE_MODULES = new Set(['game', 'demo']);
 
+// RENAMED_MODULE_PREFIXES: a module whose KEY was renamed keeps its historical
+// migration-filename prefix for files that were already applied. schema_migrations
+// is keyed by filename STEM, so renaming an applied migration makes it look
+// unapplied and RE-RUNS it — and a re-run seed/backfill is a data event, not a
+// no-op. The already-applied files therefore keep the old prefix forever; only
+// NEW migrations must carry the module's current namespace.
+//   government <- governance (ADR 0174, goal 1000068)
+const RENAMED_MODULE_PREFIXES = { government: new Set(['governance']) };
+
 // ---- parsing ---------------------------------------------------------------
 
 const BARE_RE = /^(\d{3,})_(.+)\.sql$/;
@@ -116,9 +125,11 @@ function filenameViolation(source, basename, { moduleKey } = {}) {
       ? null // legacy bare module — grandfathered
       : `module "${moduleKey}" migration "${basename}" is bare — a NEW module migration must be ${ns}_-prefixed (ADR 0083 §Decision #5 / ADR 0108 §5): use ${ns}_${pad3(p.number)}_${p.slug}.sql`;
   }
-  return p.prefix === ns
-    ? null
-    : `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
+  if (p.prefix === ns) return null;
+  // A renamed module's already-applied files keep their historical prefix (see
+  // RENAMED_MODULE_PREFIXES) — the stem is the schema_migrations key, so it cannot move.
+  if ((RENAMED_MODULE_PREFIXES[moduleKey] || new Set()).has(p.prefix)) return null;
+  return `module "${moduleKey}" migration "${basename}" carries the "${p.prefix}_" prefix — it must be ${ns}_-prefixed to its own module (ADR 0083 §Decision #5).`;
 }
 
 // ---- cross-root stem-collision detector ------------------------------------
@@ -186,6 +197,7 @@ function lineageReport({ core = [], instance = [], modulesByKey = {} } = {}) {
 
 module.exports = {
   CORE_NS,
+  RENAMED_MODULE_PREFIXES,
   INSTANCE_NS,
   RESERVED_NS,
   LEGACY_BARE_CORE_MAX,

package/scripts/gds/publish-manifest.js

@@ -61,7 +61,8 @@ const PUBLISH_ALLOWLIST = [
   'modules/sessions/',
   'modules/autonomy/',
   'modules/security/',
-  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true.
+  'modules/governance/',     // configurable roles & permissions (BV1 goal 1000030, ADR 0151) — the rank/permission machinery publishes AS the open-source methodology (ADR 0065 §4 / ADR 0098); it is in PROTECTED_GLOBS for write-protection, NOT publish-exclusion. default:true. Renamed → modules/government/ (ADR 0174); dropped with the folder in goal 1000068 R04.
+  'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/dev-box/',
@@ -74,7 +75,7 @@ const PUBLISH_ALLOWLIST = [
   'config/design-tokens.neutral.json',
   'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
   'config/hierarchy.neutral.json',
-  'config/governance.neutral.json',     // the starting role templates a fresh instance inherits (BV1.R96)
+  'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
   // --- the portable methodology core, governance, and sanitized docs ---
   'CLAUDE.md',
   'README.md',
@@ -211,7 +212,8 @@ const INSTANCE_EXCLUDE = [
   'config/modules.json',
   'config/devbox-app.json',
   'config/hierarchy.json',
-  'config/governance.json',
+  'config/government.json',
+  'config/governance.json',   // pre-ADR-0174 spelling — a live instance may still carry one; it is host content and stays denied
   'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
   // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
   // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from

package/scripts/gds/seed-governance-tasks.js

@@ -195,10 +195,10 @@ const TASKS = [
   {
     ref: 'R96', kind: 'feature', priority: 4, est_minutes: 100, manual_degree: 2, credits_reward: 40,
     criterion_ids: [C4], depends_on_refs: ['R93', 'R94'],
-    title: 'config/governance.json + neutral + resolve-over-neutral',
+    title: 'config/government.json + neutral + resolve-over-neutral',
     description: `**Why:** role templates/defaults are per-instance config (the branding pattern); live data is DB.
 
-**Done when:** \`config/governance.json\` (instance) resolves over \`config/governance.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
+**Done when:** \`config/government.json\` (instance) resolves over \`config/government.neutral.json\` (neutral) with env override on top, mirroring src/branding.js precedence; it seeds the starting role templates a fresh instance inherits; live assignments stay in the DB (R93). Depends on R93/R94.`,
   },
   {
     ref: 'R102', kind: 'verify', priority: 3, est_minutes: 70, manual_degree: 2, credits_reward: 35,

package/src/bongos/auth.js

@@ -367,7 +367,7 @@ async function maybeSeatFirstAdmin(builder) {
 // flips xenos→archon outside any transaction), and it quietly repairs a builder whose
 // assignment drifted for any other reason.
 //
-// Resolved through the `governance.roleSync` kernel port — auth.js is a KERNEL_FILE
+// Resolved through the `government.rankSync` kernel port — auth.js is a KERNEL_FILE
 // and may not require a module (ADR 0083 / ADR 0091 §1). Runs on the pool: there is
 // no surrounding transaction here, unlike the two rank-change paths, which pass their
 // own client so the rotation is atomic with the rank write.
@@ -377,8 +377,8 @@ async function maybeSeatFirstAdmin(builder) {
 async function safeSyncRankRole(builder) {
   if (!builder || builder.id == null) return;
   try {
-    await seams.resolveOptional('governance.roleSync')
-      ?.syncRankRole(null, { builderId: builder.id, rank: builder.rank });
+    await seams.resolveOptional('government.rankSync')
+      ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
   } catch (err) {
     console.error('[auth] rank-role sync failed (non-fatal):', err.message);
   }
@@ -1195,8 +1195,8 @@ async function resolveSession(req) {
 // a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
 //
 // GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
-// governance-owned data in modules/governance/session-scopes.json, validated
-// against the permission catalog at load by modules/governance/session-scopes.js.
+// governance-owned data in modules/government/session-scopes.json, validated
+// against the permission catalog at load by modules/government/session-scopes.js.
 // Core reads it as DATA with fs — never `require` (ADR 0083's one-way rule: a
 // module's code and enable/disable state must never be something the kernel
 // depends on). The sibling trust primitive permission-path-check.js reads the
@@ -1211,7 +1211,7 @@ async function resolveSession(req) {
 // registry does not declare is DENIED rather than defaulting to full authority. A
 // null/absent source is a DECLARED row (rows minted before migration 090 added the
 // column, which predate the 'box' source existing), not an implicit default.
-const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'session-scopes.json');
+const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'session-scopes.json');
 
 // Pure: validate + normalize the parsed registry. Split from the file read so the
 // shipped assertions are what the tests exercise. `label` identifies the file in
@@ -1440,7 +1440,7 @@ function signInWithReturn(req) {
 //   requireGovernancePage  was rank === 'archon'  floor archon → page.view.governance
 // That third gate was spelled `requireArchonPage` until ADR 0157 lowered
 // page.view.governance's floor archon→metic and the name stopped being true; the
-// floor now lives in modules/governance/catalog.js, not in the function's name.
+// floor now lives in modules/government/catalog.js, not in the function's name.
 // The one accepted divergence is the one governance_002 already documents
 // (tests/governance_parity.mjs Part D): a builder on a reserved/divine rank holds
 // no seeded role, so they now fail a page gate a bare rank test would have
@@ -1476,7 +1476,7 @@ const PAGE_GATES = Object.freeze({
 // through to the DB resolve, so the fold can only ever be an optimization.
 async function resolveHeldPermissions(builderId, rawKeys) {
   if (builderId === null || builderId === undefined || builderId === '') return null;
-  const governance = seams.resolveOptional('governance');
+  const governance = seams.resolveOptional('government');
   if (!governance || typeof governance.resolveBuilderPermissions !== 'function') return null;
   if (Array.isArray(rawKeys) && typeof governance.effectivePermissions === 'function') {
     try {
@@ -1723,7 +1723,7 @@ function requirePermission(...perms) {
     const deny = (held) => {
       const missing = held === null ? [...required] : required.filter((key) => !held.includes(key));
       const floors = {};
-      const governance = seams.resolveOptional('governance');
+      const governance = seams.resolveOptional('government');
       if (governance && typeof governance.permissionFloor === 'function') {
         for (const key of missing) {
           const floor = governance.permissionFloor(key);

package/src/bongos/db.js

@@ -338,10 +338,10 @@ function singleRungPromotionError(oldRank, newRank) {
 // has nothing to collide on, so it's returned unchanged. Pure + exported so
 // tests can exercise it without a DB; claimTask calls it inside the txn.
 
-// syncGovernanceRankRole — keep governance_builder_roles in step with builders.rank
-// (BV1.R95b, ADR 0151). Resolved through the `governance.roleSync` kernel port and
+// syncGovernanceRankRole — keep government_builder_ranks in step with builders.rank
+// (BV1.R95b, ADR 0151). Resolved through the `government.rankSync` kernel port and
 // run on the CALLER's transaction client, so the role rotation is atomic with the
-// rank write beside it. Core never requires modules/governance/ (ADR 0083).
+// rank write beside it. Core never requires modules/government/ (ADR 0083).
 //
 // A missing port means the governance module is disabled, and skipping is the
 // fail-closed answer: the builder then holds no role and resolves to ZERO
@@ -351,9 +351,9 @@ function singleRungPromotionError(oldRank, newRank) {
 // TWINNED with modules/lifecycle/db.js (the boundary-forced _applyRankChangeTx
 // duplication, ADR 0091 §2) — keep the two in sync.
 async function syncGovernanceRankRole(client, builderId, rank) {
-  const roleSync = seams.resolveOptional('governance.roleSync');
-  if (!roleSync || typeof roleSync.syncRankRole !== 'function') return null;
-  return roleSync.syncRankRole(client, { builderId, rank });
+  const roleSync = seams.resolveOptional('government.rankSync');
+  if (!roleSync || typeof roleSync.syncRank !== 'function') return null;
+  return roleSync.syncRank(client, { builderId, rank });
 }
 
 async function _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, reasonNote = null, enforceSingleRungPromotion = false }) {

package/src/bongos/module-scope-map.js

@@ -174,8 +174,29 @@ const MODULE_GLOBS = {
   //     role templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
+  //     RENAMED governance → government (goal 1000068, task 1003003, ADR 0174).
+  //     Both keys live through the transition and BOTH carry BOTH sets of globs,
+  //     so the wall is identical whichever key a goal names and whichever name
+  //     the folder currently has on disk. The `government` key must land BEFORE
+  //     R04 moves the folder: goals carry scope_modules by KEY, so moving the
+  //     folder first would leave goal 1000068's own wall not matching the files
+  //     its remaining tasks need to touch, blocking the rename mid-goal.
+  //     `modules/government/` is registered in protected-surfaces.json in the
+  //     same change — `protected` DERIVES from that registry, so without it this
+  //     key would compute protected:false and silently drop the Archon gate.
+  government: [
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
+    'config/governance.json', 'config/governance.neutral.json',
+  ],
+  //     DEPRECATED ALIAS — kept for one release so goals and tasks already
+  //     scoped to `governance` keep resolving. Removed by goal 1000068 R05
+  //     (task 1003006), the release that drops the /governance/* route aliases;
+  //     the two removals are the same compatibility window and should land
+  //     together.
   governance: [
-    'modules/governance/',
+    'modules/government/', 'modules/governance/',
+    'config/government.json', 'config/government.neutral.json',
     'config/governance.json', 'config/governance.neutral.json',
   ],
   // --- the two web surfaces ---

package/src/bongos/permission-path-check.js

@@ -40,7 +40,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // GOVERNANCE OWNS THE DATA; THE SUBSTRATE STAYS THE ENFORCER. Which paths are
 // protected, at what rank floor, mapped to which `system: true` catalog
 // permission, is governance-owned data in
-// modules/governance/protected-surfaces.json — no longer a constant baked into
+// modules/government/protected-surfaces.json — no longer a constant baked into
 // this file. Re-mapping a floor there is a POLICY edit. It cannot move
 // enforcement into the app: the three layers above (git pre-push hook, grader
 // pre-pass, post-push main audit) plus gate-review.js and the goal-scope check
@@ -61,7 +61,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // file that ships inside the core package next to this file (modules/ ships with
 // @bongos/core, ADR 0108 §1). The sibling trust primitive route-rank-check.js
 // already reads modules/*/routes/*.js off disk the same way, to rank-gate them.
-// Code still flows ONE way only: modules/governance/protected-surfaces.js →
+// Code still flows ONE way only: modules/government/protected-surfaces.js →
 // src/module-api.js → this matcher. Nothing in core requires the module.
 //
 // FAIL-CLOSED: a missing/empty/malformed registry THROWS. It never degrades to
@@ -71,7 +71,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 // Resolved from __dirname (this file is <coreRoot>/src/bongos/) rather than via
 // instance-config so the load keeps zero repo imports and works in a bare git
 // hook.
-const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'governance', 'protected-surfaces.json');
+const REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'protected-surfaces.json');
 
 function loadRegistry(file) {
   let raw;

package/src/bongos/route-rank-check.js

@@ -52,7 +52,7 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // classified 'any-builder': a downgrade that reads as legitimate. To classify it
 // honestly the auditor needs each atom's rank FLOOR (the rank that holds it under
 // governance's compat seed), which is declared exactly once — in
-// modules/governance/catalog.js. There is deliberately NO second permission→rank table
+// modules/government/catalog.js. There is deliberately NO second permission→rank table
 // here; a second list is a list that drifts.
 //
 // READ AS DATA, NOT require()d. ADR 0083's one-way rule forbids core from importing a
@@ -60,14 +60,14 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // core, so we parse the catalog's `floor:` declarations out of its SOURCE — the same
 // technique this file already applies to modules/*/routes/*.js, and the posture the
 // sibling trust primitive permission-path-check.js takes with
-// modules/governance/protected-surfaces.json. Like those, it runs with no DB, no
+// modules/government/protected-surfaces.json. Like those, it runs with no DB, no
 // server and no module loader, so it works inside a git hook.
 //
 // LAZY + FAIL-CLOSED. Loaded on first use, so an instance whose routes carry no
 // permission gate and no permission pin never reads it. An unreadable or empty catalog
 // THROWS rather than degrading to "every atom is unknown"; an atom the catalog does not
 // define classifies 'unknown', which hard-fails a write route.
-const CATALOG_PATH = path.join(MODULES_DIR, 'governance', 'catalog.js');
+const CATALOG_PATH = path.join(MODULES_DIR, 'government', 'catalog.js');
 // low → high authority. Mirrors catalog.js RANK_ORDER; the parse below rejects any
 // floor outside it, so a divergence surfaces as 'unknown' (loud) rather than as trust.
 const PERMISSION_RANK_ORDER = ['xenos', 'thetes', 'metic', 'archon'];
@@ -231,6 +231,21 @@ const EXPECTED_RANKS = {
   'GET /security/adr': 'metic+archon',
 };
 
+// The authz-core route pins, referenced by BOTH the `governance` and the
+// `government` module keys below while goal 1000068's rename is in flight
+// (ADR 0174, task 1003003). One object, two keys — never two literals.
+const GOVERNMENT_PINS = {
+  'GET /governance/roles': 'perm:governance.manage',
+  'GET /governance/permissions': 'perm:governance.manage',
+  'GET /governance/assignments': 'perm:governance.manage',
+  'POST /governance/roles': 'perm:governance.manage',
+  'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
+  'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
+  'POST /governance/assignments': 'perm:governance.manage',
+  'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
+};
+
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE
 // MODULE (modules/<key>/routes/…), pinned like EXPECTED_RANKS but verified ONLY
 // when that module is in scope (its routes were discovered in this scan). So an
@@ -400,24 +415,28 @@ const MODULE_EXPECTED_RANKS = {
     'POST /security/reports/:id/fix': 'perm:security.report.adjudicate',
     'POST /security/reports/:id/link-fix': 'perm:security.report.adjudicate',
   },
-  // The governance tab's server half (BV1.R110, ADR 0151) — the routes that EDIT
-  // the role/permission graph itself. Every route, the three reads included, is
-  // pinned to the `governance.manage` ATOM rather than a rank: on this surface
-  // the atom IS the authority (it is the catalog's meta-escalation key), and a
-  // downgrade here is the model's worst case — the routes that write authority
-  // drifting below the wall that guards authority. Reads are pinned too because
-  // the full role/grant/assignment map is the authority model's blueprint.
-  governance: {
-    'GET /governance/roles': 'perm:governance.manage',
-    'GET /governance/permissions': 'perm:governance.manage',
-    'GET /governance/assignments': 'perm:governance.manage',
-    'POST /governance/roles': 'perm:governance.manage',
-    'PUT /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'DELETE /governance/roles/:roleKey/permissions/:permissionKey': 'perm:governance.manage',
-    'POST /governance/roles/:roleKey/reset': 'perm:governance.manage',
-    'POST /governance/assignments': 'perm:governance.manage',
-    'DELETE /governance/assignments/:builderId/:roleKey': 'perm:governance.manage',
-  },
+  // The government tab's server half (BV1.R110, ADR 0151; renamed by ADR 0174) —
+  // the routes that EDIT the rank/permission graph itself. Every route, the three
+  // reads included, is pinned to the `governance.manage` ATOM rather than a rank:
+  // on this surface the atom IS the authority (it is the catalog's meta-escalation
+  // key), and a downgrade here is the model's worst case — the routes that write
+  // authority drifting below the wall that guards authority. Reads are pinned too
+  // because the full rank/grant/assignment map is the authority model's blueprint.
+  //
+  // The ROUTE PATHS and the `governance.manage` key are renamed by R05 (task
+  // 1003006), not here: R02 only makes the pins reachable under both module keys.
+  // Renaming the paths before the routes move would pin routes that do not exist
+  // and red the build for the whole window.
+  governance: GOVERNMENT_PINS,
+  // The same pins under the post-ADR-0174 module name (goal 1000068, task
+  // 1003003). Pins are applied only when the module directory is IN SCOPE — at
+  // least one route file was discovered under modules/<key>/ — so this entry is
+  // inert until R04 (task 1003005) moves the folder, and becomes load-bearing
+  // the moment it does, with no second edit needed. Both keys reference the SAME
+  // object rather than a copy: two literals here would be the "second list that
+  // drifts" failure mode this file exists to prevent, on the surface where a
+  // silent drift is worst.
+  government: GOVERNMENT_PINS,
 };
 
 // The rank a route's RANK middleware implies, or null when it carries none.

package/src/module-api.js

@@ -336,7 +336,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         and 2026-08-03 with no bump behind them, so no vendored-tarball instance
 //         could take any of them. Headline: the governance permission system
 //         (BV1.R95–R109 — resolver + kernel port, first-class principals, session
-//         scopes, requirePermission(), ownership-scoped grants, config/governance.json)
+//         scopes, requirePermission(), ownership-scoped grants, config/government.json)
 //         and the route-rank/validation hardening that followed it; the ship.js
 //         Windows project-path fix so Windows sessions actually get paid (89f291c);
 //         the sequential chain runner (task 1002484); Metic task abandon/un-abandon
@@ -791,8 +791,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.180 with no explicit bump. run 31972686846. (task 1002620)
 //   1.19.182 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.181 with no explicit bump. run 31972846686. (task 1002620)
+//   1.19.183 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.182 with no explicit bump. run 31973728179. (task 1002620)
+//   1.19.184 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.183 with no explicit bump. run 31974847472. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.182'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.184'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_page_gate.mjs

@@ -34,9 +34,9 @@ const auth = require('../src/bongos/auth.js');
 // exactly as tests/governance_require_permission.mjs stubs it for requirePermission.
 // The audience is unchanged; tests/governance_page_gates.mjs is the parity proof.
 const seams = require('../src/module-seams.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 seams._reset();
-seams.registerProvider('governance', {
+seams.registerProvider('government', {
   resolveBuilderPermissions: async () => catalog.seedForRank('xenos'),
 });
 

package/tests/criterion_authoring_gate.mjs

@@ -29,7 +29,7 @@ const buildDoneWhenRouter = require('../modules/lifecycle/routes/done-when.js');
 const { authorizeCriterionCreate } = buildDoneWhenRouter;
 const { authorizeGoalManagement, isGoalOwnerOrManager } = require('../modules/lifecycle/goal-authz.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
-const catalog = require('../modules/governance/catalog.js');
+const catalog = require('../modules/government/catalog.js');
 
 const doneWhenSrc = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
 const { test, summary } = makeRunner();

package/tests/governance_abuse_matrix.mjs

@@ -49,11 +49,11 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const api = require(path.join(ROOT, 'src', 'module-api.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
-const govConfig = require(path.join(ROOT, 'modules', 'governance', 'config.js'));
-const sessionScopes = require(path.join(ROOT, 'modules', 'governance', 'session-scopes.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
-const govDb = require(path.join(ROOT, 'modules', 'governance', 'db.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+const govConfig = require(path.join(ROOT, 'modules', 'government', 'config.js'));
+const sessionScopes = require(path.join(ROOT, 'modules', 'government', 'session-scopes.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
+const govDb = require(path.join(ROOT, 'modules', 'government', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
@@ -134,11 +134,11 @@ api.requireBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon
 
 function grant(keys) {
   seams._reset();
-  seams.registerProvider('governance', { resolveBuilderPermissions: async () => keys });
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => keys });
 }
 grant(['governance.manage']);
 
-const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
 const app = express();
 app.use(express.json());
 app.use(attachFail);

package/tests/governance_catalog.mjs

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const cat = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const cat = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 const { PERMISSIONS, RANK_ORDER, RANK_ROLE_SEED, permissionKeys, byKey, isSystem, isGrantable, systemKeys, grantableKeys, seedForRank } = cat;
 
 test('every permission is well-formed (key, boolean system, valid floor)', () => {

package/tests/governance_claim_eligibility.mjs

@@ -36,7 +36,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
-const catalog = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 

package/tests/governance_config.mjs

@@ -14,7 +14,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GOV = path.join(ROOT, 'modules', 'governance');
+const GOV = path.join(ROOT, 'modules', 'government');
 const config = require(path.join(GOV, 'config.js'));
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
@@ -157,7 +157,7 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
   // the CI gate (which does not scan .json itself — IDENTITY_SCAN_EXTS is js/html/css).
   const { scanPromptIdentity } = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
   const raw = fs.readFileSync(NEUTRAL_PATH, 'utf8');
-  assert.deepEqual(scanPromptIdentity('config/governance.neutral.json', raw, '.json'), []);
+  assert.deepEqual(scanPromptIdentity('config/government.neutral.json', raw, '.json'), []);
   // And it carries only templates — never a live per-builder assignment.
   assert.deepEqual(Object.keys(NEUTRAL).filter((k) => k !== '_note'), ['roles']);
   for (const role of Object.values(NEUTRAL.roles)) {
@@ -166,13 +166,13 @@ test('the neutral starter carries no host-specific identity (a vanilla instance
 });
 
 test('the two config paths are the branding-shaped neutral/instance pair under config/', () => {
-  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/governance.neutral.json');
-  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/governance.json');
+  assert.equal(path.relative(ROOT, NEUTRAL_PATH).split(path.sep).join('/'), 'config/government.neutral.json');
+  assert.equal(path.relative(ROOT, INSTANCE_PATH).split(path.sep).join('/'), 'config/government.json');
   assert.ok(fs.existsSync(NEUTRAL_PATH), 'the neutral starter must ship — it is the vanilla default');
 });
 
 test('loadGovernanceConfig reads the real neutral starter and tolerates a missing instance pack', () => {
-  // A vanilla instance has no config/governance.json at all — the default INSTANCE_PATH
+  // A vanilla instance has no config/government.json at all — the default INSTANCE_PATH
   // is genuinely absent in this checkout, so the default call exercises that path.
   assert.equal(fs.existsSync(INSTANCE_PATH), false, 'fixture guard: this checkout is the vanilla case');
   const out = loadGovernanceConfig({ env: NO_ENV });
@@ -182,6 +182,6 @@ test('loadGovernanceConfig reads the real neutral starter and tolerates a missin
 
 test('the neutral starter publishes with the core (a packaged vanilla instance needs it)', () => {
   const { isPublishable } = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
-  assert.equal(isPublishable('config/governance.neutral.json'), true);
-  assert.equal(isPublishable('config/governance.json'), false, "a host's filled-in pack is instance content");
+  assert.equal(isPublishable('config/government.neutral.json'), true);
+  assert.equal(isPublishable('config/government.json'), false, "a host's filled-in pack is instance content");
 });

package/tests/governance_fold.mjs

@@ -27,7 +27,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
 const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
-const resolver = require(path.join(ROOT, 'modules', 'governance', 'resolver.js'));
+const resolver = require(path.join(ROOT, 'modules', 'government', 'resolver.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
 function fakeRes() {
@@ -44,7 +44,7 @@ function fakeRes() {
 // One gate run against a stubbed port. `port` null = unregistered.
 async function run(req, port) {
   seams._reset();
-  if (port !== null) seams.registerProvider('governance', port);
+  if (port !== null) seams.registerProvider('government', port);
   const res = fakeRes();
   let nexted = false;
   await auth.requirePermission('idea.triage')(req, res, () => { nexted = true; });
@@ -121,7 +121,7 @@ test('the kernel shape guard: the real fragment embeds; a malformed one degrades
   assert.equal(dbKernel.sessionPermsSelect(), '', 'a fragment with a statement separator is refused');
   // The REAL registered fragment passes the guard verbatim.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
   buildGovernanceRouter();
   const real = seams.resolveOptional('session-grants-sql').selectFragment;
   assert.equal(dbKernel.sessionPermsSelect(), real, 'the shipped fragment embeds unchanged');
@@ -133,7 +133,7 @@ test('the module registers the capability-named SQL seam the kernel embeds', ()
   // §Decision #4); the governance route factory is what registers it. Pin the
   // registration and the column contract the kernel query depends on.
   seams._reset();
-  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'governance', 'routes', 'governance.js'));
+  const buildGovernanceRouter = require(path.join(ROOT, 'modules', 'government', 'routes', 'governance.js'));
   buildGovernanceRouter();
   const provider = seams.resolveOptional('session-grants-sql');
   assert.ok(provider && typeof provider.selectFragment === 'string', 'fragment provider registered');